Function at 0x4a92d0
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x512ec8
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x3088
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x34], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x4a9329
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1d
jge 0x4a9367
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4a934f
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4a935c
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
jmp 0x4a9365
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x4a9320
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x4a9387
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 1
jge 0x4a93b0
mov eax, dword [ebp - 0x28]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4a93a5
mov edx, dword [ebp - 0x24]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4a937e
mov dword [ebp - 4], 0xfffffffe
jmp 0x4a93d0
mov dword [ebp - 0x2c], 0
jmp 0x4a93e2
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xe
jge 0x4a9426
cmp dword [ebp - 0x1c], 0
jge 0x4a93f6
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a940c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], 0xfa
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4a93d9
mov dword [ebp - 0x234], 0
jmp 0x4a9441
mov ecx, dword [ebp - 0x234]
add ecx, 1
mov dword [ebp - 0x234], ecx
cmp dword [ebp - 0x234], 2
jge 0x4a948e
mov eax, dword [ebp - 0x234]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4a9470
mov eax, dword [ebp - 0x234]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4a9480
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x234]
mov dword [ebp - 0x1c], edx
jmp 0x4a948c
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x234]
mov dword [ebp - 0x1c], eax
jmp 0x4a9432
mov dword [ebp - 0x238], 0
jmp 0x4a94a9
mov ecx, dword [ebp - 0x238]
add ecx, 1
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 2
jge 0x4a94c0
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x238]
mov dword [ebp - 0x1c], edx
jmp 0x4a949a
cmp dword [ebp - 0x1c], 0
jge 0x4a94ce
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a94e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x23c], 0
jmp 0x4a9501
mov edx, dword [ebp - 0x23c]
add edx, 1
mov dword [ebp - 0x23c], edx
cmp dword [ebp - 0x23c], 0
jge 0x4a954e
mov eax, dword [ebp - 0x23c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4a9530
mov eax, dword [ebp - 0x23c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4a9540
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x23c]
mov dword [ebp - 0x1c], edx
jmp 0x4a954c
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x23c]
mov dword [ebp - 0x1c], eax
jmp 0x4a94f2
mov dword [ebp - 0x240], 0
jmp 0x4a9569
mov ecx, dword [ebp - 0x240]
add ecx, 1
mov dword [ebp - 0x240], ecx
cmp dword [ebp - 0x240], 4
jge 0x4a9580
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x240]
mov dword [ebp - 0x1c], edx
jmp 0x4a955a
cmp dword [ebp - 0x1c], 0
jge 0x4a958e
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a95a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4a95e0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4a95d2
jmp 0x4a95e0
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x244]
mov dword [ebp - 0x1c], edx
jmp 0x4a95a6
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x248], 0
jmp 0x4a9604
mov ecx, dword [ebp - 0x248]
add ecx, 1
mov dword [ebp - 0x248], ecx
cmp dword [ebp - 0x248], 8
jge 0x4a9645
cmp dword [ebp - 0x1c], 0
jge 0x4a961b
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a9631
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a95f5
mov dword [ebp - 0x444], 0
jmp 0x4a9660
mov eax, dword [ebp - 0x444]
add eax, 1
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 6
jge 0x4a96a1
cmp dword [ebp - 0x1c], 0
jge 0x4a9677
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a968d
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x640]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a9651
mov dword [ebp - 0x644], 0
jmp 0x4a96bc
mov eax, dword [ebp - 0x644]
add eax, 1
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 3
jge 0x4a96d3
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x644]
mov dword [ebp - 0x1c], ecx
jmp 0x4a96ad
cmp dword [ebp - 0x1c], 0
jge 0x4a96e1
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a96f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x648], 0
jmp 0x4a9714
mov edx, dword [ebp - 0x648]
add edx, 1
mov dword [ebp - 0x648], edx
cmp dword [ebp - 0x648], 6
jge 0x4a9761
cmp dword [ebp - 0x1c], 0
jge 0x4a972b
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a9741
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x64c], 0xfa
lea edx, [ebp - 0x64c]
push edx
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4a9705
mov ecx, 1
test ecx, ecx
je 0x4a979b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x84c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4a978d
jmp 0x4a979b
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x84c]
mov dword [ebp - 0x1c], edx
jmp 0x4a9761
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x850], 0
jmp 0x4a97bf
mov ecx, dword [ebp - 0x850]
add ecx, 1
mov dword [ebp - 0x850], ecx
cmp dword [ebp - 0x850], 2
jge 0x4a9800
cmp dword [ebp - 0x1c], 0
jge 0x4a97d6
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a97ec
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa48]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a97b0
mov eax, 1
test eax, eax
je 0x4a983a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4a982c
jmp 0x4a983a
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xa4c]
mov dword [ebp - 0x1c], edx
jmp 0x4a9800
mov eax, dword [ebp - 0x1c]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa50], 0
jmp 0x4a985e
mov ecx, dword [ebp - 0xa50]
add ecx, 1
mov dword [ebp - 0xa50], ecx
cmp dword [ebp - 0xa50], 7
jge 0x4a9875
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0xa50]
mov dword [ebp - 0x1c], edx
jmp 0x4a984f
cmp dword [ebp - 0x1c], 0
jge 0x4a9883
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a989b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0xa54], 0xffffffff
mov dword [ebp - 0xa58], 0
jmp 0x4a98c7
mov edx, dword [ebp - 0xa58]
add edx, 1
mov dword [ebp - 0xa58], edx
cmp dword [ebp - 0xa58], 1
jge 0x4a98f9
mov eax, dword [ebp - 0xa58]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4a98ee
mov edx, dword [ebp - 0xa54]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4a98b8
mov dword [ebp - 4], 0xfffffffe
jmp 0x4a9919
mov dword [ebp - 0xa5c], 0
jmp 0x4a9934
mov edx, dword [ebp - 0xa5c]
add edx, 1
mov dword [ebp - 0xa5c], edx
cmp dword [ebp - 0xa5c], 2
jge 0x4a9981
mov eax, dword [ebp - 0xa5c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4a9963
mov eax, dword [ebp - 0xa5c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4a9973
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xa5c]
mov dword [ebp - 0x1c], edx
jmp 0x4a997f
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xa5c]
mov dword [ebp - 0x1c], eax
jmp 0x4a9925
mov dword [ebp - 0xa60], 0
jmp 0x4a999c
mov ecx, dword [ebp - 0xa60]
add ecx, 1
mov dword [ebp - 0xa60], ecx
cmp dword [ebp - 0xa60], 2
jge 0x4a99dd
cmp dword [ebp - 0x1c], 0
jge 0x4a99b3
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a99c9
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xc58]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a998d
mov dword [ebp - 0xc5c], 0
jmp 0x4a99f8
mov eax, dword [ebp - 0xc5c]
add eax, 1
mov dword [ebp - 0xc5c], eax
cmp dword [ebp - 0xc5c], 7
jge 0x4a9a0f
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0xc5c]
mov dword [ebp - 0x1c], ecx
jmp 0x4a99e9
cmp dword [ebp - 0x1c], 0
jge 0x4a9a1d
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a9a35
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc60], 0
jmp 0x4a9a50
mov edx, dword [ebp - 0xc60]
add edx, 1
mov dword [ebp - 0xc60], edx
cmp dword [ebp - 0xc60], 8
jge 0x4a9a9d
cmp dword [ebp - 0x1c], 0
jge 0x4a9a67
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a9a7d
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc64], 0xfa
lea edx, [ebp - 0xc64]
push edx
lea eax, [ebp - 0xe60]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4a9a41
mov dword [ebp - 0xe64], 0
jmp 0x4a9ab8
mov ecx, dword [ebp - 0xe64]
add ecx, 1
mov dword [ebp - 0xe64], ecx
cmp dword [ebp - 0xe64], 7
jge 0x4a9af9
cmp dword [ebp - 0x1c], 0
jge 0x4a9acf
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a9ae5
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1060]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a9aa9
mov dword [ebp - 0x1064], 0
jmp 0x4a9b14
mov eax, dword [ebp - 0x1064]
add eax, 1
mov dword [ebp - 0x1064], eax
cmp dword [ebp - 0x1064], 5
jge 0x4a9b61
mov eax, dword [ebp - 0x1064]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4a9b43
mov eax, dword [ebp - 0x1064]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4a9b53
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1064]
mov dword [ebp - 0x1c], edx
jmp 0x4a9b5f
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1064]
mov dword [ebp - 0x1c], eax
jmp 0x4a9b05
mov ecx, 1
test ecx, ecx
je 0x4a9b9b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1068], eax
mov eax, dword [ebp - 0x1068]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4a9b8d
jmp 0x4a9b9b
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1068]
mov dword [ebp - 0x1c], edx
jmp 0x4a9b61
mov eax, dword [ebp - 0x1c]
add eax, 6
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x106c], 0
jmp 0x4a9bbf
mov ecx, dword [ebp - 0x106c]
add ecx, 1
mov dword [ebp - 0x106c], ecx
cmp dword [ebp - 0x106c], 1
jge 0x4a9c0c
cmp dword [ebp - 0x1c], 0
jge 0x4a9bd6
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a9bec
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1070], 0xfa
lea edx, [ebp - 0x1070]
push edx
lea eax, [ebp - 0x1268]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4a9bb0
mov dword [ebp - 0x126c], 0
jmp 0x4a9c27
mov ecx, dword [ebp - 0x126c]
add ecx, 1
mov dword [ebp - 0x126c], ecx
cmp dword [ebp - 0x126c], 2
jge 0x4a9c68
cmp dword [ebp - 0x1c], 0
jge 0x4a9c3e
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a9c54
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1468]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a9c18
mov dword [ebp - 0x146c], 0
jmp 0x4a9c83
mov eax, dword [ebp - 0x146c]
add eax, 1
mov dword [ebp - 0x146c], eax
cmp dword [ebp - 0x146c], 1
jge 0x4a9cc4
cmp dword [ebp - 0x1c], 0
jge 0x4a9c9a
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a9cb0
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1668]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a9c74
mov dword [ebp - 0x166c], 0
jmp 0x4a9cdf
mov eax, dword [ebp - 0x166c]
add eax, 1
mov dword [ebp - 0x166c], eax
cmp dword [ebp - 0x166c], 0
jge 0x4a9d2c
mov eax, dword [ebp - 0x166c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4a9d0e
mov eax, dword [ebp - 0x166c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4a9d1e
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x166c]
mov dword [ebp - 0x1c], edx
jmp 0x4a9d2a
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x166c]
mov dword [ebp - 0x1c], eax
jmp 0x4a9cd0
mov dword [ebp - 0x1670], 0
jmp 0x4a9d47
mov ecx, dword [ebp - 0x1670]
add ecx, 1
mov dword [ebp - 0x1670], ecx
cmp dword [ebp - 0x1670], 2
jge 0x4a9d94
mov eax, dword [ebp - 0x1670]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4a9d76
mov eax, dword [ebp - 0x1670]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4a9d86
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1670]
mov dword [ebp - 0x1c], edx
jmp 0x4a9d92
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1670]
mov dword [ebp - 0x1c], eax
jmp 0x4a9d38
mov dword [ebp - 0x1674], 0
jmp 0x4a9daf
mov ecx, dword [ebp - 0x1674]
add ecx, 1
mov dword [ebp - 0x1674], ecx
cmp dword [ebp - 0x1674], 3
jge 0x4a9df0
cmp dword [ebp - 0x1c], 0
jge 0x4a9dc6
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a9ddc
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1870]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a9da0
mov dword [ebp - 0x1874], 0
jmp 0x4a9e0b
mov eax, dword [ebp - 0x1874]
add eax, 1
mov dword [ebp - 0x1874], eax
cmp dword [ebp - 0x1874], 7
jge 0x4a9e58
mov eax, dword [ebp - 0x1874]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4a9e3a
mov eax, dword [ebp - 0x1874]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4a9e4a
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1874]
mov dword [ebp - 0x1c], edx
jmp 0x4a9e56
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1874]
mov dword [ebp - 0x1c], eax
jmp 0x4a9dfc
mov dword [ebp - 0x1878], 0
jmp 0x4a9e73
mov ecx, dword [ebp - 0x1878]
add ecx, 1
mov dword [ebp - 0x1878], ecx
cmp dword [ebp - 0x1878], 4
jge 0x4a9e8a
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1878]
mov dword [ebp - 0x1c], edx
jmp 0x4a9e64
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4a9e9c
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a9eb4
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x187c], 0
jmp 0x4a9ecf
mov edx, dword [ebp - 0x187c]
add edx, 1
mov dword [ebp - 0x187c], edx
cmp dword [ebp - 0x187c], 4
jge 0x4a9f10
cmp dword [ebp - 0x1c], 0
jge 0x4a9ee6
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4a9efc
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1a78]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a9ec0
mov dword [ebp - 0x1a7c], 0
jmp 0x4a9f2b
mov eax, dword [ebp - 0x1a7c]
add eax, 1
mov dword [ebp - 0x1a7c], eax
cmp dword [ebp - 0x1a7c], 4
jge 0x4a9f78
cmp dword [ebp - 0x1c], 0
jge 0x4a9f42
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4a9f58
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1a80], 0xfa
lea edx, [ebp - 0x1a80]
push edx
lea eax, [ebp - 0x1c78]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4a9f1c
mov ecx, 1
test ecx, ecx
je 0x4a9fb2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c7c], eax
mov eax, dword [ebp - 0x1c7c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4a9fa4
jmp 0x4a9fb2
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c7c]
mov dword [ebp - 0x1c], edx
jmp 0x4a9f78
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c80], 0
jmp 0x4a9fd6
mov ecx, dword [ebp - 0x1c80]
add ecx, 1
mov dword [ebp - 0x1c80], ecx
cmp dword [ebp - 0x1c80], 4
jge 0x4aa017
cmp dword [ebp - 0x1c], 0
jge 0x4a9fed
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4aa003
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1e78]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4a9fc7
mov dword [ebp - 0x1e7c], 0
jmp 0x4aa032
mov eax, dword [ebp - 0x1e7c]
add eax, 1
mov dword [ebp - 0x1e7c], eax
cmp dword [ebp - 0x1e7c], 2
jge 0x4aa07f
cmp dword [ebp - 0x1c], 0
jge 0x4aa049
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4aa05f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1e80], 0xfa
lea edx, [ebp - 0x1e80]
push edx
lea eax, [ebp - 0x2078]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4aa023
mov dword [ebp - 0x207c], 0
jmp 0x4aa09a
mov ecx, dword [ebp - 0x207c]
add ecx, 1
mov dword [ebp - 0x207c], ecx
cmp dword [ebp - 0x207c], 3
jge 0x4aa0b1
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x207c]
mov dword [ebp - 0x1c], edx
jmp 0x4aa08b
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4aa0c3
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4aa0db
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2080], 0
jmp 0x4aa0f6
mov edx, dword [ebp - 0x2080]
add edx, 1
mov dword [ebp - 0x2080], edx
cmp dword [ebp - 0x2080], 4
jge 0x4aa143
cmp dword [ebp - 0x1c], 0
jge 0x4aa10d
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4aa123
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2084], 0xfa
lea edx, [ebp - 0x2084]
push edx
lea eax, [ebp - 0x2280]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4aa0e7
mov dword [ebp - 4], 2
mov dword [ebp - 0x2284], 0xffffffff
mov dword [ebp - 0x2288], 0
jmp 0x4aa16f
mov ecx, dword [ebp - 0x2288]
add ecx, 1
mov dword [ebp - 0x2288], ecx
cmp dword [ebp - 0x2288], 0
jge 0x4aa1a1
mov eax, dword [ebp - 0x2288]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4aa196
mov edx, dword [ebp - 0x2284]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4aa160
mov dword [ebp - 4], 0xfffffffe
jmp 0x4aa1c1
mov dword [ebp - 4], 3
mov dword [ebp - 0x228c], 0xffffffff
mov dword [ebp - 0x2290], 0
jmp 0x4aa1ed
mov edx, dword [ebp - 0x2290]
add edx, 1
mov dword [ebp - 0x2290], edx
cmp dword [ebp - 0x2290], 2
jge 0x4aa21f
mov eax, dword [ebp - 0x2290]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4aa214
mov edx, dword [ebp - 0x228c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4aa1de
mov dword [ebp - 4], 0xfffffffe
jmp 0x4aa23f
mov dword [ebp - 0x2294], 0
jmp 0x4aa25a
mov edx, dword [ebp - 0x2294]
add edx, 1
mov dword [ebp - 0x2294], edx
cmp dword [ebp - 0x2294], 4
jge 0x4aa29b
cmp dword [ebp - 0x1c], 0
jge 0x4aa271
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4aa287
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x2490]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4aa24b
mov dword [ebp - 0x2494], 0
jmp 0x4aa2b6
mov eax, dword [ebp - 0x2494]
add eax, 1
mov dword [ebp - 0x2494], eax
cmp dword [ebp - 0x2494], 3
jge 0x4aa303
cmp dword [ebp - 0x1c], 0
jge 0x4aa2cd
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4aa2e3
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2498], 0xfa
lea edx, [ebp - 0x2498]
push edx
lea eax, [ebp - 0x2690]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4aa2a7
mov ecx, 1
test ecx, ecx
je 0x4aa33d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2694], eax
mov eax, dword [ebp - 0x2694]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4aa32f
jmp 0x4aa33d
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x2694]
mov dword [ebp - 0x1c], edx
jmp 0x4aa303
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2698], 0
jmp 0x4aa361
mov ecx, dword [ebp - 0x2698]
add ecx, 1
mov dword [ebp - 0x2698], ecx
cmp dword [ebp - 0x2698], 3
jge 0x4aa3a2
cmp dword [ebp - 0x1c], 0
jge 0x4aa378
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4aa38e
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x2890]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4aa352
mov dword [ebp - 0x2894], 0
jmp 0x4aa3bd
mov eax, dword [ebp - 0x2894]
add eax, 1
mov dword [ebp - 0x2894], eax
cmp dword [ebp - 0x2894], 3
jge 0x4aa3fe
cmp dword [ebp - 0x1c], 0
jge 0x4aa3d4
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4aa3ea
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x2a90]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4aa3ae
mov dword [ebp - 4], 4
mov dword [ebp - 0x2a94], 0xffffffff
mov dword [ebp - 0x2a98], 0
jmp 0x4aa42a
mov eax, dword [ebp - 0x2a98]
add eax, 1
mov dword [ebp - 0x2a98], eax
cmp dword [ebp - 0x2a98], 0
jge 0x4aa45c
mov eax, dword [ebp - 0x2a98]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4aa451
mov edx, dword [ebp - 0x2a94]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4aa41b
mov dword [ebp - 4], 0xfffffffe
jmp 0x4aa47c
mov dword [ebp - 4], 5
mov dword [ebp - 0x2a9c], 0xffffffff
mov dword [ebp - 0x2aa0], 0
jmp 0x4aa4a8
mov edx, dword [ebp - 0x2aa0]
add edx, 1
mov dword [ebp - 0x2aa0], edx
cmp dword [ebp - 0x2aa0], 0
jge 0x4aa4da
mov eax, dword [ebp - 0x2aa0]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4aa4cf
mov edx, dword [ebp - 0x2a9c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4aa499
mov dword [ebp - 4], 0xfffffffe
jmp 0x4aa4fa
mov dword [ebp - 0x2aa4], 0
jmp 0x4aa515
mov edx, dword [ebp - 0x2aa4]
add edx, 1
mov dword [ebp - 0x2aa4], edx
cmp dword [ebp - 0x2aa4], 4
jge 0x4aa556
cmp dword [ebp - 0x1c], 0
jge 0x4aa52c
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4aa542
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x2ca0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4aa506
mov dword [ebp - 0x2ca4], 0
jmp 0x4aa571
mov eax, dword [ebp - 0x2ca4]
add eax, 1
mov dword [ebp - 0x2ca4], eax
cmp dword [ebp - 0x2ca4], 4
jge 0x4aa5b2
cmp dword [ebp - 0x1c], 0
jge 0x4aa588
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4aa59e
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x2ea0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4aa562
mov dword [ebp - 0x2ea4], 0
jmp 0x4aa5cd
mov eax, dword [ebp - 0x2ea4]
add eax, 1
mov dword [ebp - 0x2ea4], eax
cmp dword [ebp - 0x2ea4], 1
jge 0x4aa61a
cmp dword [ebp - 0x1c], 0
jge 0x4aa5e4
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4aa5fa
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2ea8], 0xfa
lea edx, [ebp - 0x2ea8]
push edx
lea eax, [ebp - 0x30a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4aa5be
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret