Function at 0x49f460
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x512b78
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x124c
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x38], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x49f4b9
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1e
jge 0x49f4f7
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x49f4df
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x49f4ec
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
jmp 0x49f4f5
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x49f4b0
mov dword [ebp - 0x24], 0
jmp 0x49f509
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x34
jge 0x49f51a
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
jmp 0x49f500
cmp dword [ebp - 0x1c], 0
jge 0x49f528
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49f540
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x49f571
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x49f566
jmp 0x49f571
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
jmp 0x49f540
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0
jmp 0x49f58c
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0x1c
jge 0x49f59d
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
jmp 0x49f583
cmp dword [ebp - 0x1c], 0
jge 0x49f5ab
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49f5c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], 0
jmp 0x49f5d5
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0xd
jge 0x49f619
cmp dword [ebp - 0x1c], 0
jge 0x49f5e9
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49f5ff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x34], 0xfa
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x49f5cc
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x238], 0
jmp 0x49f645
mov ecx, dword [ebp - 0x238]
add ecx, 1
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 1
jge 0x49f677
mov eax, dword [ebp - 0x238]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x49f66c
mov edx, dword [ebp - 0x234]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x49f636
mov dword [ebp - 4], 0xfffffffe
jmp 0x49f697
mov edx, 1
test edx, edx
je 0x49f6d1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x49f6c3
jmp 0x49f6d1
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x23c]
mov dword [ebp - 0x1c], edx
jmp 0x49f697
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x240], 0
jmp 0x49f6f5
mov ecx, dword [ebp - 0x240]
add ecx, 1
mov dword [ebp - 0x240], ecx
cmp dword [ebp - 0x240], 0x10
jge 0x49f70c
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x240]
mov dword [ebp - 0x1c], edx
jmp 0x49f6e6
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x49f71e
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49f736
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x244], 0
jmp 0x49f751
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
cmp dword [ebp - 0x244], 0xb
jge 0x49f792
cmp dword [ebp - 0x1c], 0
jge 0x49f768
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49f77e
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49f742
mov dword [ebp - 0x444], 0
jmp 0x49f7ad
mov eax, dword [ebp - 0x444]
add eax, 1
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0xf
jge 0x49f7ee
cmp dword [ebp - 0x1c], 0
jge 0x49f7c4
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49f7da
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x640]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49f79e
mov dword [ebp - 0x644], 0
jmp 0x49f809
mov eax, dword [ebp - 0x644]
add eax, 1
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 5
jge 0x49f820
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x644]
mov dword [ebp - 0x1c], ecx
jmp 0x49f7fa
cmp dword [ebp - 0x1c], 0
jge 0x49f82e
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49f846
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x648], 0
jmp 0x49f861
mov edx, dword [ebp - 0x648]
add edx, 1
mov dword [ebp - 0x648], edx
cmp dword [ebp - 0x648], 6
jge 0x49f8ae
cmp dword [ebp - 0x1c], 0
jge 0x49f878
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49f88e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x64c], 0xfa
lea edx, [ebp - 0x64c]
push edx
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x49f852
mov dword [ebp - 0x84c], 0
jmp 0x49f8c9
mov ecx, dword [ebp - 0x84c]
add ecx, 1
mov dword [ebp - 0x84c], ecx
cmp dword [ebp - 0x84c], 9
jge 0x49f90a
cmp dword [ebp - 0x1c], 0
jge 0x49f8e0
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49f8f6
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa48]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49f8ba
mov eax, 1
test eax, eax
je 0x49f944
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x49f936
jmp 0x49f944
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xa4c]
mov dword [ebp - 0x1c], edx
jmp 0x49f90a
mov eax, dword [ebp - 0x1c]
add eax, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa50], 0
jmp 0x49f968
mov ecx, dword [ebp - 0xa50]
add ecx, 1
mov dword [ebp - 0xa50], ecx
cmp dword [ebp - 0xa50], 0xc
jge 0x49f97f
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xa50]
mov dword [ebp - 0x1c], edx
jmp 0x49f959
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x49f991
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49f9a9
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa54], 0
jmp 0x49f9c4
mov edx, dword [ebp - 0xa54]
add edx, 1
mov dword [ebp - 0xa54], edx
cmp dword [ebp - 0xa54], 4
jge 0x49f9db
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xa54]
mov dword [ebp - 0x1c], eax
jmp 0x49f9b5
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x49f9ed
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49fa05
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0xa58], 0xffffffff
mov dword [ebp - 0xa5c], 0
jmp 0x49fa31
mov edx, dword [ebp - 0xa5c]
add edx, 1
mov dword [ebp - 0xa5c], edx
cmp dword [ebp - 0xa5c], 1
jge 0x49fa63
mov eax, dword [ebp - 0xa5c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x49fa58
mov edx, dword [ebp - 0xa58]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x49fa22
mov dword [ebp - 4], 0xfffffffe
jmp 0x49fa83
mov dword [ebp - 0xa60], 0
jmp 0x49fa9e
mov edx, dword [ebp - 0xa60]
add edx, 1
mov dword [ebp - 0xa60], edx
cmp dword [ebp - 0xa60], 1
jge 0x49fadf
cmp dword [ebp - 0x1c], 0
jge 0x49fab5
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49facb
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xc58]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49fa8f
mov dword [ebp - 0xc5c], 0
jmp 0x49fafa
mov eax, dword [ebp - 0xc5c]
add eax, 1
mov dword [ebp - 0xc5c], eax
cmp dword [ebp - 0xc5c], 6
jge 0x49fb11
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0xc5c]
mov dword [ebp - 0x1c], ecx
jmp 0x49faeb
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x49fb23
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49fb3b
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc60], 0
jmp 0x49fb56
mov edx, dword [ebp - 0xc60]
add edx, 1
mov dword [ebp - 0xc60], edx
cmp dword [ebp - 0xc60], 8
jge 0x49fba3
cmp dword [ebp - 0x1c], 0
jge 0x49fb6d
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49fb83
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc64], 0xfa
lea edx, [ebp - 0xc64]
push edx
lea eax, [ebp - 0xe60]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x49fb47
mov dword [ebp - 0xe64], 0
jmp 0x49fbbe
mov ecx, dword [ebp - 0xe64]
add ecx, 1
mov dword [ebp - 0xe64], ecx
cmp dword [ebp - 0xe64], 0
jge 0x49fc0b
cmp dword [ebp - 0x1c], 0
jge 0x49fbd5
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49fbeb
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xe68], 0xfa
lea edx, [ebp - 0xe68]
push edx
lea eax, [ebp - 0x1060]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x49fbaf
mov dword [ebp - 0x1064], 0
jmp 0x49fc26
mov ecx, dword [ebp - 0x1064]
add ecx, 1
mov dword [ebp - 0x1064], ecx
cmp dword [ebp - 0x1064], 3
jge 0x49fc3d
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1064]
mov dword [ebp - 0x1c], edx
jmp 0x49fc17
cmp dword [ebp - 0x1c], 0
jge 0x49fc4b
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x49fc63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1068], 0
jmp 0x49fc7e
mov edx, dword [ebp - 0x1068]
add edx, 1
mov dword [ebp - 0x1068], edx
cmp dword [ebp - 0x1068], 6
jge 0x49fcbf
cmp dword [ebp - 0x1c], 0
jge 0x49fc95
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x49fcab
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1260]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x49fc6f
mov eax, 1
test eax, eax
je 0x49fcf9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1264], eax
mov eax, dword [ebp - 0x1264]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x49fceb
jmp 0x49fcf9
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1264]
mov dword [ebp - 0x1c], edx
jmp 0x49fcbf
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret