Function at 0x4ec600
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x514460
push 0x40b390
mov eax, dword fs:[0]
push eax
add esp, 0xfffff1a0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x54], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x4ec652
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x35
jge 0x4ec663
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
jmp 0x4ec649
cmp dword [ebp - 0x1c], 0
jge 0x4ec671
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ec689
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x4ec6a9
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 1
jge 0x4ec6d2
mov eax, dword [ebp - 0x28]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4ec6c7
mov edx, dword [ebp - 0x24]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4ec6a0
mov dword [ebp - 4], 0xfffffffe
jmp 0x4ec6f2
mov edx, 1
test edx, edx
je 0x4ec723
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4ec718
jmp 0x4ec723
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
jmp 0x4ec6f2
mov eax, dword [ebp - 0x1c]
add eax, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], 0
jmp 0x4ec73e
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0x17
jge 0x4ec74f
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], edx
jmp 0x4ec735
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ec761
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ec779
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0
jmp 0x4ec78b
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 4
jge 0x4ec79c
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp 0x4ec782
cmp dword [ebp - 0x1c], 0
jge 0x4ec7aa
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ec7c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], 0
jmp 0x4ec7d4
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 6
jge 0x4ec7e5
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
jmp 0x4ec7cb
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ec7f7
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ec80f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], 0
jmp 0x4ec821
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0xd
jge 0x4ec832
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
jmp 0x4ec818
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ec844
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ec85c
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0
jmp 0x4ec86e
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 9
jge 0x4ec87f
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
jmp 0x4ec865
cmp dword [ebp - 0x1c], 0
jge 0x4ec88d
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ec8a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0
jmp 0x4ec8b7
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0xb
jge 0x4ec8c8
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
jmp 0x4ec8ae
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ec8da
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ec8f2
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], 0
jmp 0x4ec904
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 0xe
jge 0x4ec942
mov eax, dword [ebp - 0x48]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4ec92a
mov eax, dword [ebp - 0x48]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4ec937
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x48]
mov dword [ebp - 0x1c], edx
jmp 0x4ec940
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
jmp 0x4ec8fb
mov dword [ebp - 0x4c], 0
jmp 0x4ec954
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 0xc
jge 0x4ec965
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], edx
jmp 0x4ec94b
cmp dword [ebp - 0x1c], 0
jge 0x4ec973
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ec98b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x50], 0
jmp 0x4ec99d
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], 2
jge 0x4ec9db
cmp dword [ebp - 0x1c], 0
jge 0x4ec9b1
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ec9c7
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4ec994
mov dword [ebp - 0x254], 0
jmp 0x4ec9f6
mov eax, dword [ebp - 0x254]
add eax, 1
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xd
jge 0x4eca43
mov eax, dword [ebp - 0x254]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4eca25
mov eax, dword [ebp - 0x254]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4eca35
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x254]
mov dword [ebp - 0x1c], edx
jmp 0x4eca41
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x254]
mov dword [ebp - 0x1c], eax
jmp 0x4ec9e7
mov dword [ebp - 4], 1
mov dword [ebp - 0x258], 0xffffffff
mov dword [ebp - 0x25c], 0
jmp 0x4eca6f
mov ecx, dword [ebp - 0x25c]
add ecx, 1
mov dword [ebp - 0x25c], ecx
cmp dword [ebp - 0x25c], 5
jge 0x4ecaa1
mov eax, dword [ebp - 0x25c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4eca96
mov edx, dword [ebp - 0x258]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4eca60
mov dword [ebp - 4], 0xfffffffe
jmp 0x4ecac1
mov dword [ebp - 0x260], 0
jmp 0x4ecadc
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
cmp dword [ebp - 0x260], 5
jge 0x4ecaf3
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x260]
mov dword [ebp - 0x1c], eax
jmp 0x4ecacd
cmp dword [ebp - 0x1c], 0
jge 0x4ecb01
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ecb19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4ecb53
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4ecb45
jmp 0x4ecb53
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x264]
mov dword [ebp - 0x1c], edx
jmp 0x4ecb19
mov eax, dword [ebp - 0x1c]
add eax, 7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x268], 0
jmp 0x4ecb77
mov ecx, dword [ebp - 0x268]
add ecx, 1
mov dword [ebp - 0x268], ecx
cmp dword [ebp - 0x268], 4
jge 0x4ecb8e
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x268]
mov dword [ebp - 0x1c], edx
jmp 0x4ecb68
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4ecba0
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ecbb8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x26c], 0
jmp 0x4ecbd3
mov edx, dword [ebp - 0x26c]
add edx, 1
mov dword [ebp - 0x26c], edx
cmp dword [ebp - 0x26c], 1
jge 0x4ecc20
cmp dword [ebp - 0x1c], 0
jge 0x4ecbea
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ecc00
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x270], 0xfa
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ecbc4
mov dword [ebp - 0x46c], 0
jmp 0x4ecc3b
mov ecx, dword [ebp - 0x46c]
add ecx, 1
mov dword [ebp - 0x46c], ecx
cmp dword [ebp - 0x46c], 8
jge 0x4ecc88
cmp dword [ebp - 0x1c], 0
jge 0x4ecc52
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ecc68
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x470], 0xfa
lea edx, [ebp - 0x470]
push edx
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ecc2c
mov dword [ebp - 0x66c], 0
jmp 0x4ecca3
mov ecx, dword [ebp - 0x66c]
add ecx, 1
mov dword [ebp - 0x66c], ecx
cmp dword [ebp - 0x66c], 4
jge 0x4eccf0
cmp dword [ebp - 0x1c], 0
jge 0x4eccba
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4eccd0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x670], 0xfa
lea edx, [ebp - 0x670]
push edx
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ecc94
mov dword [ebp - 0x86c], 0
jmp 0x4ecd0b
mov ecx, dword [ebp - 0x86c]
add ecx, 1
mov dword [ebp - 0x86c], ecx
cmp dword [ebp - 0x86c], 2
jge 0x4ecd4c
cmp dword [ebp - 0x1c], 0
jge 0x4ecd22
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4ecd38
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa68]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4eccfc
mov dword [ebp - 0xa6c], 0
jmp 0x4ecd67
mov eax, dword [ebp - 0xa6c]
add eax, 1
mov dword [ebp - 0xa6c], eax
cmp dword [ebp - 0xa6c], 5
jge 0x4ecd7e
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0xa6c]
mov dword [ebp - 0x1c], ecx
jmp 0x4ecd58
cmp dword [ebp - 0x1c], 0
jge 0x4ecd8c
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ecda4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa70], 0
jmp 0x4ecdbf
mov edx, dword [ebp - 0xa70]
add edx, 1
mov dword [ebp - 0xa70], edx
cmp dword [ebp - 0xa70], 1
jge 0x4ece0c
cmp dword [ebp - 0x1c], 0
jge 0x4ecdd6
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ecdec
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xa74], 0xfa
lea edx, [ebp - 0xa74]
push edx
lea eax, [ebp - 0xc70]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ecdb0
mov dword [ebp - 0xc74], 0
jmp 0x4ece27
mov ecx, dword [ebp - 0xc74]
add ecx, 1
mov dword [ebp - 0xc74], ecx
cmp dword [ebp - 0xc74], 0
jge 0x4ece74
cmp dword [ebp - 0x1c], 0
jge 0x4ece3e
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4ece54
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc78], 0xfa
lea edx, [ebp - 0xc78]
push edx
lea eax, [ebp - 0xe70]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4ece18
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x54]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret