Function at 0x4b3250
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x513210
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2298
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x4b32a9
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xc
jge 0x4b32e7
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b32cf
mov eax, dword [ebp - 0x20]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b32dc
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
jmp 0x4b32e5
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x4b32a0
mov dword [ebp - 0x24], 0
jmp 0x4b32f9
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x19
jge 0x4b3337
cmp dword [ebp - 0x1c], 0
jge 0x4b330d
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b3323
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b32f0
mov dword [ebp - 0x224], 0
jmp 0x4b3352
mov eax, dword [ebp - 0x224]
add eax, 1
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x1b
jge 0x4b339f
cmp dword [ebp - 0x1c], 0
jge 0x4b3369
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b337f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x228], 0xfa
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b3343
mov dword [ebp - 0x424], 0
jmp 0x4b33ba
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
cmp dword [ebp - 0x424], 7
jge 0x4b3407
cmp dword [ebp - 0x1c], 0
jge 0x4b33d1
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b33e7
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x428], 0xfa
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b33ab
mov dword [ebp - 0x624], 0
jmp 0x4b3422
mov ecx, dword [ebp - 0x624]
add ecx, 1
mov dword [ebp - 0x624], ecx
cmp dword [ebp - 0x624], 4
jge 0x4b346f
cmp dword [ebp - 0x1c], 0
jge 0x4b3439
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b344f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x628], 0xfa
lea edx, [ebp - 0x628]
push edx
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b3413
mov ecx, 1
test ecx, ecx
je 0x4b34a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x824]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b349b
jmp 0x4b34a9
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x824]
mov dword [ebp - 0x1c], edx
jmp 0x4b346f
mov eax, dword [ebp - 0x1c]
add eax, 0xd
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x828], 0
jmp 0x4b34cd
mov ecx, dword [ebp - 0x828]
add ecx, 1
mov dword [ebp - 0x828], ecx
cmp dword [ebp - 0x828], 1
jge 0x4b34e4
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x828]
mov dword [ebp - 0x1c], edx
jmp 0x4b34be
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b34f6
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b350e
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x82c], 0
jmp 0x4b3529
mov edx, dword [ebp - 0x82c]
add edx, 1
mov dword [ebp - 0x82c], edx
cmp dword [ebp - 0x82c], 0x10
jge 0x4b356a
cmp dword [ebp - 0x1c], 0
jge 0x4b3540
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b3556
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa28]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b351a
mov dword [ebp - 0xa2c], 0
jmp 0x4b3585
mov eax, dword [ebp - 0xa2c]
add eax, 1
mov dword [ebp - 0xa2c], eax
cmp dword [ebp - 0xa2c], 0xf
jge 0x4b359c
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0xa2c]
mov dword [ebp - 0x1c], ecx
jmp 0x4b3576
cmp dword [ebp - 0x1c], 0
jge 0x4b35aa
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b35c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xa30], 0xffffffff
mov dword [ebp - 0xa34], 0
jmp 0x4b35ee
mov edx, dword [ebp - 0xa34]
add edx, 1
mov dword [ebp - 0xa34], edx
cmp dword [ebp - 0xa34], 0xf
jge 0x4b3620
mov eax, dword [ebp - 0xa34]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b3615
mov edx, dword [ebp - 0xa30]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b35df
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b3640
mov dword [ebp - 0xa38], 0
jmp 0x4b365b
mov edx, dword [ebp - 0xa38]
add edx, 1
mov dword [ebp - 0xa38], edx
cmp dword [ebp - 0xa38], 1
jge 0x4b36a8
cmp dword [ebp - 0x1c], 0
jge 0x4b3672
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b3688
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xa3c], 0xfa
lea edx, [ebp - 0xa3c]
push edx
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b364c
mov dword [ebp - 0xc3c], 0
jmp 0x4b36c3
mov ecx, dword [ebp - 0xc3c]
add ecx, 1
mov dword [ebp - 0xc3c], ecx
cmp dword [ebp - 0xc3c], 2
jge 0x4b3710
mov eax, dword [ebp - 0xc3c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b36f2
mov eax, dword [ebp - 0xc3c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b3702
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc3c]
mov dword [ebp - 0x1c], edx
jmp 0x4b370e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc3c]
mov dword [ebp - 0x1c], eax
jmp 0x4b36b4
mov dword [ebp - 0xc40], 0
jmp 0x4b372b
mov ecx, dword [ebp - 0xc40]
add ecx, 1
mov dword [ebp - 0xc40], ecx
cmp dword [ebp - 0xc40], 4
jge 0x4b3742
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc40]
mov dword [ebp - 0x1c], edx
jmp 0x4b371c
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b3754
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b376c
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4b37a6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0xc44]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b3798
jmp 0x4b37a6
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xc44]
mov dword [ebp - 0x1c], edx
jmp 0x4b376c
mov eax, dword [ebp - 0x1c]
add eax, 6
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc48], 0
jmp 0x4b37ca
mov ecx, dword [ebp - 0xc48]
add ecx, 1
mov dword [ebp - 0xc48], ecx
cmp dword [ebp - 0xc48], 2
jge 0x4b3817
mov eax, dword [ebp - 0xc48]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b37f9
mov eax, dword [ebp - 0xc48]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b3809
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc48]
mov dword [ebp - 0x1c], edx
jmp 0x4b3815
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc48]
mov dword [ebp - 0x1c], eax
jmp 0x4b37bb
mov dword [ebp - 0xc4c], 0
jmp 0x4b3832
mov ecx, dword [ebp - 0xc4c]
add ecx, 1
mov dword [ebp - 0xc4c], ecx
cmp dword [ebp - 0xc4c], 8
jge 0x4b3873
cmp dword [ebp - 0x1c], 0
jge 0x4b3849
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b385f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xe48]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b3823
mov dword [ebp - 0xe4c], 0
jmp 0x4b388e
mov eax, dword [ebp - 0xe4c]
add eax, 1
mov dword [ebp - 0xe4c], eax
cmp dword [ebp - 0xe4c], 1
jge 0x4b38a5
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0xe4c]
mov dword [ebp - 0x1c], ecx
jmp 0x4b387f
cmp dword [ebp - 0x1c], 0
jge 0x4b38b3
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b38cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe50], 0
jmp 0x4b38e6
mov edx, dword [ebp - 0xe50]
add edx, 1
mov dword [ebp - 0xe50], edx
cmp dword [ebp - 0xe50], 3
jge 0x4b38fd
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0xe50]
mov dword [ebp - 0x1c], eax
jmp 0x4b38d7
cmp dword [ebp - 0x1c], 0
jge 0x4b390b
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b3923
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4b395d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xe54], eax
mov eax, dword [ebp - 0xe54]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b394f
jmp 0x4b395d
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xe54]
mov dword [ebp - 0x1c], edx
jmp 0x4b3923
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4b39a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xe58], eax
mov eax, dword [ebp - 0xe58]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b3992
jmp 0x4b39a0
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xe58]
mov dword [ebp - 0x1c], edx
jmp 0x4b3966
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4b39e3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xe5c], eax
mov eax, dword [ebp - 0xe5c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b39d5
jmp 0x4b39e3
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xe5c]
mov dword [ebp - 0x1c], edx
jmp 0x4b39a9
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe60], 0
jmp 0x4b3a07
mov ecx, dword [ebp - 0xe60]
add ecx, 1
mov dword [ebp - 0xe60], ecx
cmp dword [ebp - 0xe60], 8
jge 0x4b3a54
cmp dword [ebp - 0x1c], 0
jge 0x4b3a1e
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b3a34
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xe64], 0xfa
lea edx, [ebp - 0xe64]
push edx
lea eax, [ebp - 0x1060]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b39f8
mov ecx, 1
test ecx, ecx
je 0x4b3a8e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0x1064]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b3a80
jmp 0x4b3a8e
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1064]
mov dword [ebp - 0x1c], edx
jmp 0x4b3a54
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1068], 0
jmp 0x4b3ab2
mov ecx, dword [ebp - 0x1068]
add ecx, 1
mov dword [ebp - 0x1068], ecx
cmp dword [ebp - 0x1068], 7
jge 0x4b3ac9
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1068]
mov dword [ebp - 0x1c], edx
jmp 0x4b3aa3
cmp dword [ebp - 0x1c], 0
jge 0x4b3ad7
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b3aef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x106c], 0
jmp 0x4b3b0a
mov edx, dword [ebp - 0x106c]
add edx, 1
mov dword [ebp - 0x106c], edx
cmp dword [ebp - 0x106c], 7
jge 0x4b3b57
mov eax, dword [ebp - 0x106c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b3b39
mov eax, dword [ebp - 0x106c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b3b49
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x106c]
mov dword [ebp - 0x1c], edx
jmp 0x4b3b55
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x106c]
mov dword [ebp - 0x1c], eax
jmp 0x4b3afb
mov dword [ebp - 0x1070], 0
jmp 0x4b3b72
mov ecx, dword [ebp - 0x1070]
add ecx, 1
mov dword [ebp - 0x1070], ecx
cmp dword [ebp - 0x1070], 8
jge 0x4b3bbf
cmp dword [ebp - 0x1c], 0
jge 0x4b3b89
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b3b9f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1074], 0xfa
lea edx, [ebp - 0x1074]
push edx
lea eax, [ebp - 0x1270]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b3b63
mov dword [ebp - 0x1274], 0
jmp 0x4b3bda
mov ecx, dword [ebp - 0x1274]
add ecx, 1
mov dword [ebp - 0x1274], ecx
cmp dword [ebp - 0x1274], 6
jge 0x4b3c27
mov eax, dword [ebp - 0x1274]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b3c09
mov eax, dword [ebp - 0x1274]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b3c19
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1274]
mov dword [ebp - 0x1c], edx
jmp 0x4b3c25
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1274]
mov dword [ebp - 0x1c], eax
jmp 0x4b3bcb
mov dword [ebp - 0x1278], 0
jmp 0x4b3c42
mov ecx, dword [ebp - 0x1278]
add ecx, 1
mov dword [ebp - 0x1278], ecx
cmp dword [ebp - 0x1278], 8
jge 0x4b3c83
cmp dword [ebp - 0x1c], 0
jge 0x4b3c59
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b3c6f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1470]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b3c33
mov dword [ebp - 0x1474], 0
jmp 0x4b3c9e
mov eax, dword [ebp - 0x1474]
add eax, 1
mov dword [ebp - 0x1474], eax
cmp dword [ebp - 0x1474], 2
jge 0x4b3ceb
cmp dword [ebp - 0x1c], 0
jge 0x4b3cb5
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b3ccb
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1478], 0xfa
lea edx, [ebp - 0x1478]
push edx
lea eax, [ebp - 0x1670]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b3c8f
mov dword [ebp - 0x1674], 0
jmp 0x4b3d06
mov ecx, dword [ebp - 0x1674]
add ecx, 1
mov dword [ebp - 0x1674], ecx
cmp dword [ebp - 0x1674], 2
jge 0x4b3d47
cmp dword [ebp - 0x1c], 0
jge 0x4b3d1d
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b3d33
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1870]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b3cf7
mov dword [ebp - 0x1874], 0
jmp 0x4b3d62
mov eax, dword [ebp - 0x1874]
add eax, 1
mov dword [ebp - 0x1874], eax
cmp dword [ebp - 0x1874], 4
jge 0x4b3da3
cmp dword [ebp - 0x1c], 0
jge 0x4b3d79
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b3d8f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1a70]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b3d53
mov dword [ebp - 0x1a74], 0
jmp 0x4b3dbe
mov eax, dword [ebp - 0x1a74]
add eax, 1
mov dword [ebp - 0x1a74], eax
cmp dword [ebp - 0x1a74], 3
jge 0x4b3dff
cmp dword [ebp - 0x1c], 0
jge 0x4b3dd5
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b3deb
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1c70]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b3daf
mov eax, 1
test eax, eax
je 0x4b3e39
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c74], eax
mov eax, dword [ebp - 0x1c74]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b3e2b
jmp 0x4b3e39
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c74]
mov dword [ebp - 0x1c], edx
jmp 0x4b3dff
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4b3e7c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c78], eax
mov eax, dword [ebp - 0x1c78]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b3e6e
jmp 0x4b3e7c
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c78]
mov dword [ebp - 0x1c], edx
jmp 0x4b3e42
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c7c], 0
jmp 0x4b3ea0
mov ecx, dword [ebp - 0x1c7c]
add ecx, 1
mov dword [ebp - 0x1c7c], ecx
cmp dword [ebp - 0x1c7c], 2
jge 0x4b3eb7
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c7c]
mov dword [ebp - 0x1c], edx
jmp 0x4b3e91
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b3ec9
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b3ee1
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c80], 0
jmp 0x4b3efc
mov edx, dword [ebp - 0x1c80]
add edx, 1
mov dword [ebp - 0x1c80], edx
cmp dword [ebp - 0x1c80], 0
jge 0x4b3f49
mov eax, dword [ebp - 0x1c80]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b3f2b
mov eax, dword [ebp - 0x1c80]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b3f3b
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c80]
mov dword [ebp - 0x1c], edx
jmp 0x4b3f47
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c80]
mov dword [ebp - 0x1c], eax
jmp 0x4b3eed
mov ecx, 1
test ecx, ecx
je 0x4b3f83
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c84], eax
mov eax, dword [ebp - 0x1c84]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b3f75
jmp 0x4b3f83
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c84]
mov dword [ebp - 0x1c], edx
jmp 0x4b3f49
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c88], 0
jmp 0x4b3fa7
mov ecx, dword [ebp - 0x1c88]
add ecx, 1
mov dword [ebp - 0x1c88], ecx
cmp dword [ebp - 0x1c88], 2
jge 0x4b3fbe
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c88]
mov dword [ebp - 0x1c], edx
jmp 0x4b3f98
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b3fd0
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b3fe8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c8c], 0
jmp 0x4b4003
mov edx, dword [ebp - 0x1c8c]
add edx, 1
mov dword [ebp - 0x1c8c], edx
cmp dword [ebp - 0x1c8c], 4
jge 0x4b4050
cmp dword [ebp - 0x1c], 0
jge 0x4b401a
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b4030
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1c90], 0xfa
lea edx, [ebp - 0x1c90]
push edx
lea eax, [ebp - 0x1e88]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b3ff4
mov dword [ebp - 0x1e8c], 0
jmp 0x4b406b
mov ecx, dword [ebp - 0x1e8c]
add ecx, 1
mov dword [ebp - 0x1e8c], ecx
cmp dword [ebp - 0x1e8c], 2
jge 0x4b40b8
mov eax, dword [ebp - 0x1e8c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b409a
mov eax, dword [ebp - 0x1e8c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b40aa
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1e8c]
mov dword [ebp - 0x1c], edx
jmp 0x4b40b6
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1e8c]
mov dword [ebp - 0x1c], eax
jmp 0x4b405c
mov dword [ebp - 0x1e90], 0
jmp 0x4b40d3
mov ecx, dword [ebp - 0x1e90]
add ecx, 1
mov dword [ebp - 0x1e90], ecx
cmp dword [ebp - 0x1e90], 0
jge 0x4b40ea
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1e90]
mov dword [ebp - 0x1c], edx
jmp 0x4b40c4
cmp dword [ebp - 0x1c], 0
jge 0x4b40f8
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b4110
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1e94], 0
jmp 0x4b412b
mov edx, dword [ebp - 0x1e94]
add edx, 1
mov dword [ebp - 0x1e94], edx
cmp dword [ebp - 0x1e94], 3
jge 0x4b4178
mov eax, dword [ebp - 0x1e94]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b415a
mov eax, dword [ebp - 0x1e94]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b416a
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1e94]
mov dword [ebp - 0x1c], edx
jmp 0x4b4176
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1e94]
mov dword [ebp - 0x1c], eax
jmp 0x4b411c
mov dword [ebp - 0x1e98], 0
jmp 0x4b4193
mov ecx, dword [ebp - 0x1e98]
add ecx, 1
mov dword [ebp - 0x1e98], ecx
cmp dword [ebp - 0x1e98], 4
jge 0x4b41e0
mov eax, dword [ebp - 0x1e98]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b41c2
mov eax, dword [ebp - 0x1e98]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b41d2
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1e98]
mov dword [ebp - 0x1c], edx
jmp 0x4b41de
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1e98]
mov dword [ebp - 0x1c], eax
jmp 0x4b4184
mov dword [ebp - 0x1e9c], 0
jmp 0x4b41fb
mov ecx, dword [ebp - 0x1e9c]
add ecx, 1
mov dword [ebp - 0x1e9c], ecx
cmp dword [ebp - 0x1e9c], 2
jge 0x4b4248
mov eax, dword [ebp - 0x1e9c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b422a
mov eax, dword [ebp - 0x1e9c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b423a
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1e9c]
mov dword [ebp - 0x1c], edx
jmp 0x4b4246
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1e9c]
mov dword [ebp - 0x1c], eax
jmp 0x4b41ec
mov dword [ebp - 0x1ea0], 0
jmp 0x4b4263
mov ecx, dword [ebp - 0x1ea0]
add ecx, 1
mov dword [ebp - 0x1ea0], ecx
cmp dword [ebp - 0x1ea0], 3
jge 0x4b427a
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1ea0]
mov dword [ebp - 0x1c], edx
jmp 0x4b4254
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b428c
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b42a4
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1ea4], 0
jmp 0x4b42bf
mov edx, dword [ebp - 0x1ea4]
add edx, 1
mov dword [ebp - 0x1ea4], edx
cmp dword [ebp - 0x1ea4], 4
jge 0x4b430c
mov eax, dword [ebp - 0x1ea4]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b42ee
mov eax, dword [ebp - 0x1ea4]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b42fe
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1ea4]
mov dword [ebp - 0x1c], edx
jmp 0x4b430a
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1ea4]
mov dword [ebp - 0x1c], eax
jmp 0x4b42b0
mov dword [ebp - 0x1ea8], 0
jmp 0x4b4327
mov ecx, dword [ebp - 0x1ea8]
add ecx, 1
mov dword [ebp - 0x1ea8], ecx
cmp dword [ebp - 0x1ea8], 4
jge 0x4b4374
cmp dword [ebp - 0x1c], 0
jge 0x4b433e
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b4354
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1eac], 0xfa
lea edx, [ebp - 0x1eac]
push edx
lea eax, [ebp - 0x20a8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b4318
mov ecx, 1
test ecx, ecx
je 0x4b43ae
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20ac], eax
mov eax, dword [ebp - 0x20ac]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b43a0
jmp 0x4b43ae
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x20ac]
mov dword [ebp - 0x1c], edx
jmp 0x4b4374
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20b0], 0
jmp 0x4b43d2
mov ecx, dword [ebp - 0x20b0]
add ecx, 1
mov dword [ebp - 0x20b0], ecx
cmp dword [ebp - 0x20b0], 2
jge 0x4b441f
cmp dword [ebp - 0x1c], 0
jge 0x4b43e9
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b43ff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20b4], 0xfa
lea edx, [ebp - 0x20b4]
push edx
lea eax, [ebp - 0x22b0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b43c3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret