Function at 0x4cd740
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x513a38
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2adc
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x4cd799
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x16
jge 0x4cd7dd
cmp dword [ebp - 0x1c], 0
jge 0x4cd7ad
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cd7c3
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0xfa
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4cd790
mov dword [ebp - 0x224], 0
jmp 0x4cd7f8
mov ecx, dword [ebp - 0x224]
add ecx, 1
mov dword [ebp - 0x224], ecx
cmp dword [ebp - 0x224], 0x40
jge 0x4cd845
mov eax, dword [ebp - 0x224]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cd827
mov eax, dword [ebp - 0x224]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cd837
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x224]
mov dword [ebp - 0x1c], edx
jmp 0x4cd843
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x224]
mov dword [ebp - 0x1c], eax
jmp 0x4cd7e9
mov dword [ebp - 0x228], 0
jmp 0x4cd860
mov ecx, dword [ebp - 0x228]
add ecx, 1
mov dword [ebp - 0x228], ecx
cmp dword [ebp - 0x228], 7
jge 0x4cd8ad
cmp dword [ebp - 0x1c], 0
jge 0x4cd877
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cd88d
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x22c], 0xfa
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4cd851
mov dword [ebp - 0x42c], 0
jmp 0x4cd8c8
mov ecx, dword [ebp - 0x42c]
add ecx, 1
mov dword [ebp - 0x42c], ecx
cmp dword [ebp - 0x42c], 6
jge 0x4cd909
cmp dword [ebp - 0x1c], 0
jge 0x4cd8df
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cd8f5
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4cd8b9
mov dword [ebp - 4], 0
mov dword [ebp - 0x62c], 0xffffffff
mov dword [ebp - 0x630], 0
jmp 0x4cd935
mov eax, dword [ebp - 0x630]
add eax, 1
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0xf
jge 0x4cd967
mov eax, dword [ebp - 0x630]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4cd95c
mov edx, dword [ebp - 0x62c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4cd926
mov dword [ebp - 4], 0xfffffffe
jmp 0x4cd987
mov dword [ebp - 0x634], 0
jmp 0x4cd9a2
mov edx, dword [ebp - 0x634]
add edx, 1
mov dword [ebp - 0x634], edx
cmp dword [ebp - 0x634], 0xc
jge 0x4cd9ef
mov eax, dword [ebp - 0x634]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cd9d1
mov eax, dword [ebp - 0x634]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cd9e1
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x634]
mov dword [ebp - 0x1c], edx
jmp 0x4cd9ed
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x634]
mov dword [ebp - 0x1c], eax
jmp 0x4cd993
mov dword [ebp - 0x638], 0
jmp 0x4cda0a
mov ecx, dword [ebp - 0x638]
add ecx, 1
mov dword [ebp - 0x638], ecx
cmp dword [ebp - 0x638], 2
jge 0x4cda21
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x638]
mov dword [ebp - 0x1c], edx
jmp 0x4cd9fb
cmp dword [ebp - 0x1c], 0
jge 0x4cda2f
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cda47
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x63c], 0
jmp 0x4cda62
mov edx, dword [ebp - 0x63c]
add edx, 1
mov dword [ebp - 0x63c], edx
cmp dword [ebp - 0x63c], 2
jge 0x4cdaa3
cmp dword [ebp - 0x1c], 0
jge 0x4cda79
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cda8f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x838]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4cda53
mov eax, 1
test eax, eax
je 0x4cdadd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x83c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cdacf
jmp 0x4cdadd
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x83c]
mov dword [ebp - 0x1c], edx
jmp 0x4cdaa3
mov eax, dword [ebp - 0x1c]
add eax, 0xd
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x840], 0
jmp 0x4cdb01
mov ecx, dword [ebp - 0x840]
add ecx, 1
mov dword [ebp - 0x840], ecx
cmp dword [ebp - 0x840], 0xa
jge 0x4cdb18
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x840]
mov dword [ebp - 0x1c], edx
jmp 0x4cdaf2
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cdb2a
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cdb42
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4cdb7c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x844]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cdb6e
jmp 0x4cdb7c
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x844]
mov dword [ebp - 0x1c], edx
jmp 0x4cdb42
mov eax, dword [ebp - 0x1c]
add eax, 7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x848], 0
jmp 0x4cdba0
mov ecx, dword [ebp - 0x848]
add ecx, 1
mov dword [ebp - 0x848], ecx
cmp dword [ebp - 0x848], 2
jge 0x4cdbe1
cmp dword [ebp - 0x1c], 0
jge 0x4cdbb7
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cdbcd
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa40]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4cdb91
mov eax, 1
test eax, eax
je 0x4cdc1b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xa44], eax
mov eax, dword [ebp - 0xa44]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cdc0d
jmp 0x4cdc1b
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xa44]
mov dword [ebp - 0x1c], edx
jmp 0x4cdbe1
mov eax, dword [ebp - 0x1c]
add eax, 0xf
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa48], 0
jmp 0x4cdc3f
mov ecx, dword [ebp - 0xa48]
add ecx, 1
mov dword [ebp - 0xa48], ecx
cmp dword [ebp - 0xa48], 3
jge 0x4cdc8c
cmp dword [ebp - 0x1c], 0
jge 0x4cdc56
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cdc6c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xa4c], 0xfa
lea edx, [ebp - 0xa4c]
push edx
lea eax, [ebp - 0xc48]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4cdc30
mov dword [ebp - 0xc4c], 0
jmp 0x4cdca7
mov ecx, dword [ebp - 0xc4c]
add ecx, 1
mov dword [ebp - 0xc4c], ecx
cmp dword [ebp - 0xc4c], 7
jge 0x4cdcbe
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc4c]
mov dword [ebp - 0x1c], edx
jmp 0x4cdc98
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cdcd0
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cdce8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc50], 0
jmp 0x4cdd03
mov edx, dword [ebp - 0xc50]
add edx, 1
mov dword [ebp - 0xc50], edx
cmp dword [ebp - 0xc50], 3
jge 0x4cdd50
mov eax, dword [ebp - 0xc50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cdd32
mov eax, dword [ebp - 0xc50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cdd42
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc50]
mov dword [ebp - 0x1c], edx
jmp 0x4cdd4e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc50]
mov dword [ebp - 0x1c], eax
jmp 0x4cdcf4
mov dword [ebp - 4], 1
mov dword [ebp - 0xc54], 0xffffffff
mov dword [ebp - 0xc58], 0
jmp 0x4cdd7c
mov ecx, dword [ebp - 0xc58]
add ecx, 1
mov dword [ebp - 0xc58], ecx
cmp dword [ebp - 0xc58], 0xc
jge 0x4cddae
mov eax, dword [ebp - 0xc58]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4cdda3
mov edx, dword [ebp - 0xc54]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4cdd6d
mov dword [ebp - 4], 0xfffffffe
jmp 0x4cddce
mov dword [ebp - 0xc5c], 0
jmp 0x4cdde9
mov edx, dword [ebp - 0xc5c]
add edx, 1
mov dword [ebp - 0xc5c], edx
cmp dword [ebp - 0xc5c], 0xd
jge 0x4cde00
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc5c]
mov dword [ebp - 0x1c], eax
jmp 0x4cddda
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cde12
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cde2a
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc60], 0
jmp 0x4cde45
mov edx, dword [ebp - 0xc60]
add edx, 1
mov dword [ebp - 0xc60], edx
cmp dword [ebp - 0xc60], 0xf
jge 0x4cde92
mov eax, dword [ebp - 0xc60]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cde74
mov eax, dword [ebp - 0xc60]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cde84
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc60]
mov dword [ebp - 0x1c], edx
jmp 0x4cde90
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc60]
mov dword [ebp - 0x1c], eax
jmp 0x4cde36
mov ecx, 1
test ecx, ecx
je 0x4cdecc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp - 0xc64]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cdebe
jmp 0x4cdecc
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xc64]
mov dword [ebp - 0x1c], edx
jmp 0x4cde92
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4cdf0f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc68], eax
mov eax, dword [ebp - 0xc68]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cdf01
jmp 0x4cdf0f
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xc68]
mov dword [ebp - 0x1c], edx
jmp 0x4cded5
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc6c], 0
jmp 0x4cdf33
mov ecx, dword [ebp - 0xc6c]
add ecx, 1
mov dword [ebp - 0xc6c], ecx
cmp dword [ebp - 0xc6c], 2
jge 0x4cdf4a
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0xc6c]
mov dword [ebp - 0x1c], edx
jmp 0x4cdf24
cmp dword [ebp - 0x1c], 0
jge 0x4cdf58
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cdf70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc70], 0
jmp 0x4cdf8b
mov edx, dword [ebp - 0xc70]
add edx, 1
mov dword [ebp - 0xc70], edx
cmp dword [ebp - 0xc70], 5
jge 0x4cdfd8
mov eax, dword [ebp - 0xc70]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cdfba
mov eax, dword [ebp - 0xc70]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cdfca
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc70]
mov dword [ebp - 0x1c], edx
jmp 0x4cdfd6
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc70]
mov dword [ebp - 0x1c], eax
jmp 0x4cdf7c
mov dword [ebp - 0xc74], 0
jmp 0x4cdff3
mov ecx, dword [ebp - 0xc74]
add ecx, 1
mov dword [ebp - 0xc74], ecx
cmp dword [ebp - 0xc74], 3
jge 0x4ce00a
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc74]
mov dword [ebp - 0x1c], edx
jmp 0x4cdfe4
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ce01c
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ce034
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 2
mov dword [ebp - 0xc78], 0xffffffff
mov dword [ebp - 0xc7c], 0
jmp 0x4ce060
mov edx, dword [ebp - 0xc7c]
add edx, 1
mov dword [ebp - 0xc7c], edx
cmp dword [ebp - 0xc7c], 5
jge 0x4ce092
mov eax, dword [ebp - 0xc7c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4ce087
mov edx, dword [ebp - 0xc78]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4ce051
mov dword [ebp - 4], 0xfffffffe
jmp 0x4ce0b2
mov dword [ebp - 0xc80], 0
jmp 0x4ce0cd
mov edx, dword [ebp - 0xc80]
add edx, 1
mov dword [ebp - 0xc80], edx
cmp dword [ebp - 0xc80], 5
jge 0x4ce11a
mov eax, dword [ebp - 0xc80]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4ce0fc
mov eax, dword [ebp - 0xc80]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4ce10c
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc80]
mov dword [ebp - 0x1c], edx
jmp 0x4ce118
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc80]
mov dword [ebp - 0x1c], eax
jmp 0x4ce0be
mov dword [ebp - 0xc84], 0
jmp 0x4ce135
mov ecx, dword [ebp - 0xc84]
add ecx, 1
mov dword [ebp - 0xc84], ecx
cmp dword [ebp - 0xc84], 4
jge 0x4ce182
cmp dword [ebp - 0x1c], 0
jge 0x4ce14c
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce162
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc88], 0xfa
lea edx, [ebp - 0xc88]
push edx
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ce126
mov dword [ebp - 0xe84], 0
jmp 0x4ce19d
mov ecx, dword [ebp - 0xe84]
add ecx, 1
mov dword [ebp - 0xe84], ecx
cmp dword [ebp - 0xe84], 1
jge 0x4ce1b4
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0xe84]
mov dword [ebp - 0x1c], edx
jmp 0x4ce18e
cmp dword [ebp - 0x1c], 0
jge 0x4ce1c2
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce1da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe88], 0
jmp 0x4ce1f5
mov edx, dword [ebp - 0xe88]
add edx, 1
mov dword [ebp - 0xe88], edx
cmp dword [ebp - 0xe88], 8
jge 0x4ce20c
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0xe88]
mov dword [ebp - 0x1c], eax
jmp 0x4ce1e6
cmp dword [ebp - 0x1c], 0
jge 0x4ce21a
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce232
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe8c], 0
jmp 0x4ce24d
mov edx, dword [ebp - 0xe8c]
add edx, 1
mov dword [ebp - 0xe8c], edx
cmp dword [ebp - 0xe8c], 6
jge 0x4ce264
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xe8c]
mov dword [ebp - 0x1c], eax
jmp 0x4ce23e
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ce276
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ce28e
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe90], 0
jmp 0x4ce2a9
mov edx, dword [ebp - 0xe90]
add edx, 1
mov dword [ebp - 0xe90], edx
cmp dword [ebp - 0xe90], 4
jge 0x4ce2c0
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0xe90]
mov dword [ebp - 0x1c], eax
jmp 0x4ce29a
cmp dword [ebp - 0x1c], 0
jge 0x4ce2ce
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce2e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe94], 0
jmp 0x4ce301
mov edx, dword [ebp - 0xe94]
add edx, 1
mov dword [ebp - 0xe94], edx
cmp dword [ebp - 0xe94], 2
jge 0x4ce34e
cmp dword [ebp - 0x1c], 0
jge 0x4ce318
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce32e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xe98], 0xfa
lea edx, [ebp - 0xe98]
push edx
lea eax, [ebp - 0x1090]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ce2f2
mov dword [ebp - 0x1094], 0
jmp 0x4ce369
mov ecx, dword [ebp - 0x1094]
add ecx, 1
mov dword [ebp - 0x1094], ecx
cmp dword [ebp - 0x1094], 2
jge 0x4ce3b6
cmp dword [ebp - 0x1c], 0
jge 0x4ce380
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce396
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1098], 0xfa
lea edx, [ebp - 0x1098]
push edx
lea eax, [ebp - 0x1290]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ce35a
mov dword [ebp - 0x1294], 0
jmp 0x4ce3d1
mov ecx, dword [ebp - 0x1294]
add ecx, 1
mov dword [ebp - 0x1294], ecx
cmp dword [ebp - 0x1294], 4
jge 0x4ce412
cmp dword [ebp - 0x1c], 0
jge 0x4ce3e8
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ce3fe
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1490]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4ce3c2
mov dword [ebp - 4], 3
mov dword [ebp - 0x1494], 0xffffffff
mov dword [ebp - 0x1498], 0
jmp 0x4ce43e
mov eax, dword [ebp - 0x1498]
add eax, 1
mov dword [ebp - 0x1498], eax
cmp dword [ebp - 0x1498], 1
jge 0x4ce470
mov eax, dword [ebp - 0x1498]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4ce465
mov edx, dword [ebp - 0x1494]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4ce42f
mov dword [ebp - 4], 0xfffffffe
jmp 0x4ce490
mov edx, 1
test edx, edx
je 0x4ce4ca
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x149c], eax
mov eax, dword [ebp - 0x149c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4ce4bc
jmp 0x4ce4ca
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x149c]
mov dword [ebp - 0x1c], edx
jmp 0x4ce490
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14a0], 0
jmp 0x4ce4ee
mov ecx, dword [ebp - 0x14a0]
add ecx, 1
mov dword [ebp - 0x14a0], ecx
cmp dword [ebp - 0x14a0], 2
jge 0x4ce505
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14a0]
mov dword [ebp - 0x1c], edx
jmp 0x4ce4df
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ce517
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ce52f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14a4], 0
jmp 0x4ce54a
mov edx, dword [ebp - 0x14a4]
add edx, 1
mov dword [ebp - 0x14a4], edx
cmp dword [ebp - 0x14a4], 2
jge 0x4ce58b
cmp dword [ebp - 0x1c], 0
jge 0x4ce561
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ce577
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x16a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4ce53b
mov dword [ebp - 0x16a4], 0
jmp 0x4ce5a6
mov eax, dword [ebp - 0x16a4]
add eax, 1
mov dword [ebp - 0x16a4], eax
cmp dword [ebp - 0x16a4], 2
jge 0x4ce5f3
cmp dword [ebp - 0x1c], 0
jge 0x4ce5bd
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce5d3
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x16a8], 0xfa
lea edx, [ebp - 0x16a8]
push edx
lea eax, [ebp - 0x18a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ce597
mov ecx, 1
test ecx, ecx
je 0x4ce62d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18a4], eax
mov eax, dword [ebp - 0x18a4]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4ce61f
jmp 0x4ce62d
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18a4]
mov dword [ebp - 0x1c], edx
jmp 0x4ce5f3
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18a8], 0
jmp 0x4ce651
mov ecx, dword [ebp - 0x18a8]
add ecx, 1
mov dword [ebp - 0x18a8], ecx
cmp dword [ebp - 0x18a8], 0
jge 0x4ce692
cmp dword [ebp - 0x1c], 0
jge 0x4ce668
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ce67e
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1aa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4ce642
mov dword [ebp - 0x1aa4], 0
jmp 0x4ce6ad
mov eax, dword [ebp - 0x1aa4]
add eax, 1
mov dword [ebp - 0x1aa4], eax
cmp dword [ebp - 0x1aa4], 1
jge 0x4ce6ee
cmp dword [ebp - 0x1c], 0
jge 0x4ce6c4
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ce6da
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1ca0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4ce69e
mov eax, 1
test eax, eax
je 0x4ce728
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1ca4], eax
mov eax, dword [ebp - 0x1ca4]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4ce71a
jmp 0x4ce728
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1ca4]
mov dword [ebp - 0x1c], edx
jmp 0x4ce6ee
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1ca8], 0
jmp 0x4ce74c
mov ecx, dword [ebp - 0x1ca8]
add ecx, 1
mov dword [ebp - 0x1ca8], ecx
cmp dword [ebp - 0x1ca8], 4
jge 0x4ce763
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1ca8]
mov dword [ebp - 0x1c], edx
jmp 0x4ce73d
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ce775
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ce78d
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1cac], 0
jmp 0x4ce7a8
mov edx, dword [ebp - 0x1cac]
add edx, 1
mov dword [ebp - 0x1cac], edx
cmp dword [ebp - 0x1cac], 3
jge 0x4ce7bf
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x1cac]
mov dword [ebp - 0x1c], eax
jmp 0x4ce799
cmp dword [ebp - 0x1c], 0
jge 0x4ce7cd
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce7e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x1cb0], 0xffffffff
mov dword [ebp - 0x1cb4], 0
jmp 0x4ce811
mov edx, dword [ebp - 0x1cb4]
add edx, 1
mov dword [ebp - 0x1cb4], edx
cmp dword [ebp - 0x1cb4], 3
jge 0x4ce843
mov eax, dword [ebp - 0x1cb4]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4ce838
mov edx, dword [ebp - 0x1cb0]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4ce802
mov dword [ebp - 4], 0xfffffffe
jmp 0x4ce863
mov dword [ebp - 0x1cb8], 0
jmp 0x4ce87e
mov edx, dword [ebp - 0x1cb8]
add edx, 1
mov dword [ebp - 0x1cb8], edx
cmp dword [ebp - 0x1cb8], 4
jge 0x4ce895
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1cb8]
mov dword [ebp - 0x1c], eax
jmp 0x4ce86f
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ce8a7
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ce8bf
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1cbc], 0
jmp 0x4ce8da
mov edx, dword [ebp - 0x1cbc]
add edx, 1
mov dword [ebp - 0x1cbc], edx
cmp dword [ebp - 0x1cbc], 4
jge 0x4ce927
cmp dword [ebp - 0x1c], 0
jge 0x4ce8f1
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce907
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1cc0], 0xfa
lea edx, [ebp - 0x1cc0]
push edx
lea eax, [ebp - 0x1eb8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ce8cb
mov dword [ebp - 0x1ebc], 0
jmp 0x4ce942
mov ecx, dword [ebp - 0x1ebc]
add ecx, 1
mov dword [ebp - 0x1ebc], ecx
cmp dword [ebp - 0x1ebc], 1
jge 0x4ce98f
cmp dword [ebp - 0x1c], 0
jge 0x4ce959
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ce96f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1ec0], 0xfa
lea edx, [ebp - 0x1ec0]
push edx
lea eax, [ebp - 0x20b8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ce933
mov dword [ebp - 4], 5
mov dword [ebp - 0x20bc], 0xffffffff
mov dword [ebp - 0x20c0], 0
jmp 0x4ce9bb
mov ecx, dword [ebp - 0x20c0]
add ecx, 1
mov dword [ebp - 0x20c0], ecx
cmp dword [ebp - 0x20c0], 4
jge 0x4ce9ed
mov eax, dword [ebp - 0x20c0]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4ce9e2
mov edx, dword [ebp - 0x20bc]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4ce9ac
mov dword [ebp - 4], 0xfffffffe
jmp 0x4cea0d
mov dword [ebp - 0x20c4], 0
jmp 0x4cea28
cmp dword [ebp - 0x20c4], 2
jge 0x4cea69
cmp dword [ebp - 0x1c], 0
jge 0x4cea3f
mov dword [ebp - 4], 6
mov dword [ebp - 0x22c4], 0xffffffff
mov dword [ebp - 0x22c8], 0
jmp 0x4cea95