Function at 0x4d16f0
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x513b70
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1a8c
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x34], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov eax, 1
test eax, eax
je 0x4d1768
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d175d
jmp 0x4d1768
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
jmp 0x4d1737
mov eax, dword [ebp - 0x1c]
add eax, 0xf
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x4d1791
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xf
jge 0x4d17ba
mov eax, dword [ebp - 0x28]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d17af
mov edx, dword [ebp - 0x24]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d1788
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d17da
mov dword [ebp - 0x2c], 0
jmp 0x4d17ec
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xa
jge 0x4d17fd
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
jmp 0x4d17e3
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d180f
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d1827
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], 0
jmp 0x4d1839
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0
jge 0x4d1877
cmp dword [ebp - 0x1c], 0
jge 0x4d184d
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d1863
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d1830
mov eax, 1
test eax, eax
je 0x4d18b1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d18a3
jmp 0x4d18b1
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x234]
mov dword [ebp - 0x1c], edx
jmp 0x4d1877
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x238], 0
jmp 0x4d18d5
mov ecx, dword [ebp - 0x238]
add ecx, 1
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 4
jge 0x4d18ec
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x238]
mov dword [ebp - 0x1c], edx
jmp 0x4d18c6
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d18fe
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d1916
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x240], 0
jmp 0x4d1942
mov edx, dword [ebp - 0x240]
add edx, 1
mov dword [ebp - 0x240], edx
cmp dword [ebp - 0x240], 4
jge 0x4d1974
mov eax, dword [ebp - 0x240]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d1969
mov edx, dword [ebp - 0x23c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d1933
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d1994
mov dword [ebp - 0x244], 0
jmp 0x4d19af
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
cmp dword [ebp - 0x244], 1
jge 0x4d19c6
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x244]
mov dword [ebp - 0x1c], eax
jmp 0x4d19a0
cmp dword [ebp - 0x1c], 0
jge 0x4d19d4
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d19ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x248], 0
jmp 0x4d1a07
mov edx, dword [ebp - 0x248]
add edx, 1
mov dword [ebp - 0x248], edx
cmp dword [ebp - 0x248], 1
jge 0x4d1a54
cmp dword [ebp - 0x1c], 0
jge 0x4d1a1e
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d1a34
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24c], 0xfa
lea edx, [ebp - 0x24c]
push edx
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d19f8
mov dword [ebp - 0x44c], 0
jmp 0x4d1a6f
mov ecx, dword [ebp - 0x44c]
add ecx, 1
mov dword [ebp - 0x44c], ecx
cmp dword [ebp - 0x44c], 0
jge 0x4d1abc
cmp dword [ebp - 0x1c], 0
jge 0x4d1a86
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d1a9c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x450], 0xfa
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d1a60
mov dword [ebp - 0x64c], 0
jmp 0x4d1ad7
mov ecx, dword [ebp - 0x64c]
add ecx, 1
mov dword [ebp - 0x64c], ecx
cmp dword [ebp - 0x64c], 3
jge 0x4d1b24
cmp dword [ebp - 0x1c], 0
jge 0x4d1aee
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d1b04
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x650], 0xfa
lea edx, [ebp - 0x650]
push edx
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d1ac8
mov dword [ebp - 0x84c], 0
jmp 0x4d1b3f
mov ecx, dword [ebp - 0x84c]
add ecx, 1
mov dword [ebp - 0x84c], ecx
cmp dword [ebp - 0x84c], 1
jge 0x4d1b8c
mov eax, dword [ebp - 0x84c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d1b6e
mov eax, dword [ebp - 0x84c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d1b7e
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x84c]
mov dword [ebp - 0x1c], edx
jmp 0x4d1b8a
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x84c]
mov dword [ebp - 0x1c], eax
jmp 0x4d1b30
mov dword [ebp - 0x850], 0
jmp 0x4d1ba7
mov ecx, dword [ebp - 0x850]
add ecx, 1
mov dword [ebp - 0x850], ecx
cmp dword [ebp - 0x850], 0
jge 0x4d1bbe
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x850]
mov dword [ebp - 0x1c], edx
jmp 0x4d1b98
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d1bd0
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d1be8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x854], 0
jmp 0x4d1c03
mov edx, dword [ebp - 0x854]
add edx, 1
mov dword [ebp - 0x854], edx
cmp dword [ebp - 0x854], 0
jge 0x4d1c50
mov eax, dword [ebp - 0x854]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d1c32
mov eax, dword [ebp - 0x854]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d1c42
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x854]
mov dword [ebp - 0x1c], edx
jmp 0x4d1c4e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x854]
mov dword [ebp - 0x1c], eax
jmp 0x4d1bf4
mov dword [ebp - 0x858], 0
jmp 0x4d1c6b
mov ecx, dword [ebp - 0x858]
add ecx, 1
mov dword [ebp - 0x858], ecx
cmp dword [ebp - 0x858], 0
jge 0x4d1cb8
cmp dword [ebp - 0x1c], 0
jge 0x4d1c82
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d1c98
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x85c], 0xfa
lea edx, [ebp - 0x85c]
push edx
lea eax, [ebp - 0xa58]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d1c5c
mov dword [ebp - 0xa5c], 0
jmp 0x4d1cd3
mov ecx, dword [ebp - 0xa5c]
add ecx, 1
mov dword [ebp - 0xa5c], ecx
cmp dword [ebp - 0xa5c], 1
jge 0x4d1d20
mov eax, dword [ebp - 0xa5c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d1d02
mov eax, dword [ebp - 0xa5c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d1d12
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xa5c]
mov dword [ebp - 0x1c], edx
jmp 0x4d1d1e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xa5c]
mov dword [ebp - 0x1c], eax
jmp 0x4d1cc4
mov dword [ebp - 0xa60], 0
jmp 0x4d1d3b
mov ecx, dword [ebp - 0xa60]
add ecx, 1
mov dword [ebp - 0xa60], ecx
cmp dword [ebp - 0xa60], 3
jge 0x4d1d88
mov eax, dword [ebp - 0xa60]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d1d6a
mov eax, dword [ebp - 0xa60]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d1d7a
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xa60]
mov dword [ebp - 0x1c], edx
jmp 0x4d1d86
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xa60]
mov dword [ebp - 0x1c], eax
jmp 0x4d1d2c
mov dword [ebp - 0xa64], 0
jmp 0x4d1da3
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
cmp dword [ebp - 0xa64], 0
jge 0x4d1df0
cmp dword [ebp - 0x1c], 0
jge 0x4d1dba
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d1dd0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xa68], 0xfa
lea edx, [ebp - 0xa68]
push edx
lea eax, [ebp - 0xc60]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d1d94
mov dword [ebp - 4], 2
mov dword [ebp - 0xc64], 0xffffffff
mov dword [ebp - 0xc68], 0
jmp 0x4d1e1c
mov ecx, dword [ebp - 0xc68]
add ecx, 1
mov dword [ebp - 0xc68], ecx
cmp dword [ebp - 0xc68], 2
jge 0x4d1e4e
mov eax, dword [ebp - 0xc68]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d1e43
mov edx, dword [ebp - 0xc64]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d1e0d
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d1e6e
mov dword [ebp - 0xc6c], 0
jmp 0x4d1e89
mov edx, dword [ebp - 0xc6c]
add edx, 1
mov dword [ebp - 0xc6c], edx
cmp dword [ebp - 0xc6c], 1
jge 0x4d1eca
cmp dword [ebp - 0x1c], 0
jge 0x4d1ea0
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d1eb6
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xe68]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d1e7a
mov dword [ebp - 0xe6c], 0
jmp 0x4d1ee5
mov eax, dword [ebp - 0xe6c]
add eax, 1
mov dword [ebp - 0xe6c], eax
cmp dword [ebp - 0xe6c], 3
jge 0x4d1efc
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0xe6c]
mov dword [ebp - 0x1c], ecx
jmp 0x4d1ed6
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d1f0e
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d1f26
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe70], 0
jmp 0x4d1f41
mov edx, dword [ebp - 0xe70]
add edx, 1
mov dword [ebp - 0xe70], edx
cmp dword [ebp - 0xe70], 4
jge 0x4d1f8e
cmp dword [ebp - 0x1c], 0
jge 0x4d1f58
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d1f6e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xe74], 0xfa
lea edx, [ebp - 0xe74]
push edx
lea eax, [ebp - 0x1070]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d1f32
mov dword [ebp - 4], 3
mov dword [ebp - 0x1074], 0xffffffff
mov dword [ebp - 0x1078], 0
jmp 0x4d1fba
mov ecx, dword [ebp - 0x1078]
add ecx, 1
mov dword [ebp - 0x1078], ecx
cmp dword [ebp - 0x1078], 4
jge 0x4d1fec
mov eax, dword [ebp - 0x1078]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d1fe1
mov edx, dword [ebp - 0x1074]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d1fab
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d200c
mov dword [ebp - 0x107c], 0
jmp 0x4d2027
mov edx, dword [ebp - 0x107c]
add edx, 1
mov dword [ebp - 0x107c], edx
cmp dword [ebp - 0x107c], 0
jge 0x4d2068
cmp dword [ebp - 0x1c], 0
jge 0x4d203e
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d2054
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1278]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d2018
mov dword [ebp - 0x127c], 0
jmp 0x4d2083
mov eax, dword [ebp - 0x127c]
add eax, 1
mov dword [ebp - 0x127c], eax
cmp dword [ebp - 0x127c], 1
jge 0x4d20c4
cmp dword [ebp - 0x1c], 0
jge 0x4d209a
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d20b0
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1478]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d2074
mov dword [ebp - 0x147c], 0
jmp 0x4d20df
mov eax, dword [ebp - 0x147c]
add eax, 1
mov dword [ebp - 0x147c], eax
cmp dword [ebp - 0x147c], 2
jge 0x4d212c
mov eax, dword [ebp - 0x147c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d210e
mov eax, dword [ebp - 0x147c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d211e
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x147c]
mov dword [ebp - 0x1c], edx
jmp 0x4d212a
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x147c]
mov dword [ebp - 0x1c], eax
jmp 0x4d20d0
mov dword [ebp - 0x1480], 0
jmp 0x4d2147
mov ecx, dword [ebp - 0x1480]
add ecx, 1
mov dword [ebp - 0x1480], ecx
cmp dword [ebp - 0x1480], 3
jge 0x4d215e
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1480]
mov dword [ebp - 0x1c], edx
jmp 0x4d2138
cmp dword [ebp - 0x1c], 0
jge 0x4d216c
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d2184
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4d21be
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1484], eax
mov eax, dword [ebp - 0x1484]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d21b0
jmp 0x4d21be
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1484]
mov dword [ebp - 0x1c], edx
jmp 0x4d2184
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1488], 0
jmp 0x4d21e2
mov ecx, dword [ebp - 0x1488]
add ecx, 1
mov dword [ebp - 0x1488], ecx
cmp dword [ebp - 0x1488], 4
jge 0x4d2223
cmp dword [ebp - 0x1c], 0
jge 0x4d21f9
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d220f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1680]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d21d3
mov dword [ebp - 4], 4
mov dword [ebp - 0x1684], 0xffffffff
mov dword [ebp - 0x1688], 0
jmp 0x4d224f
mov eax, dword [ebp - 0x1688]
add eax, 1
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 2
jge 0x4d2281
mov eax, dword [ebp - 0x1688]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d2276
mov edx, dword [ebp - 0x1684]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d2240
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d22a1
mov dword [ebp - 0x168c], 0
jmp 0x4d22bc
mov edx, dword [ebp - 0x168c]
add edx, 1
mov dword [ebp - 0x168c], edx
cmp dword [ebp - 0x168c], 0
jge 0x4d22fd
cmp dword [ebp - 0x1c], 0
jge 0x4d22d3
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d22e9
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1888]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d22ad
mov dword [ebp - 0x188c], 0
jmp 0x4d2318
mov eax, dword [ebp - 0x188c]
add eax, 1
mov dword [ebp - 0x188c], eax
cmp dword [ebp - 0x188c], 2
jge 0x4d2365
mov eax, dword [ebp - 0x188c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d2347
mov eax, dword [ebp - 0x188c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d2357
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x188c]
mov dword [ebp - 0x1c], edx
jmp 0x4d2363
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x188c]
mov dword [ebp - 0x1c], eax
jmp 0x4d2309
mov dword [ebp - 0x1890], 0
jmp 0x4d2380
mov ecx, dword [ebp - 0x1890]
add ecx, 1
mov dword [ebp - 0x1890], ecx
cmp dword [ebp - 0x1890], 1
jge 0x4d23cd
cmp dword [ebp - 0x1c], 0
jge 0x4d2397
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d23ad
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1894], 0xfa
lea edx, [ebp - 0x1894]
push edx
lea eax, [ebp - 0x1a90]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d2371
mov ecx, 1
test ecx, ecx
je 0x4d2407
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1a94], eax
mov eax, dword [ebp - 0x1a94]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d23f9
jmp 0x4d2407
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1a94]
mov dword [ebp - 0x1c], edx
jmp 0x4d23cd
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x1a98], 0xffffffff
mov dword [ebp - 0x1a9c], 0
jmp 0x4d243c
mov ecx, dword [ebp - 0x1a9c]
add ecx, 1
mov dword [ebp - 0x1a9c], ecx
cmp dword [ebp - 0x1a9c], 3
jge 0x4d246e
mov eax, dword [ebp - 0x1a9c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d2463
mov edx, dword [ebp - 0x1a98]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d242d
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d248e
mov dword [ebp - 0x1aa0], 0
jmp 0x4d24a9
mov edx, dword [ebp - 0x1aa0]
add edx, 1
mov dword [ebp - 0x1aa0], edx
cmp dword [ebp - 0x1aa0], 0
jge 0x4d24c0
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x1aa0]
mov dword [ebp - 0x1c], eax
jmp 0x4d249a
cmp dword [ebp - 0x1c], 0
jge 0x4d24ce
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d24e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1aa4], 0
jmp 0x4d2501
mov edx, dword [ebp - 0x1aa4]
add edx, 1
mov dword [ebp - 0x1aa4], edx
cmp dword [ebp - 0x1aa4], 2
jge 0x4d254e
mov eax, dword [ebp - 0x1aa4]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d2530
mov eax, dword [ebp - 0x1aa4]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d2540
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1aa4]
mov dword [ebp - 0x1c], edx
jmp 0x4d254c
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1aa4]
mov dword [ebp - 0x1c], eax
jmp 0x4d24f2
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret