Function at 0x4d3960
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x513c50
push 0x40b390
mov eax, dword fs:[0]
push eax
add esp, 0xfffff3c0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x30], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jmp 0x4d39b2
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x15
jge 0x4d39c3
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
jmp 0x4d39a9
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d39d5
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d39ed
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4d3a1e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d3a13
jmp 0x4d3a1e
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
jmp 0x4d39ed
mov eax, dword [ebp - 0x1c]
add eax, 0x26
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
jmp 0x4d3a39
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 8
jge 0x4d3a7d
cmp dword [ebp - 0x1c], 0
jge 0x4d3a4d
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d3a63
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2c], 0xfa
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d3a30
mov dword [ebp - 0x22c], 0
jmp 0x4d3a98
mov ecx, dword [ebp - 0x22c]
add ecx, 1
mov dword [ebp - 0x22c], ecx
cmp dword [ebp - 0x22c], 0x19
jge 0x4d3aaf
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x22c]
mov dword [ebp - 0x1c], edx
jmp 0x4d3a89
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d3ac1
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3ad9
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], 0
jmp 0x4d3af4
mov edx, dword [ebp - 0x230]
add edx, 1
mov dword [ebp - 0x230], edx
cmp dword [ebp - 0x230], 8
jge 0x4d3b41
mov eax, dword [ebp - 0x230]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d3b23
mov eax, dword [ebp - 0x230]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d3b33
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x230]
mov dword [ebp - 0x1c], edx
jmp 0x4d3b3f
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x230]
mov dword [ebp - 0x1c], eax
jmp 0x4d3ae5
mov dword [ebp - 0x234], 0
jmp 0x4d3b5c
mov ecx, dword [ebp - 0x234]
add ecx, 1
mov dword [ebp - 0x234], ecx
cmp dword [ebp - 0x234], 0xb
jge 0x4d3ba9
cmp dword [ebp - 0x1c], 0
jge 0x4d3b73
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d3b89
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x238], 0xfa
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d3b4d
mov dword [ebp - 0x434], 0
jmp 0x4d3bc4
mov ecx, dword [ebp - 0x434]
add ecx, 1
mov dword [ebp - 0x434], ecx
cmp dword [ebp - 0x434], 6
jge 0x4d3bdb
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x434]
mov dword [ebp - 0x1c], edx
jmp 0x4d3bb5
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d3bed
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3c05
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0x43c], 0
jmp 0x4d3c31
mov edx, dword [ebp - 0x43c]
add edx, 1
mov dword [ebp - 0x43c], edx
cmp dword [ebp - 0x43c], 0x10
jge 0x4d3c63
mov eax, dword [ebp - 0x43c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d3c58
mov edx, dword [ebp - 0x438]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d3c22
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d3c83
mov dword [ebp - 0x440], 0
jmp 0x4d3c9e
mov edx, dword [ebp - 0x440]
add edx, 1
mov dword [ebp - 0x440], edx
cmp dword [ebp - 0x440], 4
jge 0x4d3cb5
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x440]
mov dword [ebp - 0x1c], eax
jmp 0x4d3c8f
cmp dword [ebp - 0x1c], 0
jge 0x4d3cc3
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d3cdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x444], 0
jmp 0x4d3cf6
mov edx, dword [ebp - 0x444]
add edx, 1
mov dword [ebp - 0x444], edx
cmp dword [ebp - 0x444], 8
jge 0x4d3d37
cmp dword [ebp - 0x1c], 0
jge 0x4d3d0d
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3d23
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x640]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d3ce7
mov dword [ebp - 0x644], 0
jmp 0x4d3d52
mov eax, dword [ebp - 0x644]
add eax, 1
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 2
jge 0x4d3d93
cmp dword [ebp - 0x1c], 0
jge 0x4d3d69
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3d7f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x840]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d3d43
mov dword [ebp - 4], 1
mov dword [ebp - 0x844], 0xffffffff
mov dword [ebp - 0x848], 0
jmp 0x4d3dbf
mov eax, dword [ebp - 0x848]
add eax, 1
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 5
jge 0x4d3df1
mov eax, dword [ebp - 0x848]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d3de6
mov edx, dword [ebp - 0x844]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d3db0
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d3e11
mov dword [ebp - 0x84c], 0
jmp 0x4d3e2c
mov edx, dword [ebp - 0x84c]
add edx, 1
mov dword [ebp - 0x84c], edx
cmp dword [ebp - 0x84c], 1
jge 0x4d3e79
mov eax, dword [ebp - 0x84c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d3e5b
mov eax, dword [ebp - 0x84c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d3e6b
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x84c]
mov dword [ebp - 0x1c], edx
jmp 0x4d3e77
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x84c]
mov dword [ebp - 0x1c], eax
jmp 0x4d3e1d
mov dword [ebp - 0x850], 0
jmp 0x4d3e94
mov ecx, dword [ebp - 0x850]
add ecx, 1
mov dword [ebp - 0x850], ecx
cmp dword [ebp - 0x850], 0
jge 0x4d3ed5
cmp dword [ebp - 0x1c], 0
jge 0x4d3eab
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3ec1
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa48]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d3e85
mov eax, 1
test eax, eax
je 0x4d3f0f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d3f01
jmp 0x4d3f0f
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xa4c]
mov dword [ebp - 0x1c], edx
jmp 0x4d3ed5
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa50], 0
jmp 0x4d3f33
mov ecx, dword [ebp - 0xa50]
add ecx, 1
mov dword [ebp - 0xa50], ecx
cmp dword [ebp - 0xa50], 1
jge 0x4d3f80
mov eax, dword [ebp - 0xa50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d3f62
mov eax, dword [ebp - 0xa50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d3f72
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xa50]
mov dword [ebp - 0x1c], edx
jmp 0x4d3f7e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xa50]
mov dword [ebp - 0x1c], eax
jmp 0x4d3f24
mov dword [ebp - 0xa54], 0
jmp 0x4d3f9b
mov ecx, dword [ebp - 0xa54]
add ecx, 1
mov dword [ebp - 0xa54], ecx
cmp dword [ebp - 0xa54], 2
jge 0x4d3fdc
cmp dword [ebp - 0x1c], 0
jge 0x4d3fb2
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d3fc8
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xc50]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d3f8c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret