Function at 0x4b1310
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x513170
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x24bc
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x4b1369
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10
jge 0x4b13ad
cmp dword [ebp - 0x1c], 0
jge 0x4b137d
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b1393
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0xfa
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b1360
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0xffffffff
mov dword [ebp - 0x228], 0
jmp 0x4b13d9
mov ecx, dword [ebp - 0x228]
add ecx, 1
mov dword [ebp - 0x228], ecx
cmp dword [ebp - 0x228], 3
jge 0x4b140b
mov eax, dword [ebp - 0x228]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b1400
mov edx, dword [ebp - 0x224]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b13ca
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b142b
mov dword [ebp - 0x22c], 0
jmp 0x4b1446
mov edx, dword [ebp - 0x22c]
add edx, 1
mov dword [ebp - 0x22c], edx
cmp dword [ebp - 0x22c], 0x2b
jge 0x4b1493
mov eax, dword [ebp - 0x22c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b1475
mov eax, dword [ebp - 0x22c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b1485
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x22c]
mov dword [ebp - 0x1c], edx
jmp 0x4b1491
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x22c]
mov dword [ebp - 0x1c], eax
jmp 0x4b1437
mov dword [ebp - 0x230], 0
jmp 0x4b14ae
mov ecx, dword [ebp - 0x230]
add ecx, 1
mov dword [ebp - 0x230], ecx
cmp dword [ebp - 0x230], 0xc
jge 0x4b14fb
cmp dword [ebp - 0x1c], 0
jge 0x4b14c5
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b14db
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x234], 0xfa
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b149f
mov dword [ebp - 0x434], 0
jmp 0x4b1516
mov ecx, dword [ebp - 0x434]
add ecx, 1
mov dword [ebp - 0x434], ecx
cmp dword [ebp - 0x434], 0xa
jge 0x4b1563
mov eax, dword [ebp - 0x434]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b1545
mov eax, dword [ebp - 0x434]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b1555
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x434]
mov dword [ebp - 0x1c], edx
jmp 0x4b1561
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x434]
mov dword [ebp - 0x1c], eax
jmp 0x4b1507
mov dword [ebp - 0x438], 0
jmp 0x4b157e
mov ecx, dword [ebp - 0x438]
add ecx, 1
mov dword [ebp - 0x438], ecx
cmp dword [ebp - 0x438], 0x1f
jge 0x4b15cb
cmp dword [ebp - 0x1c], 0
jge 0x4b1595
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b15ab
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x43c], 0xfa
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b156f
mov dword [ebp - 0x63c], 0
jmp 0x4b15e6
mov ecx, dword [ebp - 0x63c]
add ecx, 1
mov dword [ebp - 0x63c], ecx
cmp dword [ebp - 0x63c], 3
jge 0x4b15fd
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x63c]
mov dword [ebp - 0x1c], edx
jmp 0x4b15d7
cmp dword [ebp - 0x1c], 0
jge 0x4b160b
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b1623
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x640], 0
jmp 0x4b163e
mov edx, dword [ebp - 0x640]
add edx, 1
mov dword [ebp - 0x640], edx
cmp dword [ebp - 0x640], 0x1d
jge 0x4b1655
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x640]
mov dword [ebp - 0x1c], eax
jmp 0x4b162f
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b1667
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b167f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x644], 0
jmp 0x4b169a
mov edx, dword [ebp - 0x644]
add edx, 1
mov dword [ebp - 0x644], edx
cmp dword [ebp - 0x644], 0x20
jge 0x4b16db
cmp dword [ebp - 0x1c], 0
jge 0x4b16b1
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b16c7
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x840]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b168b
mov dword [ebp - 0x844], 0
jmp 0x4b16f6
mov eax, dword [ebp - 0x844]
add eax, 1
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0
jge 0x4b170d
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x844]
mov dword [ebp - 0x1c], ecx
jmp 0x4b16e7
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b171f
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1737
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x848], 0
jmp 0x4b1752
mov edx, dword [ebp - 0x848]
add edx, 1
mov dword [ebp - 0x848], edx
cmp dword [ebp - 0x848], 0xc
jge 0x4b179f
cmp dword [ebp - 0x1c], 0
jge 0x4b1769
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b177f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x84c], 0xfa
lea edx, [ebp - 0x84c]
push edx
lea eax, [ebp - 0xa48]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b1743
mov dword [ebp - 0xa4c], 0
jmp 0x4b17ba
mov ecx, dword [ebp - 0xa4c]
add ecx, 1
mov dword [ebp - 0xa4c], ecx
cmp dword [ebp - 0xa4c], 0
jge 0x4b17fb
cmp dword [ebp - 0x1c], 0
jge 0x4b17d1
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b17e7
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xc48]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b17ab
mov dword [ebp - 0xc4c], 0
jmp 0x4b1816
mov eax, dword [ebp - 0xc4c]
add eax, 1
mov dword [ebp - 0xc4c], eax
cmp dword [ebp - 0xc4c], 8
jge 0x4b182d
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x1c], ecx
jmp 0x4b1807
cmp dword [ebp - 0x1c], 0
jge 0x4b183b
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b1853
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc50], 0
jmp 0x4b186e
mov edx, dword [ebp - 0xc50]
add edx, 1
mov dword [ebp - 0xc50], edx
cmp dword [ebp - 0xc50], 7
jge 0x4b18bb
mov eax, dword [ebp - 0xc50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b189d
mov eax, dword [ebp - 0xc50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b18ad
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc50]
mov dword [ebp - 0x1c], edx
jmp 0x4b18b9
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc50]
mov dword [ebp - 0x1c], eax
jmp 0x4b185f
mov dword [ebp - 0xc54], 0
jmp 0x4b18d6
mov ecx, dword [ebp - 0xc54]
add ecx, 1
mov dword [ebp - 0xc54], ecx
cmp dword [ebp - 0xc54], 4
jge 0x4b1917
cmp dword [ebp - 0x1c], 0
jge 0x4b18ed
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1903
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xe50]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b18c7
mov dword [ebp - 0xe54], 0
jmp 0x4b1932
mov eax, dword [ebp - 0xe54]
add eax, 1
mov dword [ebp - 0xe54], eax
cmp dword [ebp - 0xe54], 3
jge 0x4b1949
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0xe54]
mov dword [ebp - 0x1c], ecx
jmp 0x4b1923
cmp dword [ebp - 0x1c], 0
jge 0x4b1957
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b196f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe58], 0
jmp 0x4b198a
mov edx, dword [ebp - 0xe58]
add edx, 1
mov dword [ebp - 0xe58], edx
cmp dword [ebp - 0xe58], 5
jge 0x4b19cb
cmp dword [ebp - 0x1c], 0
jge 0x4b19a1
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b19b7
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1050]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b197b
mov dword [ebp - 0x1054], 0
jmp 0x4b19e6
mov eax, dword [ebp - 0x1054]
add eax, 1
mov dword [ebp - 0x1054], eax
cmp dword [ebp - 0x1054], 8
jge 0x4b19fd
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1054]
mov dword [ebp - 0x1c], ecx
jmp 0x4b19d7
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b1a0f
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1a27
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4b1a61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1058], eax
mov eax, dword [ebp - 0x1058]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b1a53
jmp 0x4b1a61
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1058]
mov dword [ebp - 0x1c], edx
jmp 0x4b1a27
mov eax, dword [ebp - 0x1c]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x105c], 0xffffffff
mov dword [ebp - 0x1060], 0
jmp 0x4b1a96
mov ecx, dword [ebp - 0x1060]
add ecx, 1
mov dword [ebp - 0x1060], ecx
cmp dword [ebp - 0x1060], 6
jge 0x4b1ac8
mov eax, dword [ebp - 0x1060]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b1abd
mov edx, dword [ebp - 0x105c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b1a87
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b1ae8
mov dword [ebp - 0x1064], 0
jmp 0x4b1b03
mov edx, dword [ebp - 0x1064]
add edx, 1
mov dword [ebp - 0x1064], edx
cmp dword [ebp - 0x1064], 0
jge 0x4b1b50
cmp dword [ebp - 0x1c], 0
jge 0x4b1b1a
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b1b30
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1068], 0xfa
lea edx, [ebp - 0x1068]
push edx
lea eax, [ebp - 0x1260]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b1af4
mov dword [ebp - 0x1264], 0
jmp 0x4b1b6b
mov ecx, dword [ebp - 0x1264]
add ecx, 1
mov dword [ebp - 0x1264], ecx
cmp dword [ebp - 0x1264], 8
jge 0x4b1b82
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1264]
mov dword [ebp - 0x1c], edx
jmp 0x4b1b5c
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b1b94
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1bac
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1268], 0
jmp 0x4b1bc7
mov edx, dword [ebp - 0x1268]
add edx, 1
mov dword [ebp - 0x1268], edx
cmp dword [ebp - 0x1268], 0
jge 0x4b1c14
cmp dword [ebp - 0x1c], 0
jge 0x4b1bde
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b1bf4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x126c], 0xfa
lea edx, [ebp - 0x126c]
push edx
lea eax, [ebp - 0x1468]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b1bb8
mov dword [ebp - 0x146c], 0
jmp 0x4b1c2f
mov ecx, dword [ebp - 0x146c]
add ecx, 1
mov dword [ebp - 0x146c], ecx
cmp dword [ebp - 0x146c], 3
jge 0x4b1c46
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x146c]
mov dword [ebp - 0x1c], edx
jmp 0x4b1c20
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b1c58
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1c70
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1470], 0
jmp 0x4b1c8b
mov edx, dword [ebp - 0x1470]
add edx, 1
mov dword [ebp - 0x1470], edx
cmp dword [ebp - 0x1470], 5
jge 0x4b1ccc
cmp dword [ebp - 0x1c], 0
jge 0x4b1ca2
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1cb8
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1668]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b1c7c
mov dword [ebp - 0x166c], 0
jmp 0x4b1ce7
mov eax, dword [ebp - 0x166c]
add eax, 1
mov dword [ebp - 0x166c], eax
cmp dword [ebp - 0x166c], 2
jge 0x4b1cfe
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x166c]
mov dword [ebp - 0x1c], ecx
jmp 0x4b1cd8
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b1d10
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1d28
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1670], 0
jmp 0x4b1d43
mov edx, dword [ebp - 0x1670]
add edx, 1
mov dword [ebp - 0x1670], edx
cmp dword [ebp - 0x1670], 3
jge 0x4b1d5a
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1670]
mov dword [ebp - 0x1c], eax
jmp 0x4b1d34
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b1d6c
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1d84
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4b1dbe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1674], eax
mov eax, dword [ebp - 0x1674]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b1db0
jmp 0x4b1dbe
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1674]
mov dword [ebp - 0x1c], edx
jmp 0x4b1d84
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4b1e01
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1678], eax
mov eax, dword [ebp - 0x1678]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b1df3
jmp 0x4b1e01
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1678]
mov dword [ebp - 0x1c], edx
jmp 0x4b1dc7
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x167c], 0
jmp 0x4b1e25
mov ecx, dword [ebp - 0x167c]
add ecx, 1
mov dword [ebp - 0x167c], ecx
cmp dword [ebp - 0x167c], 3
jge 0x4b1e3c
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x167c]
mov dword [ebp - 0x1c], edx
jmp 0x4b1e16
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b1e4e
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1e66
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1680], 0
jmp 0x4b1e81
mov edx, dword [ebp - 0x1680]
add edx, 1
mov dword [ebp - 0x1680], edx
cmp dword [ebp - 0x1680], 7
jge 0x4b1ec2
cmp dword [ebp - 0x1c], 0
jge 0x4b1e98
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1eae
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1878]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b1e72
mov dword [ebp - 0x187c], 0
jmp 0x4b1edd
mov eax, dword [ebp - 0x187c]
add eax, 1
mov dword [ebp - 0x187c], eax
cmp dword [ebp - 0x187c], 4
jge 0x4b1f2a
mov eax, dword [ebp - 0x187c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b1f0c
mov eax, dword [ebp - 0x187c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b1f1c
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x187c]
mov dword [ebp - 0x1c], edx
jmp 0x4b1f28
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x187c]
mov dword [ebp - 0x1c], eax
jmp 0x4b1ece
mov dword [ebp - 0x1880], 0
jmp 0x4b1f45
mov ecx, dword [ebp - 0x1880]
add ecx, 1
mov dword [ebp - 0x1880], ecx
cmp dword [ebp - 0x1880], 2
jge 0x4b1f92
mov eax, dword [ebp - 0x1880]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b1f74
mov eax, dword [ebp - 0x1880]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b1f84
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1880]
mov dword [ebp - 0x1c], edx
jmp 0x4b1f90
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1880]
mov dword [ebp - 0x1c], eax
jmp 0x4b1f36
mov dword [ebp - 0x1884], 0
jmp 0x4b1fad
mov ecx, dword [ebp - 0x1884]
add ecx, 1
mov dword [ebp - 0x1884], ecx
cmp dword [ebp - 0x1884], 0
jge 0x4b1fc4
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1884]
mov dword [ebp - 0x1c], edx
jmp 0x4b1f9e
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b1fd6
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b1fee
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1888], 0
jmp 0x4b2009
mov edx, dword [ebp - 0x1888]
add edx, 1
mov dword [ebp - 0x1888], edx
cmp dword [ebp - 0x1888], 6
jge 0x4b204a
cmp dword [ebp - 0x1c], 0
jge 0x4b2020
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b2036
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1a80]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b1ffa
mov dword [ebp - 4], 2
mov dword [ebp - 0x1a84], 0xffffffff
mov dword [ebp - 0x1a88], 0
jmp 0x4b2076
mov eax, dword [ebp - 0x1a88]
add eax, 1
mov dword [ebp - 0x1a88], eax
cmp dword [ebp - 0x1a88], 1
jge 0x4b20a8
mov eax, dword [ebp - 0x1a88]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b209d
mov edx, dword [ebp - 0x1a84]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b2067
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b20c8
mov dword [ebp - 4], 3
mov dword [ebp - 0x1a8c], 0xffffffff
mov dword [ebp - 0x1a90], 0
jmp 0x4b20f4
mov edx, dword [ebp - 0x1a90]
add edx, 1
mov dword [ebp - 0x1a90], edx
cmp dword [ebp - 0x1a90], 2
jge 0x4b2126
mov eax, dword [ebp - 0x1a90]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b211b
mov edx, dword [ebp - 0x1a8c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b20e5
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b2146
mov dword [ebp - 0x1a94], 0
jmp 0x4b2161
mov edx, dword [ebp - 0x1a94]
add edx, 1
mov dword [ebp - 0x1a94], edx
cmp dword [ebp - 0x1a94], 1
jge 0x4b21ae
cmp dword [ebp - 0x1c], 0
jge 0x4b2178
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b218e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1a98], 0xfa
lea edx, [ebp - 0x1a98]
push edx
lea eax, [ebp - 0x1c90]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b2152
mov dword [ebp - 0x1c94], 0
jmp 0x4b21c9
mov ecx, dword [ebp - 0x1c94]
add ecx, 1
mov dword [ebp - 0x1c94], ecx
cmp dword [ebp - 0x1c94], 0
jge 0x4b21e0
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c94]
mov dword [ebp - 0x1c], edx
jmp 0x4b21ba
cmp dword [ebp - 0x1c], 0
jge 0x4b21ee
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b2206
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c98], 0
jmp 0x4b2221
mov edx, dword [ebp - 0x1c98]
add edx, 1
mov dword [ebp - 0x1c98], edx
cmp dword [ebp - 0x1c98], 1
jge 0x4b2238
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c98]
mov dword [ebp - 0x1c], eax
jmp 0x4b2212
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b224a
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b2262
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c9c], 0
jmp 0x4b227d
mov edx, dword [ebp - 0x1c9c]
add edx, 1
mov dword [ebp - 0x1c9c], edx
cmp dword [ebp - 0x1c9c], 3
jge 0x4b22be
cmp dword [ebp - 0x1c], 0
jge 0x4b2294
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b22aa
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1e98]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b226e
mov dword [ebp - 0x1e9c], 0
jmp 0x4b22d9
mov eax, dword [ebp - 0x1e9c]
add eax, 1
mov dword [ebp - 0x1e9c], eax
cmp dword [ebp - 0x1e9c], 3
jge 0x4b2326
cmp dword [ebp - 0x1c], 0
jge 0x4b22f0
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b2306
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1ea0], 0xfa
lea edx, [ebp - 0x1ea0]
push edx
lea eax, [ebp - 0x2098]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b22ca
mov dword [ebp - 0x209c], 0
jmp 0x4b2341
mov ecx, dword [ebp - 0x209c]
add ecx, 1
mov dword [ebp - 0x209c], ecx
cmp dword [ebp - 0x209c], 4
jge 0x4b238e
cmp dword [ebp - 0x1c], 0
jge 0x4b2358
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b236e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20a0], 0xfa
lea edx, [ebp - 0x20a0]
push edx
lea eax, [ebp - 0x2298]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b2332
mov dword [ebp - 0x229c], 0
jmp 0x4b23a9
mov ecx, dword [ebp - 0x229c]
add ecx, 1
mov dword [ebp - 0x229c], ecx
cmp dword [ebp - 0x229c], 1
jge 0x4b23f6
mov eax, dword [ebp - 0x229c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b23d8
mov eax, dword [ebp - 0x229c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b23e8
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x229c]
mov dword [ebp - 0x1c], edx
jmp 0x4b23f4
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x229c]
mov dword [ebp - 0x1c], eax
jmp 0x4b239a
mov dword [ebp - 4], 4
mov dword [ebp - 0x22a0], 0xffffffff
mov dword [ebp - 0x22a4], 0
jmp 0x4b2422
mov ecx, dword [ebp - 0x22a4]
add ecx, 1
mov dword [ebp - 0x22a4], ecx
cmp dword [ebp - 0x22a4], 3
jge 0x4b2454
mov eax, dword [ebp - 0x22a4]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b2449
mov edx, dword [ebp - 0x22a0]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b2413
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b2474
mov dword [ebp - 0x22a8], 0
jmp 0x4b248f
mov edx, dword [ebp - 0x22a8]
add edx, 1
mov dword [ebp - 0x22a8], edx
cmp dword [ebp - 0x22a8], 0
jge 0x4b24a6
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x22a8]
mov dword [ebp - 0x1c], eax
jmp 0x4b2480
cmp dword [ebp - 0x1c], 0
jge 0x4b24b4
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b24cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x22ac], 0
jmp 0x4b24e7
mov edx, dword [ebp - 0x22ac]
add edx, 1
mov dword [ebp - 0x22ac], edx
cmp dword [ebp - 0x22ac], 3
jge 0x4b24fe
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x22ac]
mov dword [ebp - 0x1c], eax
jmp 0x4b24d8
cmp dword [ebp - 0x1c], 0
jge 0x4b250c
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b2524
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x22b0], 0xffffffff
mov dword [ebp - 0x22b4], 0
jmp 0x4b2550