Function at 0x4b28c0
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5131d8
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1650
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x30], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0
jmp 0x4b2927
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x18
jge 0x4b2950
mov eax, dword [ebp - 0x24]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b2945
mov edx, dword [ebp - 0x20]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b291e
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b2970
mov dword [ebp - 0x28], 0
jmp 0x4b2982
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 8
jge 0x4b29c6
cmp dword [ebp - 0x1c], 0
jge 0x4b2996
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b29ac
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2c], 0xfa
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b2979
mov dword [ebp - 0x22c], 0
jmp 0x4b29e1
mov ecx, dword [ebp - 0x22c]
add ecx, 1
mov dword [ebp - 0x22c], ecx
cmp dword [ebp - 0x22c], 7
jge 0x4b29f8
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x22c]
mov dword [ebp - 0x1c], edx
jmp 0x4b29d2
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b2a0a
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b2a22
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], 0
jmp 0x4b2a3d
mov edx, dword [ebp - 0x230]
add edx, 1
mov dword [ebp - 0x230], edx
cmp dword [ebp - 0x230], 0xc
jge 0x4b2a8a
cmp dword [ebp - 0x1c], 0
jge 0x4b2a54
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b2a6a
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x234], 0xfa
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b2a2e
mov dword [ebp - 0x434], 0
jmp 0x4b2aa5
mov ecx, dword [ebp - 0x434]
add ecx, 1
mov dword [ebp - 0x434], ecx
cmp dword [ebp - 0x434], 0xb
jge 0x4b2af2
cmp dword [ebp - 0x1c], 0
jge 0x4b2abc
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b2ad2
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x438], 0xfa
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b2a96
mov dword [ebp - 0x634], 0
jmp 0x4b2b0d
mov ecx, dword [ebp - 0x634]
add ecx, 1
mov dword [ebp - 0x634], ecx
cmp dword [ebp - 0x634], 1
jge 0x4b2b5a
cmp dword [ebp - 0x1c], 0
jge 0x4b2b24
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b2b3a
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x638], 0xfa
lea edx, [ebp - 0x638]
push edx
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b2afe
mov ecx, 1
test ecx, ecx
je 0x4b2b94
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x834]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b2b86
jmp 0x4b2b94
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x834]
mov dword [ebp - 0x1c], edx
jmp 0x4b2b5a
mov eax, dword [ebp - 0x1c]
add eax, 0xe
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4b2bd7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b2bc9
jmp 0x4b2bd7
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x838]
mov dword [ebp - 0x1c], edx
jmp 0x4b2b9d
mov eax, dword [ebp - 0x1c]
add eax, 0xe
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x83c], 0xffffffff
mov dword [ebp - 0x840], 0
jmp 0x4b2c0c
mov ecx, dword [ebp - 0x840]
add ecx, 1
mov dword [ebp - 0x840], ecx
cmp dword [ebp - 0x840], 5
jge 0x4b2c3e
mov eax, dword [ebp - 0x840]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b2c33
mov edx, dword [ebp - 0x83c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b2bfd
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b2c5e
mov dword [ebp - 0x844], 0
jmp 0x4b2c79
mov edx, dword [ebp - 0x844]
add edx, 1
mov dword [ebp - 0x844], edx
cmp dword [ebp - 0x844], 0xa
jge 0x4b2cc6
cmp dword [ebp - 0x1c], 0
jge 0x4b2c90
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b2ca6
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x848], 0xfa
lea edx, [ebp - 0x848]
push edx
lea eax, [ebp - 0xa40]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b2c6a
mov dword [ebp - 4], 2
mov dword [ebp - 0xa44], 0xffffffff
mov dword [ebp - 0xa48], 0
jmp 0x4b2cf2
mov ecx, dword [ebp - 0xa48]
add ecx, 1
mov dword [ebp - 0xa48], ecx
cmp dword [ebp - 0xa48], 4
jge 0x4b2d24
mov eax, dword [ebp - 0xa48]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b2d19
mov edx, dword [ebp - 0xa44]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b2ce3
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b2d44
mov dword [ebp - 0xa4c], 0
jmp 0x4b2d5f
mov edx, dword [ebp - 0xa4c]
add edx, 1
mov dword [ebp - 0xa4c], edx
cmp dword [ebp - 0xa4c], 4
jge 0x4b2d76
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x1c], eax
jmp 0x4b2d50
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b2d88
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b2da0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa50], 0
jmp 0x4b2dbb
mov edx, dword [ebp - 0xa50]
add edx, 1
mov dword [ebp - 0xa50], edx
cmp dword [ebp - 0xa50], 2
jge 0x4b2e08
mov eax, dword [ebp - 0xa50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b2dea
mov eax, dword [ebp - 0xa50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b2dfa
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xa50]
mov dword [ebp - 0x1c], edx
jmp 0x4b2e06
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xa50]
mov dword [ebp - 0x1c], eax
jmp 0x4b2dac
mov dword [ebp - 0xa54], 0
jmp 0x4b2e23
mov ecx, dword [ebp - 0xa54]
add ecx, 1
mov dword [ebp - 0xa54], ecx
cmp dword [ebp - 0xa54], 0xd
jge 0x4b2e70
cmp dword [ebp - 0x1c], 0
jge 0x4b2e3a
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b2e50
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xa58], 0xfa
lea edx, [ebp - 0xa58]
push edx
lea eax, [ebp - 0xc50]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b2e14
mov dword [ebp - 0xc54], 0
jmp 0x4b2e8b
mov ecx, dword [ebp - 0xc54]
add ecx, 1
mov dword [ebp - 0xc54], ecx
cmp dword [ebp - 0xc54], 0xa
jge 0x4b2ed8
mov eax, dword [ebp - 0xc54]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b2eba
mov eax, dword [ebp - 0xc54]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b2eca
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc54]
mov dword [ebp - 0x1c], edx
jmp 0x4b2ed6
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc54]
mov dword [ebp - 0x1c], eax
jmp 0x4b2e7c
mov ecx, 1
test ecx, ecx
je 0x4b2f12
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0xc58]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b2f04
jmp 0x4b2f12
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xc58]
mov dword [ebp - 0x1c], edx
jmp 0x4b2ed8
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc5c], 0
jmp 0x4b2f36
mov ecx, dword [ebp - 0xc5c]
add ecx, 1
mov dword [ebp - 0xc5c], ecx
cmp dword [ebp - 0xc5c], 3
jge 0x4b2f83
cmp dword [ebp - 0x1c], 0
jge 0x4b2f4d
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b2f63
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc60], 0xfa
lea edx, [ebp - 0xc60]
push edx
lea eax, [ebp - 0xe58]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b2f27
mov dword [ebp - 0xe5c], 0
jmp 0x4b2f9e
mov ecx, dword [ebp - 0xe5c]
add ecx, 1
mov dword [ebp - 0xe5c], ecx
cmp dword [ebp - 0xe5c], 8
jge 0x4b2fdf
cmp dword [ebp - 0x1c], 0
jge 0x4b2fb5
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b2fcb
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1058]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b2f8f
mov dword [ebp - 0x105c], 0
jmp 0x4b2ffa
mov eax, dword [ebp - 0x105c]
add eax, 1
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x105c], 0
jge 0x4b3047
mov eax, dword [ebp - 0x105c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b3029
mov eax, dword [ebp - 0x105c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b3039
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x105c]
mov dword [ebp - 0x1c], edx
jmp 0x4b3045
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x105c]
mov dword [ebp - 0x1c], eax
jmp 0x4b2feb
mov dword [ebp - 0x1060], 0
jmp 0x4b3062
mov ecx, dword [ebp - 0x1060]
add ecx, 1
mov dword [ebp - 0x1060], ecx
cmp dword [ebp - 0x1060], 8
jge 0x4b30af
cmp dword [ebp - 0x1c], 0
jge 0x4b3079
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b308f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1064], 0xfa
lea edx, [ebp - 0x1064]
push edx
lea eax, [ebp - 0x1260]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b3053
mov dword [ebp - 0x1264], 0
jmp 0x4b30ca
mov ecx, dword [ebp - 0x1264]
add ecx, 1
mov dword [ebp - 0x1264], ecx
cmp dword [ebp - 0x1264], 0
jge 0x4b30e1
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1264]
mov dword [ebp - 0x1c], edx
jmp 0x4b30bb
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b30f3
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b310b
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1268], 0
jmp 0x4b3126
mov edx, dword [ebp - 0x1268]
add edx, 1
mov dword [ebp - 0x1268], edx
cmp dword [ebp - 0x1268], 8
jge 0x4b3167
cmp dword [ebp - 0x1c], 0
jge 0x4b313d
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b3153
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1460]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b3117
mov dword [ebp - 0x1464], 0
jmp 0x4b3182
mov eax, dword [ebp - 0x1464]
add eax, 1
mov dword [ebp - 0x1464], eax
cmp dword [ebp - 0x1464], 5
jge 0x4b3199
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x1464]
mov dword [ebp - 0x1c], ecx
jmp 0x4b3173
cmp dword [ebp - 0x1c], 0
jge 0x4b31a7
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b31bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1468], 0
jmp 0x4b31da
mov edx, dword [ebp - 0x1468]
add edx, 1
mov dword [ebp - 0x1468], edx
cmp dword [ebp - 0x1468], 1
jge 0x4b3227
cmp dword [ebp - 0x1c], 0
jge 0x4b31f1
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b3207
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x146c], 0xfa
lea edx, [ebp - 0x146c]
push edx
lea eax, [ebp - 0x1668]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b31cb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret