Function at 0x492320
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x512718
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x105c
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x492379
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x4923bd
cmp dword [ebp - 0x1c], 0
jge 0x49238d
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4923a3
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0xfa
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x492370
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0xffffffff
mov dword [ebp - 0x228], 0
jmp 0x4923e9
mov ecx, dword [ebp - 0x228]
add ecx, 1
mov dword [ebp - 0x228], ecx
cmp dword [ebp - 0x228], 0xb
jge 0x49241b
mov eax, dword [ebp - 0x228]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x492410
mov edx, dword [ebp - 0x224]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4923da
mov dword [ebp - 4], 0xfffffffe
jmp 0x49243b
mov dword [ebp - 0x22c], 0
jmp 0x492456
mov edx, dword [ebp - 0x22c]
add edx, 1
mov dword [ebp - 0x22c], edx
cmp dword [ebp - 0x22c], 0x3f
jge 0x4924a3
mov eax, dword [ebp - 0x22c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x492485
mov eax, dword [ebp - 0x22c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x492495
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x22c]
mov dword [ebp - 0x1c], edx
jmp 0x4924a1
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x22c]
mov dword [ebp - 0x1c], eax
jmp 0x492447
mov dword [ebp - 0x230], 0
jmp 0x4924be
mov ecx, dword [ebp - 0x230]
add ecx, 1
mov dword [ebp - 0x230], ecx
cmp dword [ebp - 0x230], 0x40
jge 0x4924d5
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x230]
mov dword [ebp - 0x1c], edx
jmp 0x4924af
cmp dword [ebp - 0x1c], 0
jge 0x4924e3
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4924fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x234], 0
jmp 0x492516
mov edx, dword [ebp - 0x234]
add edx, 1
mov dword [ebp - 0x234], edx
cmp dword [ebp - 0x234], 0x17
jge 0x492563
mov eax, dword [ebp - 0x234]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x492545
mov eax, dword [ebp - 0x234]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x492555
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x234]
mov dword [ebp - 0x1c], edx
jmp 0x492561
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x234]
mov dword [ebp - 0x1c], eax
jmp 0x492507
mov dword [ebp - 0x238], 0
jmp 0x49257e
mov ecx, dword [ebp - 0x238]
add ecx, 1
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 6
jge 0x4925bf
cmp dword [ebp - 0x1c], 0
jge 0x492595
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4925ab
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49256f
mov dword [ebp - 0x434], 0
jmp 0x4925da
mov eax, dword [ebp - 0x434]
add eax, 1
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0xd
jge 0x49261b
cmp dword [ebp - 0x1c], 0
jge 0x4925f1
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x492607
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4925cb
mov dword [ebp - 0x634], 0
jmp 0x492636
mov eax, dword [ebp - 0x634]
add eax, 1
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0xb
jge 0x49264d
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x634]
mov dword [ebp - 0x1c], ecx
jmp 0x492627
cmp dword [ebp - 0x1c], 0
jge 0x49265b
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x492673
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x638], 0xffffffff
mov dword [ebp - 0x63c], 0
jmp 0x49269f
mov edx, dword [ebp - 0x63c]
add edx, 1
mov dword [ebp - 0x63c], edx
cmp dword [ebp - 0x63c], 0x20
jge 0x4926d1
mov eax, dword [ebp - 0x63c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4926c6
mov edx, dword [ebp - 0x638]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x492690
mov dword [ebp - 4], 0xfffffffe
jmp 0x4926f1
mov dword [ebp - 0x640], 0
jmp 0x49270c
mov edx, dword [ebp - 0x640]
add edx, 1
mov dword [ebp - 0x640], edx
cmp dword [ebp - 0x640], 0x13
jge 0x492759
mov eax, dword [ebp - 0x640]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x49273b
mov eax, dword [ebp - 0x640]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x49274b
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x640]
mov dword [ebp - 0x1c], edx
jmp 0x492757
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x640]
mov dword [ebp - 0x1c], eax
jmp 0x4926fd
mov ecx, 1
test ecx, ecx
je 0x492793
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x492785
jmp 0x492793
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x644]
mov dword [ebp - 0x1c], edx
jmp 0x492759
mov eax, dword [ebp - 0x1c]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x648], 0
jmp 0x4927b7
mov ecx, dword [ebp - 0x648]
add ecx, 1
mov dword [ebp - 0x648], ecx
cmp dword [ebp - 0x648], 1
jge 0x4927ce
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x648]
mov dword [ebp - 0x1c], edx
jmp 0x4927a8
cmp dword [ebp - 0x1c], 0
jge 0x4927dc
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4927f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x64c], 0
jmp 0x49280f
mov edx, dword [ebp - 0x64c]
add edx, 1
mov dword [ebp - 0x64c], edx
cmp dword [ebp - 0x64c], 3
jge 0x492826
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x64c]
mov dword [ebp - 0x1c], eax
jmp 0x492800
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x492838
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x492850
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x650], 0
jmp 0x49286b
mov edx, dword [ebp - 0x650]
add edx, 1
mov dword [ebp - 0x650], edx
cmp dword [ebp - 0x650], 6
jge 0x4928b8
mov eax, dword [ebp - 0x650]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x49289a
mov eax, dword [ebp - 0x650]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4928aa
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x650]
mov dword [ebp - 0x1c], edx
jmp 0x4928b6
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x650]
mov dword [ebp - 0x1c], eax
jmp 0x49285c
mov dword [ebp - 0x654], 0
jmp 0x4928d3
mov ecx, dword [ebp - 0x654]
add ecx, 1
mov dword [ebp - 0x654], ecx
cmp dword [ebp - 0x654], 2
jge 0x492920
cmp dword [ebp - 0x1c], 0
jge 0x4928ea
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x492900
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x658], 0xfa
lea edx, [ebp - 0x658]
push edx
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4928c4
mov dword [ebp - 0x854], 0
jmp 0x49293b
mov ecx, dword [ebp - 0x854]
add ecx, 1
mov dword [ebp - 0x854], ecx
cmp dword [ebp - 0x854], 9
jge 0x49297c
cmp dword [ebp - 0x1c], 0
jge 0x492952
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x492968
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa50]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49292c
mov dword [ebp - 0xa54], 0
jmp 0x492997
mov eax, dword [ebp - 0xa54]
add eax, 1
mov dword [ebp - 0xa54], eax
cmp dword [ebp - 0xa54], 9
jge 0x4929ae
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0xa54]
mov dword [ebp - 0x1c], ecx
jmp 0x492988
cmp dword [ebp - 0x1c], 0
jge 0x4929bc
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4929d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x492a0e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0xa58]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x492a00
jmp 0x492a0e
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xa58]
mov dword [ebp - 0x1c], edx
jmp 0x4929d4
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa5c], 0
jmp 0x492a32
mov ecx, dword [ebp - 0xa5c]
add ecx, 1
mov dword [ebp - 0xa5c], ecx
cmp dword [ebp - 0xa5c], 0xc
jge 0x492a49
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xa5c]
mov dword [ebp - 0x1c], edx
jmp 0x492a23
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x492a5b
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x492a73
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa60], 0
jmp 0x492a8e
mov edx, dword [ebp - 0xa60]
add edx, 1
mov dword [ebp - 0xa60], edx
cmp dword [ebp - 0xa60], 3
jge 0x492adb
cmp dword [ebp - 0x1c], 0
jge 0x492aa5
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x492abb
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xa64], 0xfa
lea edx, [ebp - 0xa64]
push edx
lea eax, [ebp - 0xc60]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x492a7f
mov dword [ebp - 0xc64], 0
jmp 0x492af6
mov ecx, dword [ebp - 0xc64]
add ecx, 1
mov dword [ebp - 0xc64], ecx
cmp dword [ebp - 0xc64], 5
jge 0x492b0d
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0xc64]
mov dword [ebp - 0x1c], edx
jmp 0x492ae7
cmp dword [ebp - 0x1c], 0
jge 0x492b1b
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x492b33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc68], 0
jmp 0x492b4e
mov edx, dword [ebp - 0xc68]
add edx, 1
mov dword [ebp - 0xc68], edx
cmp dword [ebp - 0xc68], 6
jge 0x492b65
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc68]
mov dword [ebp - 0x1c], eax
jmp 0x492b3f
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x492b77
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x492b8f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc6c], 0
jmp 0x492baa
mov edx, dword [ebp - 0xc6c]
add edx, 1
mov dword [ebp - 0xc6c], edx
cmp dword [ebp - 0xc6c], 3
jge 0x492bf7
cmp dword [ebp - 0x1c], 0
jge 0x492bc1
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x492bd7
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc70], 0xfa
lea edx, [ebp - 0xc70]
push edx
lea eax, [ebp - 0xe68]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x492b9b
mov dword [ebp - 0xe6c], 0
jmp 0x492c12
mov ecx, dword [ebp - 0xe6c]
add ecx, 1
mov dword [ebp - 0xe6c], ecx
cmp dword [ebp - 0xe6c], 0
jge 0x492c5f
cmp dword [ebp - 0x1c], 0
jge 0x492c29
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x492c3f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xe70], 0xfa
lea edx, [ebp - 0xe70]
push edx
lea eax, [ebp - 0x1068]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x492c03
mov ecx, 1
test ecx, ecx
je 0x492c99
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x106c], eax
mov eax, dword [ebp - 0x106c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x492c8b
jmp 0x492c99
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x106c]
mov dword [ebp - 0x1c], edx
jmp 0x492c5f
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x1070], 0xffffffff
mov dword [ebp - 0x1074], 0
jmp 0x492cce
mov ecx, dword [ebp - 0x1074]
add ecx, 1
mov dword [ebp - 0x1074], ecx
cmp dword [ebp - 0x1074], 0
jge 0x492d00
mov eax, dword [ebp - 0x1074]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x492cf5
mov edx, dword [ebp - 0x1070]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x492cbf
mov dword [ebp - 4], 0xfffffffe
jmp 0x492d20
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret