Function at 0x4af310
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5130d8
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x3110
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x3c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0
jmp 0x4af377
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3c
jge 0x4af3a0
mov eax, dword [ebp - 0x24]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4af395
mov edx, dword [ebp - 0x20]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4af36e
mov dword [ebp - 4], 0xfffffffe
jmp 0x4af3c0
mov dword [ebp - 0x28], 0
jmp 0x4af3d2
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x20
jge 0x4af3e3
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
jmp 0x4af3c9
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4af3f5
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4af40d
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], 0
jmp 0x4af42d
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 2
jge 0x4af456
mov eax, dword [ebp - 0x30]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4af44b
mov edx, dword [ebp - 0x2c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4af424
mov dword [ebp - 4], 0xfffffffe
jmp 0x4af476
mov dword [ebp - 0x34], 0
jmp 0x4af488
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0xa
jge 0x4af4c6
mov eax, dword [ebp - 0x34]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4af4ae
mov eax, dword [ebp - 0x34]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4af4bb
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], edx
jmp 0x4af4c4
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp 0x4af47f
mov dword [ebp - 0x38], 0
jmp 0x4af4d8
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 6
jge 0x4af516
cmp dword [ebp - 0x1c], 0
jge 0x4af4ec
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4af502
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4af4cf
mov dword [ebp - 0x23c], 0
jmp 0x4af531
mov eax, dword [ebp - 0x23c]
add eax, 1
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x4af57e
cmp dword [ebp - 0x1c], 0
jge 0x4af548
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4af55e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x240], 0xfa
lea edx, [ebp - 0x240]
push edx
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4af522
mov dword [ebp - 0x43c], 0
jmp 0x4af599
mov ecx, dword [ebp - 0x43c]
add ecx, 1
mov dword [ebp - 0x43c], ecx
cmp dword [ebp - 0x43c], 2
jge 0x4af5e6
mov eax, dword [ebp - 0x43c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4af5c8
mov eax, dword [ebp - 0x43c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4af5d8
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x43c]
mov dword [ebp - 0x1c], edx
jmp 0x4af5e4
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x43c]
mov dword [ebp - 0x1c], eax
jmp 0x4af58a
mov dword [ebp - 4], 2
mov dword [ebp - 0x440], 0xffffffff
mov dword [ebp - 0x444], 0
jmp 0x4af612
mov ecx, dword [ebp - 0x444]
add ecx, 1
mov dword [ebp - 0x444], ecx
cmp dword [ebp - 0x444], 5
jge 0x4af644
mov eax, dword [ebp - 0x444]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4af639
mov edx, dword [ebp - 0x440]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4af603
mov dword [ebp - 4], 0xfffffffe
jmp 0x4af664
mov edx, 1
test edx, edx
je 0x4af69e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x448]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4af690
jmp 0x4af69e
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x448]
mov dword [ebp - 0x1c], edx
jmp 0x4af664
mov eax, dword [ebp - 0x1c]
add eax, 0xc
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4af6e1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4af6d3
jmp 0x4af6e1
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x44c]
mov dword [ebp - 0x1c], edx
jmp 0x4af6a7
mov eax, dword [ebp - 0x1c]
add eax, 7
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x4af724
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x450]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4af716
jmp 0x4af724
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x450]
mov dword [ebp - 0x1c], edx
jmp 0x4af6ea
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x454], 0
jmp 0x4af748
mov ecx, dword [ebp - 0x454]
add ecx, 1
mov dword [ebp - 0x454], ecx
cmp dword [ebp - 0x454], 8
jge 0x4af75f
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x454]
mov dword [ebp - 0x1c], edx
jmp 0x4af739
cmp dword [ebp - 0x1c], 0
jge 0x4af76d
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4af785
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x458], 0
jmp 0x4af7a0
mov edx, dword [ebp - 0x458]
add edx, 1
mov dword [ebp - 0x458], edx
cmp dword [ebp - 0x458], 1
jge 0x4af7ed
cmp dword [ebp - 0x1c], 0
jge 0x4af7b7
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4af7cd
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x45c], 0xfa
lea edx, [ebp - 0x45c]
push edx
lea eax, [ebp - 0x658]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4af791
mov dword [ebp - 4], 3
mov dword [ebp - 0x65c], 0xffffffff
mov dword [ebp - 0x660], 0
jmp 0x4af819
mov ecx, dword [ebp - 0x660]
add ecx, 1
mov dword [ebp - 0x660], ecx
cmp dword [ebp - 0x660], 6
jge 0x4af84b
mov eax, dword [ebp - 0x660]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4af840
mov edx, dword [ebp - 0x65c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4af80a
mov dword [ebp - 4], 0xfffffffe
jmp 0x4af86b
mov dword [ebp - 0x664], 0
jmp 0x4af886
mov edx, dword [ebp - 0x664]
add edx, 1
mov dword [ebp - 0x664], edx
cmp dword [ebp - 0x664], 0xc
jge 0x4af8c7
cmp dword [ebp - 0x1c], 0
jge 0x4af89d
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4af8b3
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x860]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4af877
mov dword [ebp - 0x864], 0
jmp 0x4af8e2
mov eax, dword [ebp - 0x864]
add eax, 1
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 3
jge 0x4af92f
mov eax, dword [ebp - 0x864]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4af911
mov eax, dword [ebp - 0x864]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4af921
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x864]
mov dword [ebp - 0x1c], edx
jmp 0x4af92d
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x864]
mov dword [ebp - 0x1c], eax
jmp 0x4af8d3
mov dword [ebp - 0x868], 0
jmp 0x4af94a
mov ecx, dword [ebp - 0x868]
add ecx, 1
mov dword [ebp - 0x868], ecx
cmp dword [ebp - 0x868], 3
jge 0x4af98b
cmp dword [ebp - 0x1c], 0
jge 0x4af961
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4af977
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xa60]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4af93b
mov dword [ebp - 0xa64], 0
jmp 0x4af9a6
mov eax, dword [ebp - 0xa64]
add eax, 1
mov dword [ebp - 0xa64], eax
cmp dword [ebp - 0xa64], 0
jge 0x4af9f3
cmp dword [ebp - 0x1c], 0
jge 0x4af9bd
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4af9d3
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xa68], 0xfa
lea edx, [ebp - 0xa68]
push edx
lea eax, [ebp - 0xc60]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4af997
mov dword [ebp - 0xc64], 0
jmp 0x4afa0e
mov ecx, dword [ebp - 0xc64]
add ecx, 1
mov dword [ebp - 0xc64], ecx
cmp dword [ebp - 0xc64], 0
jge 0x4afa4f
cmp dword [ebp - 0x1c], 0
jge 0x4afa25
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4afa3b
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xe60]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4af9ff
mov dword [ebp - 0xe64], 0
jmp 0x4afa6a
mov eax, dword [ebp - 0xe64]
add eax, 1
mov dword [ebp - 0xe64], eax
cmp dword [ebp - 0xe64], 2
jge 0x4afab7
cmp dword [ebp - 0x1c], 0
jge 0x4afa81
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4afa97
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xe68], 0xfa
lea edx, [ebp - 0xe68]
push edx
lea eax, [ebp - 0x1060]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4afa5b
mov dword [ebp - 0x1064], 0
jmp 0x4afad2
mov ecx, dword [ebp - 0x1064]
add ecx, 1
mov dword [ebp - 0x1064], ecx
cmp dword [ebp - 0x1064], 1
jge 0x4afae9
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1064]
mov dword [ebp - 0x1c], edx
jmp 0x4afac3
cmp dword [ebp - 0x1c], 0
jge 0x4afaf7
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4afb0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1068], 0
jmp 0x4afb2a
mov edx, dword [ebp - 0x1068]
add edx, 1
mov dword [ebp - 0x1068], edx
cmp dword [ebp - 0x1068], 7
jge 0x4afb6b
cmp dword [ebp - 0x1c], 0
jge 0x4afb41
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4afb57
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1260]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4afb1b
mov dword [ebp - 0x1264], 0
jmp 0x4afb86
mov eax, dword [ebp - 0x1264]
add eax, 1
mov dword [ebp - 0x1264], eax
cmp dword [ebp - 0x1264], 4
jge 0x4afb9d
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1264]
mov dword [ebp - 0x1c], ecx
jmp 0x4afb77
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4afbaf
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4afbc7
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1268], 0
jmp 0x4afbe2
mov edx, dword [ebp - 0x1268]
add edx, 1
mov dword [ebp - 0x1268], edx
cmp dword [ebp - 0x1268], 6
jge 0x4afbf9
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x1268]
mov dword [ebp - 0x1c], eax
jmp 0x4afbd3
cmp dword [ebp - 0x1c], 0
jge 0x4afc07
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4afc1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x126c], 0
jmp 0x4afc3a
mov edx, dword [ebp - 0x126c]
add edx, 1
mov dword [ebp - 0x126c], edx
cmp dword [ebp - 0x126c], 8
jge 0x4afc87
mov eax, dword [ebp - 0x126c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4afc69
mov eax, dword [ebp - 0x126c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4afc79
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x126c]
mov dword [ebp - 0x1c], edx
jmp 0x4afc85
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x126c]
mov dword [ebp - 0x1c], eax
jmp 0x4afc2b
mov dword [ebp - 0x1270], 0
jmp 0x4afca2
mov ecx, dword [ebp - 0x1270]
add ecx, 1
mov dword [ebp - 0x1270], ecx
cmp dword [ebp - 0x1270], 3
jge 0x4afce3
cmp dword [ebp - 0x1c], 0
jge 0x4afcb9
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4afccf
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1468]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4afc93
mov dword [ebp - 0x146c], 0
jmp 0x4afcfe
mov eax, dword [ebp - 0x146c]
add eax, 1
mov dword [ebp - 0x146c], eax
cmp dword [ebp - 0x146c], 4
jge 0x4afd4b
mov eax, dword [ebp - 0x146c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4afd2d
mov eax, dword [ebp - 0x146c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4afd3d
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x146c]
mov dword [ebp - 0x1c], edx
jmp 0x4afd49
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x146c]
mov dword [ebp - 0x1c], eax
jmp 0x4afcef
mov ecx, 1
test ecx, ecx
je 0x4afd85
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1470], eax
mov eax, dword [ebp - 0x1470]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4afd77
jmp 0x4afd85
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1470]
mov dword [ebp - 0x1c], edx
jmp 0x4afd4b
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1474], 0
jmp 0x4afda9
mov ecx, dword [ebp - 0x1474]
add ecx, 1
mov dword [ebp - 0x1474], ecx
cmp dword [ebp - 0x1474], 0
jge 0x4afdc0
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1474]
mov dword [ebp - 0x1c], edx
jmp 0x4afd9a
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4afdd2
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4afdea
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4afe24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1478], eax
mov eax, dword [ebp - 0x1478]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4afe16
jmp 0x4afe24
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1478]
mov dword [ebp - 0x1c], edx
jmp 0x4afdea
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x147c], 0
jmp 0x4afe48
mov ecx, dword [ebp - 0x147c]
add ecx, 1
mov dword [ebp - 0x147c], ecx
cmp dword [ebp - 0x147c], 1
jge 0x4afe5f
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x147c]
mov dword [ebp - 0x1c], edx
jmp 0x4afe39
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4afe71
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4afe89
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1480], 0
jmp 0x4afea4
mov edx, dword [ebp - 0x1480]
add edx, 1
mov dword [ebp - 0x1480], edx
cmp dword [ebp - 0x1480], 4
jge 0x4afee5
cmp dword [ebp - 0x1c], 0
jge 0x4afebb
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4afed1
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1678]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4afe95
mov dword [ebp - 0x167c], 0
jmp 0x4aff00
mov eax, dword [ebp - 0x167c]
add eax, 1
mov dword [ebp - 0x167c], eax
cmp dword [ebp - 0x167c], 7
jge 0x4aff4d
mov eax, dword [ebp - 0x167c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4aff2f
mov eax, dword [ebp - 0x167c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4aff3f
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x167c]
mov dword [ebp - 0x1c], edx
jmp 0x4aff4b
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x167c]
mov dword [ebp - 0x1c], eax
jmp 0x4afef1
mov dword [ebp - 0x1680], 0
jmp 0x4aff68
mov ecx, dword [ebp - 0x1680]
add ecx, 1
mov dword [ebp - 0x1680], ecx
cmp dword [ebp - 0x1680], 2
jge 0x4affa9
cmp dword [ebp - 0x1c], 0
jge 0x4aff7f
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4aff95
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1878]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4aff59
mov dword [ebp - 4], 4
mov dword [ebp - 0x187c], 0xffffffff
mov dword [ebp - 0x1880], 0
jmp 0x4affd5
mov eax, dword [ebp - 0x1880]
add eax, 1
mov dword [ebp - 0x1880], eax
cmp dword [ebp - 0x1880], 1
jge 0x4b0007
mov eax, dword [ebp - 0x1880]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4afffc
mov edx, dword [ebp - 0x187c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4affc6
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b0027
mov dword [ebp - 0x1884], 0
jmp 0x4b0042
mov edx, dword [ebp - 0x1884]
add edx, 1
mov dword [ebp - 0x1884], edx
cmp dword [ebp - 0x1884], 2
jge 0x4b008f
mov eax, dword [ebp - 0x1884]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b0071
mov eax, dword [ebp - 0x1884]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b0081
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1884]
mov dword [ebp - 0x1c], edx
jmp 0x4b008d
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1884]
mov dword [ebp - 0x1c], eax
jmp 0x4b0033
mov dword [ebp - 0x1888], 0
jmp 0x4b00aa
mov ecx, dword [ebp - 0x1888]
add ecx, 1
mov dword [ebp - 0x1888], ecx
cmp dword [ebp - 0x1888], 3
jge 0x4b00c1
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1888]
mov dword [ebp - 0x1c], edx
jmp 0x4b009b
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b00d3
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b00eb
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x188c], 0
jmp 0x4b0106
mov edx, dword [ebp - 0x188c]
add edx, 1
mov dword [ebp - 0x188c], edx
cmp dword [ebp - 0x188c], 2
jge 0x4b0153
cmp dword [ebp - 0x1c], 0
jge 0x4b011d
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b0133
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1890], 0xfa
lea edx, [ebp - 0x1890]
push edx
lea eax, [ebp - 0x1a88]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4b00f7
mov ecx, 1
test ecx, ecx
je 0x4b018d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1a8c], eax
mov eax, dword [ebp - 0x1a8c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4b017f
jmp 0x4b018d
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1a8c]
mov dword [ebp - 0x1c], edx
jmp 0x4b0153
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1a90], 0
jmp 0x4b01b1
mov ecx, dword [ebp - 0x1a90]
add ecx, 1
mov dword [ebp - 0x1a90], ecx
cmp dword [ebp - 0x1a90], 3
jge 0x4b01c8
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1a90]
mov dword [ebp - 0x1c], edx
jmp 0x4b01a2
cmp dword [ebp - 0x1c], 0
jge 0x4b01d6
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b01ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1a94], 0
jmp 0x4b0209
mov edx, dword [ebp - 0x1a94]
add edx, 1
mov dword [ebp - 0x1a94], edx
cmp dword [ebp - 0x1a94], 1
jge 0x4b0256
mov eax, dword [ebp - 0x1a94]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b0238
mov eax, dword [ebp - 0x1a94]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b0248
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1a94]
mov dword [ebp - 0x1c], edx
jmp 0x4b0254
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1a94]
mov dword [ebp - 0x1c], eax
jmp 0x4b01fa
mov dword [ebp - 0x1a98], 0
jmp 0x4b0271
mov ecx, dword [ebp - 0x1a98]
add ecx, 1
mov dword [ebp - 0x1a98], ecx
cmp dword [ebp - 0x1a98], 2
jge 0x4b0288
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1a98]
mov dword [ebp - 0x1c], edx
jmp 0x4b0262
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b029a
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b02b2
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1a9c], 0
jmp 0x4b02cd
mov edx, dword [ebp - 0x1a9c]
add edx, 1
mov dword [ebp - 0x1a9c], edx
cmp dword [ebp - 0x1a9c], 4
jge 0x4b02e4
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1a9c]
mov dword [ebp - 0x1c], eax
jmp 0x4b02be
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b02f6
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b030e
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1aa0], 0
jmp 0x4b0329
mov edx, dword [ebp - 0x1aa0]
add edx, 1
mov dword [ebp - 0x1aa0], edx
cmp dword [ebp - 0x1aa0], 3
jge 0x4b036a
cmp dword [ebp - 0x1c], 0
jge 0x4b0340
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b0356
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1c98]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b031a
mov dword [ebp - 0x1c9c], 0
jmp 0x4b0385
mov eax, dword [ebp - 0x1c9c]
add eax, 1
mov dword [ebp - 0x1c9c], eax
cmp dword [ebp - 0x1c9c], 3
jge 0x4b03d2
mov eax, dword [ebp - 0x1c9c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4b03b4
mov eax, dword [ebp - 0x1c9c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4b03c4
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c9c]
mov dword [ebp - 0x1c], edx
jmp 0x4b03d0
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1c9c]
mov dword [ebp - 0x1c], eax
jmp 0x4b0376
mov dword [ebp - 0x1ca0], 0
jmp 0x4b03ed
mov ecx, dword [ebp - 0x1ca0]
add ecx, 1
mov dword [ebp - 0x1ca0], ecx
cmp dword [ebp - 0x1ca0], 0
jge 0x4b042e
cmp dword [ebp - 0x1c], 0
jge 0x4b0404
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b041a
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1e98]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4b03de
mov dword [ebp - 4], 5
mov dword [ebp - 0x1e9c], 0xffffffff
mov dword [ebp - 0x1ea0], 0
jmp 0x4b045a
mov eax, dword [ebp - 0x1ea0]
add eax, 1
mov dword [ebp - 0x1ea0], eax
cmp dword [ebp - 0x1ea0], 3
jge 0x4b048c
mov eax, dword [ebp - 0x1ea0]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4b0481
mov edx, dword [ebp - 0x1e9c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4b044b
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b04ac
mov dword [ebp - 0x1ea4], 0
jmp 0x4b04c7
mov edx, dword [ebp - 0x1ea4]
add edx, 1
mov dword [ebp - 0x1ea4], edx
cmp dword [ebp - 0x1ea4], 0
jge 0x4b04de
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1ea4]
mov dword [ebp - 0x1c], eax
jmp 0x4b04b8
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b04f0
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b0508
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1ea8], 0
jmp 0x4b0523
mov edx, dword [ebp - 0x1ea8]
add edx, 1
mov dword [ebp - 0x1ea8], edx
cmp dword [ebp - 0x1ea8], 3
jge 0x4b053a
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1ea8]
mov dword [ebp - 0x1c], eax
jmp 0x4b0514
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4b054c
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4b0564
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1eac], 0
jmp 0x4b057f
mov edx, dword [ebp - 0x1eac]
add edx, 1
mov dword [ebp - 0x1eac], edx
cmp dword [ebp - 0x1eac], 1
jge 0x4b0596
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x1eac]
mov dword [ebp - 0x1c], eax
jmp 0x4b0570
cmp dword [ebp - 0x1c], 0
jge 0x4b05a4
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4b05bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x1eb0], 0xffffffff
mov dword [ebp - 0x1eb4], 0
jmp 0x4b05e8