Function at 0x4d2570
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x513bc8
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x16e4
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x2c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x4d25c9
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
jge 0x4d25da
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
jmp 0x4d25c0
cmp dword [ebp - 0x1c], 0
jge 0x4d25e8
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d2600
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0
jmp 0x4d2612
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x1e
jge 0x4d2656
cmp dword [ebp - 0x1c], 0
jge 0x4d2626
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d263c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0xfa
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d2609
mov dword [ebp - 0x22c], 0
jmp 0x4d2671
mov ecx, dword [ebp - 0x22c]
add ecx, 1
mov dword [ebp - 0x22c], ecx
cmp dword [ebp - 0x22c], 0x18
jge 0x4d26b2
cmp dword [ebp - 0x1c], 0
jge 0x4d2688
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d269e
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d2662
mov dword [ebp - 0x42c], 0
jmp 0x4d26cd
mov eax, dword [ebp - 0x42c]
add eax, 1
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 4
jge 0x4d271a
mov eax, dword [ebp - 0x42c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d26fc
mov eax, dword [ebp - 0x42c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d270c
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x42c]
mov dword [ebp - 0x1c], edx
jmp 0x4d2718
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x42c]
mov dword [ebp - 0x1c], eax
jmp 0x4d26be
mov dword [ebp - 0x430], 0
jmp 0x4d2735
mov ecx, dword [ebp - 0x430]
add ecx, 1
mov dword [ebp - 0x430], ecx
cmp dword [ebp - 0x430], 9
jge 0x4d274c
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x430]
mov dword [ebp - 0x1c], edx
jmp 0x4d2726
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d275e
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d2776
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4d27b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x434]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d27a2
jmp 0x4d27b0
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x434]
mov dword [ebp - 0x1c], edx
jmp 0x4d2776
mov eax, dword [ebp - 0x1c]
add eax, 0x1f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x438], 0
jmp 0x4d27d4
mov ecx, dword [ebp - 0x438]
add ecx, 1
mov dword [ebp - 0x438], ecx
cmp dword [ebp - 0x438], 0x11
jge 0x4d2821
mov eax, dword [ebp - 0x438]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d2803
mov eax, dword [ebp - 0x438]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d2813
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x438]
mov dword [ebp - 0x1c], edx
jmp 0x4d281f
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x438]
mov dword [ebp - 0x1c], eax
jmp 0x4d27c5
mov dword [ebp - 0x43c], 0
jmp 0x4d283c
mov ecx, dword [ebp - 0x43c]
add ecx, 1
mov dword [ebp - 0x43c], ecx
cmp dword [ebp - 0x43c], 8
jge 0x4d2853
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x43c]
mov dword [ebp - 0x1c], edx
jmp 0x4d282d
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d2865
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d287d
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x440], 0xffffffff
mov dword [ebp - 0x444], 0
jmp 0x4d28a9
mov edx, dword [ebp - 0x444]
add edx, 1
mov dword [ebp - 0x444], edx
cmp dword [ebp - 0x444], 0x10
jge 0x4d28db
mov eax, dword [ebp - 0x444]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d28d0
mov edx, dword [ebp - 0x440]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d289a
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d28fb
mov dword [ebp - 4], 1
mov dword [ebp - 0x448], 0xffffffff
mov dword [ebp - 0x44c], 0
jmp 0x4d2927
mov edx, dword [ebp - 0x44c]
add edx, 1
mov dword [ebp - 0x44c], edx
cmp dword [ebp - 0x44c], 5
jge 0x4d2959
mov eax, dword [ebp - 0x44c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d294e
mov edx, dword [ebp - 0x448]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d2918
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d2979
mov dword [ebp - 0x450], 0
jmp 0x4d2994
mov edx, dword [ebp - 0x450]
add edx, 1
mov dword [ebp - 0x450], edx
cmp dword [ebp - 0x450], 0
jge 0x4d29ab
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x450]
mov dword [ebp - 0x1c], eax
jmp 0x4d2985
cmp dword [ebp - 0x1c], 0
jge 0x4d29b9
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d29d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x454], 0
jmp 0x4d29ec
mov edx, dword [ebp - 0x454]
add edx, 1
mov dword [ebp - 0x454], edx
cmp dword [ebp - 0x454], 2
jge 0x4d2a03
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x454]
mov dword [ebp - 0x1c], eax
jmp 0x4d29dd
cmp dword [ebp - 0x1c], 0
jge 0x4d2a11
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d2a29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x458], 0
jmp 0x4d2a44
mov edx, dword [ebp - 0x458]
add edx, 1
mov dword [ebp - 0x458], edx
cmp dword [ebp - 0x458], 5
jge 0x4d2a91
cmp dword [ebp - 0x1c], 0
jge 0x4d2a5b
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d2a71
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x45c], 0xfa
lea edx, [ebp - 0x45c]
push edx
lea eax, [ebp - 0x658]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d2a35
mov dword [ebp - 4], 2
mov dword [ebp - 0x65c], 0xffffffff
mov dword [ebp - 0x660], 0
jmp 0x4d2abd
mov ecx, dword [ebp - 0x660]
add ecx, 1
mov dword [ebp - 0x660], ecx
cmp dword [ebp - 0x660], 0
jge 0x4d2aef
mov eax, dword [ebp - 0x660]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d2ae4
mov edx, dword [ebp - 0x65c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d2aae
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d2b0f
mov edx, 1
test edx, edx
je 0x4d2b49
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x664]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d2b3b
jmp 0x4d2b49
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x664]
mov dword [ebp - 0x1c], edx
jmp 0x4d2b0f
mov eax, dword [ebp - 0x1c]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x668], 0
jmp 0x4d2b6d
mov ecx, dword [ebp - 0x668]
add ecx, 1
mov dword [ebp - 0x668], ecx
cmp dword [ebp - 0x668], 3
jge 0x4d2b84
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x668]
mov dword [ebp - 0x1c], edx
jmp 0x4d2b5e
cmp dword [ebp - 0x1c], 0
jge 0x4d2b92
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d2baa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x66c], 0
jmp 0x4d2bc5
mov edx, dword [ebp - 0x66c]
add edx, 1
mov dword [ebp - 0x66c], edx
cmp dword [ebp - 0x66c], 2
jge 0x4d2bdc
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x66c]
mov dword [ebp - 0x1c], eax
jmp 0x4d2bb6
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d2bee
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d2c06
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x670], 0
jmp 0x4d2c21
mov edx, dword [ebp - 0x670]
add edx, 1
mov dword [ebp - 0x670], edx
cmp dword [ebp - 0x670], 6
jge 0x4d2c6e
cmp dword [ebp - 0x1c], 0
jge 0x4d2c38
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d2c4e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x674], 0xfa
lea edx, [ebp - 0x674]
push edx
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d2c12
mov dword [ebp - 0x874], 0
jmp 0x4d2c89
mov ecx, dword [ebp - 0x874]
add ecx, 1
mov dword [ebp - 0x874], ecx
cmp dword [ebp - 0x874], 3
jge 0x4d2cd6
mov eax, dword [ebp - 0x874]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d2cb8
mov eax, dword [ebp - 0x874]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d2cc8
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x874]
mov dword [ebp - 0x1c], edx
jmp 0x4d2cd4
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x874]
mov dword [ebp - 0x1c], eax
jmp 0x4d2c7a
mov ecx, 1
test ecx, ecx
je 0x4d2d10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x878]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d2d02
jmp 0x4d2d10
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x878]
mov dword [ebp - 0x1c], edx
jmp 0x4d2cd6
mov eax, dword [ebp - 0x1c]
add eax, 7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x87c], 0
jmp 0x4d2d34
mov ecx, dword [ebp - 0x87c]
add ecx, 1
mov dword [ebp - 0x87c], ecx
cmp dword [ebp - 0x87c], 7
jge 0x4d2d4b
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x87c]
mov dword [ebp - 0x1c], edx
jmp 0x4d2d25
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d2d5d
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d2d75
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x880], 0
jmp 0x4d2d90
mov edx, dword [ebp - 0x880]
add edx, 1
mov dword [ebp - 0x880], edx
cmp dword [ebp - 0x880], 0
jge 0x4d2ddd
cmp dword [ebp - 0x1c], 0
jge 0x4d2da7
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d2dbd
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x884], 0xfa
lea edx, [ebp - 0x884]
push edx
lea eax, [ebp - 0xa80]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d2d81
mov dword [ebp - 4], 3
mov dword [ebp - 0xa84], 0xffffffff
mov dword [ebp - 0xa88], 0
jmp 0x4d2e09
mov ecx, dword [ebp - 0xa88]
add ecx, 1
mov dword [ebp - 0xa88], ecx
cmp dword [ebp - 0xa88], 8
jge 0x4d2e3b
mov eax, dword [ebp - 0xa88]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d2e30
mov edx, dword [ebp - 0xa84]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d2dfa
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d2e5b
mov edx, 1
test edx, edx
je 0x4d2e95
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xa8c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d2e87
jmp 0x4d2e95
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xa8c]
mov dword [ebp - 0x1c], edx
jmp 0x4d2e5b
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4d2ed8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xa90]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d2eca
jmp 0x4d2ed8
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xa90]
mov dword [ebp - 0x1c], edx
jmp 0x4d2e9e
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa94], 0
jmp 0x4d2efc
mov ecx, dword [ebp - 0xa94]
add ecx, 1
mov dword [ebp - 0xa94], ecx
cmp dword [ebp - 0xa94], 6
jge 0x4d2f49
cmp dword [ebp - 0x1c], 0
jge 0x4d2f13
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d2f29
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xa98], 0xfa
lea edx, [ebp - 0xa98]
push edx
lea eax, [ebp - 0xc90]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d2eed
mov dword [ebp - 4], 4
mov dword [ebp - 0xc94], 0xffffffff
mov dword [ebp - 0xc98], 0
jmp 0x4d2f75
mov ecx, dword [ebp - 0xc98]
add ecx, 1
mov dword [ebp - 0xc98], ecx
cmp dword [ebp - 0xc98], 0
jge 0x4d2fa7
mov eax, dword [ebp - 0xc98]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d2f9c
mov edx, dword [ebp - 0xc94]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d2f66
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d2fc7
mov dword [ebp - 0xc9c], 0
jmp 0x4d2fe2
mov edx, dword [ebp - 0xc9c]
add edx, 1
mov dword [ebp - 0xc9c], edx
cmp dword [ebp - 0xc9c], 5
jge 0x4d3023
cmp dword [ebp - 0x1c], 0
jge 0x4d2ff9
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d300f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xe98]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d2fd3
mov eax, 1
test eax, eax
je 0x4d305d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xe9c], eax
mov eax, dword [ebp - 0xe9c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d304f
jmp 0x4d305d
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xe9c]
mov dword [ebp - 0x1c], edx
jmp 0x4d3023
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xea0], 0
jmp 0x4d3081
mov ecx, dword [ebp - 0xea0]
add ecx, 1
mov dword [ebp - 0xea0], ecx
cmp dword [ebp - 0xea0], 6
jge 0x4d30ce
mov eax, dword [ebp - 0xea0]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d30b0
mov eax, dword [ebp - 0xea0]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d30c0
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xea0]
mov dword [ebp - 0x1c], edx
jmp 0x4d30cc
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xea0]
mov dword [ebp - 0x1c], eax
jmp 0x4d3072
mov dword [ebp - 0xea4], 0
jmp 0x4d30e9
mov ecx, dword [ebp - 0xea4]
add ecx, 1
mov dword [ebp - 0xea4], ecx
cmp dword [ebp - 0xea4], 8
jge 0x4d3136
cmp dword [ebp - 0x1c], 0
jge 0x4d3100
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d3116
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xea8], 0xfa
lea edx, [ebp - 0xea8]
push edx
lea eax, [ebp - 0x10a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d30da
mov dword [ebp - 0x10a4], 0
jmp 0x4d3151
mov ecx, dword [ebp - 0x10a4]
add ecx, 1
mov dword [ebp - 0x10a4], ecx
cmp dword [ebp - 0x10a4], 0
jge 0x4d319e
cmp dword [ebp - 0x1c], 0
jge 0x4d3168
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d317e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10a8], 0xfa
lea edx, [ebp - 0x10a8]
push edx
lea eax, [ebp - 0x12a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d3142
mov ecx, 1
test ecx, ecx
je 0x4d31d8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x12a4], eax
mov eax, dword [ebp - 0x12a4]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d31ca
jmp 0x4d31d8
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x12a4]
mov dword [ebp - 0x1c], edx
jmp 0x4d319e
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x12a8], 0
jmp 0x4d31fc
mov ecx, dword [ebp - 0x12a8]
add ecx, 1
mov dword [ebp - 0x12a8], ecx
cmp dword [ebp - 0x12a8], 3
jge 0x4d3249
cmp dword [ebp - 0x1c], 0
jge 0x4d3213
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d3229
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x12ac], 0xfa
lea edx, [ebp - 0x12ac]
push edx
lea eax, [ebp - 0x14a8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d31ed
mov dword [ebp - 0x14ac], 0
jmp 0x4d3264
mov ecx, dword [ebp - 0x14ac]
add ecx, 1
mov dword [ebp - 0x14ac], ecx
cmp dword [ebp - 0x14ac], 2
jge 0x4d32b1
mov eax, dword [ebp - 0x14ac]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d3293
mov eax, dword [ebp - 0x14ac]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d32a3
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14ac]
mov dword [ebp - 0x1c], edx
jmp 0x4d32af
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x14ac]
mov dword [ebp - 0x1c], eax
jmp 0x4d3255
mov dword [ebp - 0x14b0], 0
jmp 0x4d32cc
mov ecx, dword [ebp - 0x14b0]
add ecx, 1
mov dword [ebp - 0x14b0], ecx
cmp dword [ebp - 0x14b0], 1
jge 0x4d32e3
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x14b0]
mov dword [ebp - 0x1c], edx
jmp 0x4d32bd
cmp dword [ebp - 0x1c], 0
jge 0x4d32f1
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d3309
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14b4], 0
jmp 0x4d3324
mov edx, dword [ebp - 0x14b4]
add edx, 1
mov dword [ebp - 0x14b4], edx
cmp dword [ebp - 0x14b4], 0
jge 0x4d333b
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14b4]
mov dword [ebp - 0x1c], eax
jmp 0x4d3315
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d334d
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3365
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14b8], 0
jmp 0x4d3380
mov edx, dword [ebp - 0x14b8]
add edx, 1
mov dword [ebp - 0x14b8], edx
cmp dword [ebp - 0x14b8], 3
jge 0x4d33c1
cmp dword [ebp - 0x1c], 0
jge 0x4d3397
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d33ad
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x16b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d3371
mov dword [ebp - 0x16b4], 0
jmp 0x4d33dc
mov eax, dword [ebp - 0x16b4]
add eax, 1
mov dword [ebp - 0x16b4], eax
cmp dword [ebp - 0x16b4], 3
jge 0x4d33f3
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x16b4]
mov dword [ebp - 0x1c], ecx
jmp 0x4d33cd
cmp dword [ebp - 0x1c], 0
jge 0x4d3401
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d3419
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x16b8], 0
jmp 0x4d3434
mov edx, dword [ebp - 0x16b8]
add edx, 1
mov dword [ebp - 0x16b8], edx
cmp dword [ebp - 0x16b8], 4
jge 0x4d344b
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x16b8]
mov dword [ebp - 0x1c], eax
jmp 0x4d3425
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d345d
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3475
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x16bc], 0
jmp 0x4d3490
mov edx, dword [ebp - 0x16bc]
add edx, 1
mov dword [ebp - 0x16bc], edx
cmp dword [ebp - 0x16bc], 2
jge 0x4d34a7
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x16bc]
mov dword [ebp - 0x1c], eax
jmp 0x4d3481
cmp dword [ebp - 0x1c], 0
jge 0x4d34b5
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d34cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x16c0], 0
jmp 0x4d34e8
mov edx, dword [ebp - 0x16c0]
add edx, 1
mov dword [ebp - 0x16c0], edx
cmp dword [ebp - 0x16c0], 4
jge 0x4d34ff
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x16c0]
mov dword [ebp - 0x1c], eax
jmp 0x4d34d9
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d3511
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3529
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x16c4], 0xffffffff
mov dword [ebp - 0x16c8], 0
jmp 0x4d3555
mov edx, dword [ebp - 0x16c8]
add edx, 1
mov dword [ebp - 0x16c8], edx
cmp dword [ebp - 0x16c8], 3
jge 0x4d3587
mov eax, dword [ebp - 0x16c8]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d357c
mov edx, dword [ebp - 0x16c4]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d3546
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d35a7
mov dword [ebp - 4], 6
mov dword [ebp - 0x16cc], 0xffffffff
mov dword [ebp - 0x16d0], 0
jmp 0x4d35d3
mov edx, dword [ebp - 0x16d0]
add edx, 1
mov dword [ebp - 0x16d0], edx
cmp dword [ebp - 0x16d0], 4
jge 0x4d3605
mov eax, dword [ebp - 0x16d0]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d35fa
mov edx, dword [ebp - 0x16cc]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d35c4
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d3625
mov dword [ebp - 0x16d4], 0
jmp 0x4d3640
mov edx, dword [ebp - 0x16d4]
add edx, 1
mov dword [ebp - 0x16d4], edx
cmp dword [ebp - 0x16d4], 2
jge 0x4d3657
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x16d4]
mov dword [ebp - 0x1c], eax
jmp 0x4d3631
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d3669
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3681
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x16d8], 0
jmp 0x4d369c
mov edx, dword [ebp - 0x16d8]
add edx, 1
mov dword [ebp - 0x16d8], edx
cmp dword [ebp - 0x16d8], 1
jge 0x4d36b3
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x16d8]
mov dword [ebp - 0x1c], eax
jmp 0x4d368d
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d36c5
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d36dd
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4d3717
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x16dc], eax
mov eax, dword [ebp - 0x16dc]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d3709
jmp 0x4d3717
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x16dc]
mov dword [ebp - 0x1c], edx
jmp 0x4d36dd
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x16e0], 0
jmp 0x4d373b
mov ecx, dword [ebp - 0x16e0]
add ecx, 1
mov dword [ebp - 0x16e0], ecx
cmp dword [ebp - 0x16e0], 3
jge 0x4d3752
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x16e0]
mov dword [ebp - 0x1c], edx
jmp 0x4d372c
cmp dword [ebp - 0x1c], 0
jge 0x4d3760
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d3778