Function at 0x474ee0
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x511d88
push 0x40b390
mov eax, dword fs:[0]
push eax
add esp, 0xfffff5a0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x58], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x474f32
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x474f70
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x474f58
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x474f65
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
jmp 0x474f6e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x474f29
mov dword [ebp - 0x24], 0
jmp 0x474f82
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x1f
jge 0x474f93
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
jmp 0x474f79
cmp dword [ebp - 0x1c], 0
jge 0x474fa1
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x474fb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
jmp 0x474fcb
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xe
jge 0x474fdc
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
jmp 0x474fc2
cmp dword [ebp - 0x1c], 0
jge 0x474fea
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x475002
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0
jmp 0x475014
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xd
jge 0x475052
mov eax, dword [ebp - 0x2c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x47503a
mov eax, dword [ebp - 0x2c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x475047
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
jmp 0x475050
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
jmp 0x47500b
mov dword [ebp - 0x30], 0
jmp 0x475064
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 6
jge 0x475075
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], edx
jmp 0x47505b
cmp dword [ebp - 0x1c], 0
jge 0x475083
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47509b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0
jmp 0x4750ad
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 4
jge 0x4750be
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp 0x4750a4
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4750d0
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4750e8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x475119
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x47510e
jmp 0x475119
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], edx
jmp 0x4750e8
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x40], 0
jmp 0x475142
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 4
jge 0x47516b
mov eax, dword [ebp - 0x40]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x475160
mov edx, dword [ebp - 0x3c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x475139
mov dword [ebp - 4], 0xfffffffe
jmp 0x47518b
mov dword [ebp - 0x44], 0
jmp 0x47519d
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0
jge 0x4751db
mov eax, dword [ebp - 0x44]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4751c3
mov eax, dword [ebp - 0x44]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4751d0
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], edx
jmp 0x4751d9
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
jmp 0x475194
mov dword [ebp - 4], 1
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x4c], 0
jmp 0x4751fb
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 1
jge 0x475224
mov eax, dword [ebp - 0x4c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x475219
mov edx, dword [ebp - 0x48]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4751f2
mov dword [ebp - 4], 0xfffffffe
jmp 0x475244
mov dword [ebp - 0x50], 0
jmp 0x475256
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], 3
jge 0x47529a
cmp dword [ebp - 0x1c], 0
jge 0x47526a
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x475280
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x54], 0xfa
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x47524d
mov ecx, 1
test ecx, ecx
je 0x4752d4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4752c6
jmp 0x4752d4
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x254]
mov dword [ebp - 0x1c], edx
jmp 0x47529a
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x258], 0
jmp 0x4752f8
mov ecx, dword [ebp - 0x258]
add ecx, 1
mov dword [ebp - 0x258], ecx
cmp dword [ebp - 0x258], 1
jge 0x47530f
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x258]
mov dword [ebp - 0x1c], edx
jmp 0x4752e9
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x475321
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x475339
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x25c], 0
jmp 0x475354
mov edx, dword [ebp - 0x25c]
add edx, 1
mov dword [ebp - 0x25c], edx
cmp dword [ebp - 0x25c], 1
jge 0x47536b
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x25c]
mov dword [ebp - 0x1c], eax
jmp 0x475345
cmp dword [ebp - 0x1c], 0
jge 0x475379
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x475391
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x260], 0xffffffff
mov dword [ebp - 0x264], 0
jmp 0x4753bd
mov edx, dword [ebp - 0x264]
add edx, 1
mov dword [ebp - 0x264], edx
cmp dword [ebp - 0x264], 3
jge 0x4753ef
mov eax, dword [ebp - 0x264]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4753e4
mov edx, dword [ebp - 0x260]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4753ae
mov dword [ebp - 4], 0xfffffffe
jmp 0x47540f
mov edx, 1
test edx, edx
je 0x475449
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x268]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x47543b
jmp 0x475449
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x268]
mov dword [ebp - 0x1c], edx
jmp 0x47540f
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x26c], 0
jmp 0x47546d
mov ecx, dword [ebp - 0x26c]
add ecx, 1
mov dword [ebp - 0x26c], ecx
cmp dword [ebp - 0x26c], 3
jge 0x4754ba
mov eax, dword [ebp - 0x26c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x47549c
mov eax, dword [ebp - 0x26c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4754ac
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x26c]
mov dword [ebp - 0x1c], edx
jmp 0x4754b8
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x26c]
mov dword [ebp - 0x1c], eax
jmp 0x47545e
mov dword [ebp - 0x270], 0
jmp 0x4754d5
mov ecx, dword [ebp - 0x270]
add ecx, 1
mov dword [ebp - 0x270], ecx
cmp dword [ebp - 0x270], 1
jge 0x475516
cmp dword [ebp - 0x1c], 0
jge 0x4754ec
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x475502
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x468]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4754c6
mov dword [ebp - 0x46c], 0
jmp 0x475531
mov eax, dword [ebp - 0x46c]
add eax, 1
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 4
jge 0x47557e
mov eax, dword [ebp - 0x46c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x475560
mov eax, dword [ebp - 0x46c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x475570
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x46c]
mov dword [ebp - 0x1c], edx
jmp 0x47557c
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x46c]
mov dword [ebp - 0x1c], eax
jmp 0x475522
mov dword [ebp - 0x470], 0
jmp 0x475599
mov ecx, dword [ebp - 0x470]
add ecx, 1
mov dword [ebp - 0x470], ecx
cmp dword [ebp - 0x470], 4
jge 0x4755b0
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x470]
mov dword [ebp - 0x1c], edx
jmp 0x47558a
cmp dword [ebp - 0x1c], 0
jge 0x4755be
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4755d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x474], 0
jmp 0x4755f1
mov edx, dword [ebp - 0x474]
add edx, 1
mov dword [ebp - 0x474], edx
cmp dword [ebp - 0x474], 0
jge 0x47563e
mov eax, dword [ebp - 0x474]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x475620
mov eax, dword [ebp - 0x474]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x475630
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x474]
mov dword [ebp - 0x1c], edx
jmp 0x47563c
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x474]
mov dword [ebp - 0x1c], eax
jmp 0x4755e2
mov dword [ebp - 0x478], 0
jmp 0x475659
mov ecx, dword [ebp - 0x478]
add ecx, 1
mov dword [ebp - 0x478], ecx
cmp dword [ebp - 0x478], 3
jge 0x47569a
cmp dword [ebp - 0x1c], 0
jge 0x475670
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x475686
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x670]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47564a
mov dword [ebp - 0x674], 0
jmp 0x4756b5
mov eax, dword [ebp - 0x674]
add eax, 1
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0
jge 0x4756f6
cmp dword [ebp - 0x1c], 0
jge 0x4756cc
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4756e2
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x870]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4756a6
mov dword [ebp - 0x874], 0
jmp 0x475711
mov eax, dword [ebp - 0x874]
add eax, 1
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 3
jge 0x475728
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x874]
mov dword [ebp - 0x1c], ecx
jmp 0x475702
cmp dword [ebp - 0x1c], 0
jge 0x475736
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x47574e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x878], 0
jmp 0x475769
mov edx, dword [ebp - 0x878]
add edx, 1
mov dword [ebp - 0x878], edx
cmp dword [ebp - 0x878], 1
jge 0x4757aa
cmp dword [ebp - 0x1c], 0
jge 0x475780
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x475796
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa70]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47575a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x58]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret