Function at 0x40349d
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x6c], 0x104
lea rdx, [rbp + 0x6c]
lea rax, [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rcx, [0x004d75d6]
call fcn.0043ea70
lea rax, [rbp + 0x3b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLocalTime]
call rax
lea rax, [rbp + 0x290]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
mov byte [rbp + 0x293], 0
lea rax, [rbp + 0x180]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
mov byte [rbp + 0x183], 0
mov dword [rbp - 0x30], 0x94
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetVersionExA]
call rax
lea rdx, str.Win_xp:5_Win7_10_11:6
mov rcx, qword [0x004de010]
call fcn.004cf880
lea rax, [rbp - 0x34]
mov rdx, rax
mov rcx, qword [0x004ddfe0]
call fcn.00493200
mov eax, dword [rbp - 0x30]
cmp eax, 5
je 0x403579
cmp eax, 6
je 0x403725
jmp 0x403805
lea rax, [rbp + 0x290]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x290]
add rax, rdx
movabs r8, 0x746e656d75636f44
movabs r9, 0x655320646e612073
mov qword [rax], r8
mov qword [rax + 8], r9
movabs r10, 0x5c73676e697474
mov qword [rax + 0x10], r10
lea rax, [rbp + 0x180]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x180]
add rax, rdx
mov qword [rax], r8
mov qword [rax + 8], r9
mov qword [rax + 0x10], r10
lea rdx, [rbp + 0x70]
lea rax, [rbp + 0x290]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rdx, [rbp + 0x70]
lea rax, [rbp + 0x180]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0x290]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x290]
add rax, rdx
movabs r10, 0x53206c61636f4c5c
movabs r11, 0x5c73676e69747465
mov qword [rax], r10
mov qword [rax + 8], r11
movabs rdx, 0x7261726f706d6554
movabs rcx, 0x6e7265746e492079
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
movabs rdi, 0x73656c6946207465
mov qword [rax + 0x20], rdi
mov byte [rax + 0x28], 0
lea rax, [rbp + 0x180]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x180]
add rax, rdx
mov qword [rax], r10
mov qword [rax + 8], r11
movabs rdx, 0x5c79726f74736948
movabs rcx, 0x2e79726f74736948
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
mov dword [rax + 0x20], 0x354549
lea rax, [rbp + 0x290]
mov rcx, rax
call fcn.004021b7
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.004021b7
jmp 0x403805
lea rax, [rbp + 0x290]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x290]
add rax, rdx
mov dword [rax], 0x72657355
mov word [rax + 4], 0x5c73
mov byte [rax + 6], 0
lea rdx, [rbp + 0x70]
lea rax, [rbp + 0x290]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0x290]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x290]
add rax, rdx
movabs rdx, 0x617461447070415c
movabs rcx, 0x676e696d616f525c
mov qword [rax], rdx
mov qword [rax + 8], rcx
movabs rdx, 0x6f736f7263694d5c
movabs rcx, 0x6f646e69575c7466
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
movabs rdi, 0x696b6f6f435c7377
mov qword [rax + 0x20], rdi
mov word [rax + 0x28], 0x7365
mov byte [rax + 0x2a], 0
lea rax, [rbp + 0x290]
mov rcx, rax
call fcn.004021b7
nop
lea rax, [rbp + 0x3a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLocalTime]
call rax
mov rax, qword [rbp + 0x3b0]
mov rdx, qword [rbp + 0x3b8]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov rax, qword [rbp + 0x3a0]
mov rdx, qword [rbp + 0x3a8]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.004023c9
nop
add rsp, 0x448
pop rdi
pop rbp
ret