Function at 0x4fdd20
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x514a58
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2118
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x2c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov eax, 1
test eax, eax
je 0x4fdd98
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4fdd8d
jmp 0x4fdd98
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
jmp 0x4fdd67
mov eax, dword [ebp - 0x1c]
add eax, 0x26
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0
jmp 0x4fddb3
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 2
jge 0x4fddf7
cmp dword [ebp - 0x1c], 0
jge 0x4fddc7
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fdddd
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0xfa
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4fddaa
mov dword [ebp - 0x22c], 0
jmp 0x4fde12
mov ecx, dword [ebp - 0x22c]
add ecx, 1
mov dword [ebp - 0x22c], ecx
cmp dword [ebp - 0x22c], 0x2a
jge 0x4fde29
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x22c]
mov dword [ebp - 0x1c], edx
jmp 0x4fde03
cmp dword [ebp - 0x1c], 0
jge 0x4fde37
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fde4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], 0
jmp 0x4fde6a
mov edx, dword [ebp - 0x230]
add edx, 1
mov dword [ebp - 0x230], edx
cmp dword [ebp - 0x230], 0x1e
jge 0x4fde81
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x230]
mov dword [ebp - 0x1c], eax
jmp 0x4fde5b
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4fde93
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fdeab
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x238], 0
jmp 0x4fded7
mov edx, dword [ebp - 0x238]
add edx, 1
mov dword [ebp - 0x238], edx
cmp dword [ebp - 0x238], 0x18
jge 0x4fdf09
mov eax, dword [ebp - 0x238]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4fdefe
mov edx, dword [ebp - 0x234]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4fdec8
mov dword [ebp - 4], 0xfffffffe
jmp 0x4fdf29
mov dword [ebp - 0x23c], 0
jmp 0x4fdf44
mov edx, dword [ebp - 0x23c]
add edx, 1
mov dword [ebp - 0x23c], edx
cmp dword [ebp - 0x23c], 3
jge 0x4fdf85
cmp dword [ebp - 0x1c], 0
jge 0x4fdf5b
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fdf71
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4fdf35
mov dword [ebp - 0x43c], 0
jmp 0x4fdfa0
mov eax, dword [ebp - 0x43c]
add eax, 1
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 1
jge 0x4fdfed
mov eax, dword [ebp - 0x43c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4fdfcf
mov eax, dword [ebp - 0x43c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4fdfdf
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x43c]
mov dword [ebp - 0x1c], edx
jmp 0x4fdfeb
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x43c]
mov dword [ebp - 0x1c], eax
jmp 0x4fdf91
mov dword [ebp - 0x440], 0
jmp 0x4fe008
mov ecx, dword [ebp - 0x440]
add ecx, 1
mov dword [ebp - 0x440], ecx
cmp dword [ebp - 0x440], 7
jge 0x4fe055
mov eax, dword [ebp - 0x440]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4fe037
mov eax, dword [ebp - 0x440]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4fe047
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x440]
mov dword [ebp - 0x1c], edx
jmp 0x4fe053
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x440]
mov dword [ebp - 0x1c], eax
jmp 0x4fdff9
mov dword [ebp - 4], 1
mov dword [ebp - 0x444], 0xffffffff
mov dword [ebp - 0x448], 0
jmp 0x4fe081
mov ecx, dword [ebp - 0x448]
add ecx, 1
mov dword [ebp - 0x448], ecx
cmp dword [ebp - 0x448], 6
jge 0x4fe0b3
mov eax, dword [ebp - 0x448]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4fe0a8
mov edx, dword [ebp - 0x444]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4fe072
mov dword [ebp - 4], 0xfffffffe
jmp 0x4fe0d3
mov dword [ebp - 0x44c], 0
jmp 0x4fe0ee
mov edx, dword [ebp - 0x44c]
add edx, 1
mov dword [ebp - 0x44c], edx
cmp dword [ebp - 0x44c], 0xf
jge 0x4fe105
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x44c]
mov dword [ebp - 0x1c], eax
jmp 0x4fe0df
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4fe117
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fe12f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x450], 0
jmp 0x4fe14a
mov edx, dword [ebp - 0x450]
add edx, 1
mov dword [ebp - 0x450], edx
cmp dword [ebp - 0x450], 8
jge 0x4fe161
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x450]
mov dword [ebp - 0x1c], eax
jmp 0x4fe13b
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4fe173
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fe18b
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x454], 0
jmp 0x4fe1a6
mov edx, dword [ebp - 0x454]
add edx, 1
mov dword [ebp - 0x454], edx
cmp dword [ebp - 0x454], 4
jge 0x4fe1f3
cmp dword [ebp - 0x1c], 0
jge 0x4fe1bd
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fe1d3
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x458], 0xfa
lea edx, [ebp - 0x458]
push edx
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4fe197
mov dword [ebp - 0x654], 0
jmp 0x4fe20e
mov ecx, dword [ebp - 0x654]
add ecx, 1
mov dword [ebp - 0x654], ecx
cmp dword [ebp - 0x654], 1
jge 0x4fe225
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x654]
mov dword [ebp - 0x1c], edx
jmp 0x4fe1ff
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4fe237
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fe24f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x658], 0
jmp 0x4fe26a
mov edx, dword [ebp - 0x658]
add edx, 1
mov dword [ebp - 0x658], edx
cmp dword [ebp - 0x658], 1
jge 0x4fe281
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x658]
mov dword [ebp - 0x1c], eax
jmp 0x4fe25b
cmp dword [ebp - 0x1c], 0
jge 0x4fe28f
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fe2a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x65c], 0
jmp 0x4fe2c2
mov edx, dword [ebp - 0x65c]
add edx, 1
mov dword [ebp - 0x65c], edx
cmp dword [ebp - 0x65c], 0
jge 0x4fe2d9
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x65c]
mov dword [ebp - 0x1c], eax
jmp 0x4fe2b3
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4fe2eb
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fe303
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x660], 0
jmp 0x4fe31e
mov edx, dword [ebp - 0x660]
add edx, 1
mov dword [ebp - 0x660], edx
cmp dword [ebp - 0x660], 8
jge 0x4fe335
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x660]
mov dword [ebp - 0x1c], eax
jmp 0x4fe30f
cmp dword [ebp - 0x1c], 0
jge 0x4fe343
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fe35b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x664], 0
jmp 0x4fe376
mov edx, dword [ebp - 0x664]
add edx, 1
mov dword [ebp - 0x664], edx
cmp dword [ebp - 0x664], 8
jge 0x4fe3c3
mov eax, dword [ebp - 0x664]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4fe3a5
mov eax, dword [ebp - 0x664]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4fe3b5
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x664]
mov dword [ebp - 0x1c], edx
jmp 0x4fe3c1
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x664]
mov dword [ebp - 0x1c], eax
jmp 0x4fe367
mov dword [ebp - 0x668], 0
jmp 0x4fe3de
mov ecx, dword [ebp - 0x668]
add ecx, 1
mov dword [ebp - 0x668], ecx
cmp dword [ebp - 0x668], 6
jge 0x4fe42b
cmp dword [ebp - 0x1c], 0
jge 0x4fe3f5
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fe40b
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x66c], 0xfa
lea edx, [ebp - 0x66c]
push edx
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4fe3cf
mov ecx, 1
test ecx, ecx
je 0x4fe465
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x86c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4fe457
jmp 0x4fe465
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x86c]
mov dword [ebp - 0x1c], edx
jmp 0x4fe42b
mov eax, dword [ebp - 0x1c]
add eax, 6
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x870], 0
jmp 0x4fe489
mov ecx, dword [ebp - 0x870]
add ecx, 1
mov dword [ebp - 0x870], ecx
cmp dword [ebp - 0x870], 3
jge 0x4fe4d6
cmp dword [ebp - 0x1c], 0
jge 0x4fe4a0
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fe4b6
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x874], 0xfa
lea edx, [ebp - 0x874]
push edx
lea eax, [ebp - 0xa70]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4fe47a
mov dword [ebp - 4], 2
mov dword [ebp - 0xa74], 0xffffffff
mov dword [ebp - 0xa78], 0
jmp 0x4fe502
mov ecx, dword [ebp - 0xa78]
add ecx, 1
mov dword [ebp - 0xa78], ecx
cmp dword [ebp - 0xa78], 6
jge 0x4fe534
mov eax, dword [ebp - 0xa78]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4fe529
mov edx, dword [ebp - 0xa74]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4fe4f3
mov dword [ebp - 4], 0xfffffffe
jmp 0x4fe554
mov dword [ebp - 0xa7c], 0
jmp 0x4fe56f
mov edx, dword [ebp - 0xa7c]
add edx, 1
mov dword [ebp - 0xa7c], edx
cmp dword [ebp - 0xa7c], 5
jge 0x4fe5b0
cmp dword [ebp - 0x1c], 0
jge 0x4fe586
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fe59c
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xc78]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4fe560
mov dword [ebp - 0xc7c], 0
jmp 0x4fe5cb
mov eax, dword [ebp - 0xc7c]
add eax, 1
mov dword [ebp - 0xc7c], eax
cmp dword [ebp - 0xc7c], 6
jge 0x4fe5e2
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0xc7c]
mov dword [ebp - 0x1c], ecx
jmp 0x4fe5bc
cmp dword [ebp - 0x1c], 0
jge 0x4fe5f0
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fe608
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc80], 0
jmp 0x4fe623
mov edx, dword [ebp - 0xc80]
add edx, 1
mov dword [ebp - 0xc80], edx
cmp dword [ebp - 0xc80], 4
jge 0x4fe664
cmp dword [ebp - 0x1c], 0
jge 0x4fe63a
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fe650
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xe78]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4fe614
mov dword [ebp - 0xe7c], 0
jmp 0x4fe67f
mov eax, dword [ebp - 0xe7c]
add eax, 1
mov dword [ebp - 0xe7c], eax
cmp dword [ebp - 0xe7c], 1
jge 0x4fe6cc
mov eax, dword [ebp - 0xe7c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4fe6ae
mov eax, dword [ebp - 0xe7c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4fe6be
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xe7c]
mov dword [ebp - 0x1c], edx
jmp 0x4fe6ca
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xe7c]
mov dword [ebp - 0x1c], eax
jmp 0x4fe670
mov dword [ebp - 0xe80], 0
jmp 0x4fe6e7
mov ecx, dword [ebp - 0xe80]
add ecx, 1
mov dword [ebp - 0xe80], ecx
cmp dword [ebp - 0xe80], 1
jge 0x4fe6fe
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0xe80]
mov dword [ebp - 0x1c], edx
jmp 0x4fe6d8
cmp dword [ebp - 0x1c], 0
jge 0x4fe70c
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fe724
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe84], 0
jmp 0x4fe73f
mov edx, dword [ebp - 0xe84]
add edx, 1
mov dword [ebp - 0xe84], edx
cmp dword [ebp - 0xe84], 7
jge 0x4fe78c
cmp dword [ebp - 0x1c], 0
jge 0x4fe756
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fe76c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xe88], 0xfa
lea edx, [ebp - 0xe88]
push edx
lea eax, [ebp - 0x1080]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4fe730
mov dword [ebp - 4], 3
mov dword [ebp - 0x1084], 0xffffffff
mov dword [ebp - 0x1088], 0
jmp 0x4fe7b8
mov ecx, dword [ebp - 0x1088]
add ecx, 1
mov dword [ebp - 0x1088], ecx
cmp dword [ebp - 0x1088], 2
jge 0x4fe7ea
mov eax, dword [ebp - 0x1088]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4fe7df
mov edx, dword [ebp - 0x1084]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4fe7a9
mov dword [ebp - 4], 0xfffffffe
jmp 0x4fe80a
mov edx, 1
test edx, edx
je 0x4fe844
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x108c], eax
mov eax, dword [ebp - 0x108c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4fe836
jmp 0x4fe844
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x108c]
mov dword [ebp - 0x1c], edx
jmp 0x4fe80a
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x1090], 0xffffffff
mov dword [ebp - 0x1094], 0
jmp 0x4fe879
mov ecx, dword [ebp - 0x1094]
add ecx, 1
mov dword [ebp - 0x1094], ecx
cmp dword [ebp - 0x1094], 6
jge 0x4fe8ab
mov eax, dword [ebp - 0x1094]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4fe8a0
mov edx, dword [ebp - 0x1090]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4fe86a
mov dword [ebp - 4], 0xfffffffe
jmp 0x4fe8cb
mov dword [ebp - 0x1098], 0
jmp 0x4fe8e6
mov edx, dword [ebp - 0x1098]
add edx, 1
mov dword [ebp - 0x1098], edx
cmp dword [ebp - 0x1098], 3
jge 0x4fe933
mov eax, dword [ebp - 0x1098]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4fe915
mov eax, dword [ebp - 0x1098]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4fe925
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1098]
mov dword [ebp - 0x1c], edx
jmp 0x4fe931
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1098]
mov dword [ebp - 0x1c], eax
jmp 0x4fe8d7
mov dword [ebp - 4], 5
mov dword [ebp - 0x109c], 0xffffffff
mov dword [ebp - 0x10a0], 0
jmp 0x4fe95f
mov ecx, dword [ebp - 0x10a0]
add ecx, 1
mov dword [ebp - 0x10a0], ecx
cmp dword [ebp - 0x10a0], 2
jge 0x4fe991
mov eax, dword [ebp - 0x10a0]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4fe986
mov edx, dword [ebp - 0x109c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4fe950
mov dword [ebp - 4], 0xfffffffe
jmp 0x4fe9b1
mov dword [ebp - 0x10a4], 0
jmp 0x4fe9cc
mov edx, dword [ebp - 0x10a4]
add edx, 1
mov dword [ebp - 0x10a4], edx
cmp dword [ebp - 0x10a4], 4
jge 0x4fea19
mov eax, dword [ebp - 0x10a4]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4fe9fb
mov eax, dword [ebp - 0x10a4]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4fea0b
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10a4]
mov dword [ebp - 0x1c], edx
jmp 0x4fea17
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x10a4]
mov dword [ebp - 0x1c], eax
jmp 0x4fe9bd
mov dword [ebp - 4], 6
mov dword [ebp - 0x10a8], 0xffffffff
mov dword [ebp - 0x10ac], 0
jmp 0x4fea45
mov ecx, dword [ebp - 0x10ac]
add ecx, 1
mov dword [ebp - 0x10ac], ecx
cmp dword [ebp - 0x10ac], 4
jge 0x4fea77
mov eax, dword [ebp - 0x10ac]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4fea6c
mov edx, dword [ebp - 0x10a8]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4fea36
mov dword [ebp - 4], 0xfffffffe
jmp 0x4fea97
mov dword [ebp - 0x10b0], 0
jmp 0x4feab2
mov edx, dword [ebp - 0x10b0]
add edx, 1
mov dword [ebp - 0x10b0], edx
cmp dword [ebp - 0x10b0], 2
jge 0x4feaf3
cmp dword [ebp - 0x1c], 0
jge 0x4feac9
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4feadf
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x12a8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4feaa3
mov dword [ebp - 0x12ac], 0
jmp 0x4feb0e
mov eax, dword [ebp - 0x12ac]
add eax, 1
mov dword [ebp - 0x12ac], eax
cmp dword [ebp - 0x12ac], 2
jge 0x4feb5b
mov eax, dword [ebp - 0x12ac]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4feb3d
mov eax, dword [ebp - 0x12ac]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4feb4d
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x12ac]
mov dword [ebp - 0x1c], edx
jmp 0x4feb59
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x12ac]
mov dword [ebp - 0x1c], eax
jmp 0x4feaff
mov dword [ebp - 0x12b0], 0
jmp 0x4feb76
mov ecx, dword [ebp - 0x12b0]
add ecx, 1
mov dword [ebp - 0x12b0], ecx
cmp dword [ebp - 0x12b0], 3
jge 0x4febc3
mov eax, dword [ebp - 0x12b0]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4feba5
mov eax, dword [ebp - 0x12b0]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4febb5
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x12b0]
mov dword [ebp - 0x1c], edx
jmp 0x4febc1
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x12b0]
mov dword [ebp - 0x1c], eax
jmp 0x4feb67
mov ecx, 1
test ecx, ecx
je 0x4febfd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x12b4], eax
mov eax, dword [ebp - 0x12b4]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4febef
jmp 0x4febfd
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x12b4]
mov dword [ebp - 0x1c], edx
jmp 0x4febc3
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4fec40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x12b8], eax
mov eax, dword [ebp - 0x12b8]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4fec32
jmp 0x4fec40
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x12b8]
mov dword [ebp - 0x1c], edx
jmp 0x4fec06
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x12bc], 0
jmp 0x4fec61
mov ecx, dword [ebp - 0x12bc]
add ecx, 1
mov dword [ebp - 0x12bc], ecx
cmp dword [ebp - 0x12bc], 4
jge 0x4feca2
cmp dword [ebp - 0x1c], 0
jge 0x4fec78
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fec8e
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x14b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4fec52
mov dword [ebp - 4], 7
mov dword [ebp - 0x14bc], 0xffffffff
mov dword [ebp - 0x14c0], 0
jmp 0x4fecce
mov eax, dword [ebp - 0x14c0]
add eax, 1
mov dword [ebp - 0x14c0], eax
cmp dword [ebp - 0x14c0], 2
jge 0x4fed00
mov eax, dword [ebp - 0x14c0]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4fecf5
mov edx, dword [ebp - 0x14bc]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4fecbf
mov dword [ebp - 4], 0xfffffffe
jmp 0x4fed20
mov dword [ebp - 0x14c4], 0
jmp 0x4fed3b
mov edx, dword [ebp - 0x14c4]
add edx, 1
mov dword [ebp - 0x14c4], edx
cmp dword [ebp - 0x14c4], 4
jge 0x4fed52
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14c4]
mov dword [ebp - 0x1c], eax
jmp 0x4fed2c
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4fed64
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fed7c
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14c8], 0
jmp 0x4fed97
mov edx, dword [ebp - 0x14c8]
add edx, 1
mov dword [ebp - 0x14c8], edx
cmp dword [ebp - 0x14c8], 2
jge 0x4fede4
mov eax, dword [ebp - 0x14c8]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4fedc6
mov eax, dword [ebp - 0x14c8]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4fedd6
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x1c], edx
jmp 0x4fede2
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x14c8]
mov dword [ebp - 0x1c], eax
jmp 0x4fed88
mov dword [ebp - 0x14cc], 0
jmp 0x4fedff
mov ecx, dword [ebp - 0x14cc]
add ecx, 1
mov dword [ebp - 0x14cc], ecx
cmp dword [ebp - 0x14cc], 1
jge 0x4fee16
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14cc]
mov dword [ebp - 0x1c], edx
jmp 0x4fedf0
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4fee28
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4fee40
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14d0], 0
jmp 0x4fee5b
mov edx, dword [ebp - 0x14d0]
add edx, 1
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 1
jge 0x4fee72
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x14d0]
mov dword [ebp - 0x1c], eax
jmp 0x4fee4c
cmp dword [ebp - 0x1c], 0
jge 0x4fee80
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fee98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14d4], 0
jmp 0x4feeb3
mov edx, dword [ebp - 0x14d4]
add edx, 1
mov dword [ebp - 0x14d4], edx
cmp dword [ebp - 0x14d4], 1
jge 0x4feeca
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14d4]
mov dword [ebp - 0x1c], eax
jmp 0x4feea4
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4feedc
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4feef4
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14d8], 0
jmp 0x4fef0f
mov edx, dword [ebp - 0x14d8]
add edx, 1
mov dword [ebp - 0x14d8], edx
cmp dword [ebp - 0x14d8], 1
jge 0x4fef26
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x14d8]
mov dword [ebp - 0x1c], eax
jmp 0x4fef00
cmp dword [ebp - 0x1c], 0
jge 0x4fef34
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4fef4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14dc], 0
jmp 0x4fef67
cmp dword [ebp - 0x14dc], 3
jge 0x4fef7e