Function at 0x4bd730
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513e91
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0
call fcn.00460220
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x4bd785
push 0x80004005
call fcn.004712d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 1
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bd7b3
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 2
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bd7e0
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 3
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bd80d
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bd83a
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 5
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bd867
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], 1
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x3c]
call fcn.00494440
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
setbe byte [ebp - 0xd]
mov dword [ebp - 0x50], 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.00471bb0
push 0x20019
mov byte [ebp - 4], 7
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bd8ee
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 8
push eax
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.00472fc0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
push ecx
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.00472fc0
add esp, 8
mov byte [ebp - 4], 0xa
push dword [eax]
push ecx
mov ecx, esp
push str.users
call fcn.00471bb0
call fcn.0047d280
add esp, 4
lea ecx, [ebp - 0x58]
push eax
call fcn.0047c920
mov dword [ebp - 0x44], eax
or ebx, 0xffffffff
mov byte [ebp - 4], 9
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov dword [ebp - 0x28], eax
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4bd972
mov ecx, dword [eax]
push dword [ebp - 0x28]
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov ecx, ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bd992
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 7
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bd9af
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov ecx, ebx
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bd9cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x44], 0
mov esi, dword [ebp + 0xc]
jne 0x4bdd6c
xor ecx, ecx
mov dword [ebp - 0x44], 0x1fffff
mov eax, 0x1fffff
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ea22e
push 0x3ffffe
push 0
push eax
mov dword [ebp - 0x20], eax
call fcn.004ef3a0
add esp, 0x10
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bda2d
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test esi, esi
jne 0x4bda53
push 7
push str.Desktop
lea ecx, [ebp - 0x18]
call fcn.004725a0
jmp 0x4bda71
cmp esi, 1
jne 0x4bda5f
push str.Start_Menu
jmp 0x4bda69
cmp esi, 2
jne 0x4bda71
push str.Startup
lea ecx, [ebp - 0x18]
call fcn.00471e60
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x58]
push dword [ebp - 0x18]
call fcn.0047c990
test eax, eax
jne 0x4bdbd0
mov edx, dword [ebp - 0x20]
test edx, edx
jne 0x4bda96
xor ecx, ecx
jmp 0x4bdaaf
mov ecx, edx
lea esi, [ecx + 2]
jmp 0x4bdaa0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4bdaa0
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.004725a0
push str.Query_string:
lea ecx, [ebp - 0x2c]
call fcn.00471c70
push str.getShortcutNonePublicPath
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.00471bb0
mov byte [ebp - 4], 0xd
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bdaf6
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x48]
call fcn.00472fc0
push edi
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x30]
call fcn.00472fc0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x10
cmp dword [eax + 0xc], 0
je 0x4bdb47
push 0
push ecx
lea ecx, [ebp - 0x28]
add eax, 8
push ecx
push eax
call fcn.00473100
mov byte [ebp - 4], 0xf
mov ecx, ebx
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdb67
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdb87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0xd
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdba4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdbc4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x2c]
jmp 0x4bdd22
mov ecx, str.Start_Menu
test esi, esi
mov eax, str.Desktop
cmovne eax, ecx
lea ecx, [ebp - 0x30]
push eax
call fcn.00471bb0
push str.failed_to_read_registry_value:
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.00471c70
push str.getShortcutNonePublicPath
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x12
call fcn.00471bb0
mov byte [ebp - 4], 0x13
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bdc2a
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x48], esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x14
push eax
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x4c]
call fcn.00472fc0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x15
push ecx
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.00472fc0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x16
cmp dword [eax + 0xc], 0
je 0x4bdc7e
push 2
push ecx
lea ecx, [ebp - 0x2c]
add eax, 8
push ecx
push eax
call fcn.00473100
mov byte [ebp - 4], 0x15
mov ecx, ebx
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdc9e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x14
mov ecx, ebx
mov edx, dword [ebp - 0x4c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdcbe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x13
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdcdb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x12
mov ecx, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdcfb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov ecx, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdd1b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdd3b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call fcn.004ea229
mov edx, dword [ebp - 0x58]
add esp, 4
test edx, edx
je 0x4bdd59
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [ebp - 0x58], edx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x54], 0
jmp 0x4bde50
push str.failed_to_open_Shell_Folders_registry_key
lea ecx, [ebp - 0x2c]
call fcn.00471c70
push str.getShortcutNonePublicPath
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x17
call fcn.00471bb0
mov byte [ebp - 4], 0x18
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bddaa
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x4c], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x19
push eax
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x48]
call fcn.00472fc0
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x1a
cmp dword [eax + 0xc], 0
je 0x4bddec
push 2
push ecx
lea ecx, [ebp - 0x30]
add eax, 8
push ecx
push eax
call fcn.00473100
mov byte [ebp - 4], 0x19
mov ecx, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bde0c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x18
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bde29
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x17
mov ecx, ebx
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bde49
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bde69
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov esi, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
jne 0x4bdee4
mov cl, byte [ebp - 0xd]
test cl, cl
je 0x4bde96
push ecx
mov ecx, esp
push str.USERPROFILE
call fcn.00471bb0
lea ecx, [ebp - 0x14]
call fcn.0047ca10
mov cl, byte [ebp - 0xd]
add esp, 4
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4bdea7
push dword [ebp - 0x14]
push str._sDesktop
jmp 0x4bdedb
cmp eax, 1
jne 0x4bdec2
test cl, cl
je 0x4bdeba
push dword [ebp - 0x14]
push str._sStart_MenuPrograms
jmp 0x4bdedb
push esi
push str._sMicrosoftWindowsStart_MenuPrograms
jmp 0x4bdedb
cmp eax, 2
jne 0x4bdee4
test cl, cl
je 0x4bded5
push dword [ebp - 0x14]
push str._sStart_MenuProgramsStartup
jmp 0x4bdedb
push esi
push str._sMicrosoftWindowsStart_MenuProgramsStartup
push edi
call fcn.00472d30
add esp, 0xc
push str.Shortcut_path:
lea ecx, [ebp - 0x30]
call fcn.00471c70
push str.getShortcutNonePublicPath
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x1b
call fcn.00471bb0
mov byte [ebp - 4], 0x1c
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4bdf22
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x1d
push eax
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x44]
call fcn.00472fc0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x48]
push dword [ebp + 8]
mov edx, eax
call fcn.00472fc0
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x1f
cmp dword [eax + 0xc], 0
je 0x4bdf75
push 0
push ecx
lea ecx, [ebp + 0xc]
add eax, 8
push ecx
push eax
call fcn.00473100
mov byte [ebp - 4], 0x1e
mov ecx, ebx
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdf95
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1d
mov ecx, ebx
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdfb5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x1c
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdfd2
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1b
mov ecx, ebx
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4bdff2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov ecx, ebx
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4be012
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x4be020
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
mov ecx, ebx
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4be040
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov ecx, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4be060
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 2
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4be07d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4be09d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x3c]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4be0bb
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8