Function at 0x4d5a20
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x513cf8
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2ef0
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x30], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0
jmp 0x4d5a87
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x37
jge 0x4d5ab0
mov eax, dword [ebp - 0x24]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d5aa5
mov edx, dword [ebp - 0x20]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d5a7e
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d5ad0
mov edx, 1
test edx, edx
je 0x4d5b01
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d5af6
jmp 0x4d5b01
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
jmp 0x4d5ad0
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0
jmp 0x4d5b1c
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0x19
jge 0x4d5b5a
cmp dword [ebp - 0x1c], 0
jge 0x4d5b30
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d5b46
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d5b13
mov dword [ebp - 4], 1
mov dword [ebp - 0x22c], 0xffffffff
mov dword [ebp - 0x230], 0
jmp 0x4d5b86
mov eax, dword [ebp - 0x230]
add eax, 1
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xe
jge 0x4d5bb8
mov eax, dword [ebp - 0x230]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d5bad
mov edx, dword [ebp - 0x22c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d5b77
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d5bd8
mov dword [ebp - 0x234], 0
jmp 0x4d5bf3
mov edx, dword [ebp - 0x234]
add edx, 1
mov dword [ebp - 0x234], edx
cmp dword [ebp - 0x234], 1
jge 0x4d5c0a
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x234]
mov dword [ebp - 0x1c], eax
jmp 0x4d5be4
cmp dword [ebp - 0x1c], 0
jge 0x4d5c18
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d5c30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x238], 0
jmp 0x4d5c4b
mov edx, dword [ebp - 0x238]
add edx, 1
mov dword [ebp - 0x238], edx
cmp dword [ebp - 0x238], 3
jge 0x4d5c98
cmp dword [ebp - 0x1c], 0
jge 0x4d5c62
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d5c78
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x23c], 0xfa
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d5c3c
mov dword [ebp - 0x43c], 0
jmp 0x4d5cb3
mov ecx, dword [ebp - 0x43c]
add ecx, 1
mov dword [ebp - 0x43c], ecx
cmp dword [ebp - 0x43c], 0xf
jge 0x4d5cf4
cmp dword [ebp - 0x1c], 0
jge 0x4d5cca
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d5ce0
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x638]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d5ca4
mov dword [ebp - 0x63c], 0
jmp 0x4d5d0f
mov eax, dword [ebp - 0x63c]
add eax, 1
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0xa
jge 0x4d5d5c
cmp dword [ebp - 0x1c], 0
jge 0x4d5d26
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d5d3c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x640], 0xfa
lea edx, [ebp - 0x640]
push edx
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d5d00
mov dword [ebp - 0x83c], 0
jmp 0x4d5d77
mov ecx, dword [ebp - 0x83c]
add ecx, 1
mov dword [ebp - 0x83c], ecx
cmp dword [ebp - 0x83c], 0xd
jge 0x4d5dc4
mov eax, dword [ebp - 0x83c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d5da6
mov eax, dword [ebp - 0x83c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d5db6
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x83c]
mov dword [ebp - 0x1c], edx
jmp 0x4d5dc2
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x83c]
mov dword [ebp - 0x1c], eax
jmp 0x4d5d68
mov dword [ebp - 0x840], 0
jmp 0x4d5ddf
mov ecx, dword [ebp - 0x840]
add ecx, 1
mov dword [ebp - 0x840], ecx
cmp dword [ebp - 0x840], 0
jge 0x4d5e2c
cmp dword [ebp - 0x1c], 0
jge 0x4d5df6
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d5e0c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x844], 0xfa
lea edx, [ebp - 0x844]
push edx
lea eax, [ebp - 0xa40]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d5dd0
mov ecx, 1
test ecx, ecx
je 0x4d5e66
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xa44], eax
mov eax, dword [ebp - 0xa44]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d5e58
jmp 0x4d5e66
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xa44]
mov dword [ebp - 0x1c], edx
jmp 0x4d5e2c
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa48], 0
jmp 0x4d5e8a
mov ecx, dword [ebp - 0xa48]
add ecx, 1
mov dword [ebp - 0xa48], ecx
cmp dword [ebp - 0xa48], 0
jge 0x4d5ecb
cmp dword [ebp - 0x1c], 0
jge 0x4d5ea1
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d5eb7
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xc40]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d5e7b
mov dword [ebp - 0xc44], 0
jmp 0x4d5ee6
mov eax, dword [ebp - 0xc44]
add eax, 1
mov dword [ebp - 0xc44], eax
cmp dword [ebp - 0xc44], 0
jge 0x4d5efd
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0xc44]
mov dword [ebp - 0x1c], ecx
jmp 0x4d5ed7
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d5f0f
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d5f27
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc48], 0
jmp 0x4d5f42
mov edx, dword [ebp - 0xc48]
add edx, 1
mov dword [ebp - 0xc48], edx
cmp dword [ebp - 0xc48], 6
jge 0x4d5f8f
cmp dword [ebp - 0x1c], 0
jge 0x4d5f59
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d5f6f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc4c], 0xfa
lea edx, [ebp - 0xc4c]
push edx
lea eax, [ebp - 0xe48]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d5f33
mov dword [ebp - 0xe4c], 0
jmp 0x4d5faa
mov ecx, dword [ebp - 0xe4c]
add ecx, 1
mov dword [ebp - 0xe4c], ecx
cmp dword [ebp - 0xe4c], 7
jge 0x4d5feb
cmp dword [ebp - 0x1c], 0
jge 0x4d5fc1
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d5fd7
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1048]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d5f9b
mov eax, 1
test eax, eax
je 0x4d6025
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x104c], eax
mov eax, dword [ebp - 0x104c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d6017
jmp 0x4d6025
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x104c]
mov dword [ebp - 0x1c], edx
jmp 0x4d5feb
mov eax, dword [ebp - 0x1c]
add eax, 6
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1050], 0
jmp 0x4d6049
mov ecx, dword [ebp - 0x1050]
add ecx, 1
mov dword [ebp - 0x1050], ecx
cmp dword [ebp - 0x1050], 4
jge 0x4d6060
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1050]
mov dword [ebp - 0x1c], edx
jmp 0x4d603a
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d6072
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d608a
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1054], 0
jmp 0x4d60a5
mov edx, dword [ebp - 0x1054]
add edx, 1
mov dword [ebp - 0x1054], edx
cmp dword [ebp - 0x1054], 3
jge 0x4d60f2
mov eax, dword [ebp - 0x1054]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d60d4
mov eax, dword [ebp - 0x1054]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d60e4
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1054]
mov dword [ebp - 0x1c], edx
jmp 0x4d60f0
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1054]
mov dword [ebp - 0x1c], eax
jmp 0x4d6096
mov dword [ebp - 0x1058], 0
jmp 0x4d610d
mov ecx, dword [ebp - 0x1058]
add ecx, 1
mov dword [ebp - 0x1058], ecx
cmp dword [ebp - 0x1058], 0
jge 0x4d615a
mov eax, dword [ebp - 0x1058]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d613c
mov eax, dword [ebp - 0x1058]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d614c
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1058]
mov dword [ebp - 0x1c], edx
jmp 0x4d6158
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1058]
mov dword [ebp - 0x1c], eax
jmp 0x4d60fe
mov dword [ebp - 4], 2
mov dword [ebp - 0x105c], 0xffffffff
mov dword [ebp - 0x1060], 0
jmp 0x4d6186
mov ecx, dword [ebp - 0x1060]
add ecx, 1
mov dword [ebp - 0x1060], ecx
cmp dword [ebp - 0x1060], 0
jge 0x4d61b8
mov eax, dword [ebp - 0x1060]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d61ad
mov edx, dword [ebp - 0x105c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d6177
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d61d8
mov dword [ebp - 0x1064], 0
jmp 0x4d61f3
mov edx, dword [ebp - 0x1064]
add edx, 1
mov dword [ebp - 0x1064], edx
cmp dword [ebp - 0x1064], 3
jge 0x4d620a
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1064]
mov dword [ebp - 0x1c], eax
jmp 0x4d61e4
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d621c
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d6234
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1068], 0
jmp 0x4d624f
mov edx, dword [ebp - 0x1068]
add edx, 1
mov dword [ebp - 0x1068], edx
cmp dword [ebp - 0x1068], 4
jge 0x4d6266
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1068]
mov dword [ebp - 0x1c], eax
jmp 0x4d6240
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d6278
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d6290
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x106c], 0
jmp 0x4d62ab
mov edx, dword [ebp - 0x106c]
add edx, 1
mov dword [ebp - 0x106c], edx
cmp dword [ebp - 0x106c], 7
jge 0x4d62c2
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x106c]
mov dword [ebp - 0x1c], eax
jmp 0x4d629c
cmp dword [ebp - 0x1c], 0
jge 0x4d62d0
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d62e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1070], 0
jmp 0x4d6303
mov edx, dword [ebp - 0x1070]
add edx, 1
mov dword [ebp - 0x1070], edx
cmp dword [ebp - 0x1070], 6
jge 0x4d6350
mov eax, dword [ebp - 0x1070]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d6332
mov eax, dword [ebp - 0x1070]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d6342
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1070]
mov dword [ebp - 0x1c], edx
jmp 0x4d634e
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1070]
mov dword [ebp - 0x1c], eax
jmp 0x4d62f4
mov dword [ebp - 4], 3
mov dword [ebp - 0x1074], 0xffffffff
mov dword [ebp - 0x1078], 0
jmp 0x4d637c
mov ecx, dword [ebp - 0x1078]
add ecx, 1
mov dword [ebp - 0x1078], ecx
cmp dword [ebp - 0x1078], 1
jge 0x4d63ae
mov eax, dword [ebp - 0x1078]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d63a3
mov edx, dword [ebp - 0x1074]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d636d
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d63ce
mov dword [ebp - 0x107c], 0
jmp 0x4d63e9
mov edx, dword [ebp - 0x107c]
add edx, 1
mov dword [ebp - 0x107c], edx
cmp dword [ebp - 0x107c], 0
jge 0x4d6400
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x107c]
mov dword [ebp - 0x1c], eax
jmp 0x4d63da
cmp dword [ebp - 0x1c], 0
jge 0x4d640e
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d6426
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1080], 0
jmp 0x4d6441
mov edx, dword [ebp - 0x1080]
add edx, 1
mov dword [ebp - 0x1080], edx
cmp dword [ebp - 0x1080], 0
jge 0x4d648e
mov eax, dword [ebp - 0x1080]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d6470
mov eax, dword [ebp - 0x1080]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d6480
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1080]
mov dword [ebp - 0x1c], edx
jmp 0x4d648c
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1080]
mov dword [ebp - 0x1c], eax
jmp 0x4d6432
mov dword [ebp - 0x1084], 0
jmp 0x4d64a9
mov ecx, dword [ebp - 0x1084]
add ecx, 1
mov dword [ebp - 0x1084], ecx
cmp dword [ebp - 0x1084], 5
jge 0x4d64ea
cmp dword [ebp - 0x1c], 0
jge 0x4d64c0
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d64d6
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1280]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d649a
mov dword [ebp - 0x1284], 0
jmp 0x4d6505
mov eax, dword [ebp - 0x1284]
add eax, 1
mov dword [ebp - 0x1284], eax
cmp dword [ebp - 0x1284], 6
jge 0x4d651c
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1284]
mov dword [ebp - 0x1c], ecx
jmp 0x4d64f6
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4d652e
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d6546
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x1288], 0xffffffff
mov dword [ebp - 0x128c], 0
jmp 0x4d6572
mov edx, dword [ebp - 0x128c]
add edx, 1
mov dword [ebp - 0x128c], edx
cmp dword [ebp - 0x128c], 7
jge 0x4d65a4
mov eax, dword [ebp - 0x128c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d6599
mov edx, dword [ebp - 0x1288]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d6563
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d65c4
mov dword [ebp - 0x1290], 0
jmp 0x4d65df
mov edx, dword [ebp - 0x1290]
add edx, 1
mov dword [ebp - 0x1290], edx
cmp dword [ebp - 0x1290], 7
jge 0x4d6620
cmp dword [ebp - 0x1c], 0
jge 0x4d65f6
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d660c
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1488]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d65d0
mov dword [ebp - 0x148c], 0
jmp 0x4d663b
mov eax, dword [ebp - 0x148c]
add eax, 1
mov dword [ebp - 0x148c], eax
cmp dword [ebp - 0x148c], 7
jge 0x4d6652
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x148c]
mov dword [ebp - 0x1c], ecx
jmp 0x4d662c
cmp dword [ebp - 0x1c], 0
jge 0x4d6660
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d6678
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x1490], 0xffffffff
mov dword [ebp - 0x1494], 0
jmp 0x4d66a4
mov edx, dword [ebp - 0x1494]
add edx, 1
mov dword [ebp - 0x1494], edx
cmp dword [ebp - 0x1494], 2
jge 0x4d66d6
mov eax, dword [ebp - 0x1494]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d66cb
mov edx, dword [ebp - 0x1490]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d6695
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d66f6
mov dword [ebp - 0x1498], 0
jmp 0x4d6711
mov edx, dword [ebp - 0x1498]
add edx, 1
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 2
jge 0x4d6728
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x1498]
mov dword [ebp - 0x1c], eax
jmp 0x4d6702
cmp dword [ebp - 0x1c], 0
jge 0x4d6736
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d674e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x149c], 0xffffffff
mov dword [ebp - 0x14a0], 0
jmp 0x4d677a
mov edx, dword [ebp - 0x14a0]
add edx, 1
mov dword [ebp - 0x14a0], edx
cmp dword [ebp - 0x14a0], 4
jge 0x4d67ac
mov eax, dword [ebp - 0x14a0]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d67a1
mov edx, dword [ebp - 0x149c]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d676b
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d67cc
mov dword [ebp - 0x14a4], 0
jmp 0x4d67e7
mov edx, dword [ebp - 0x14a4]
add edx, 1
mov dword [ebp - 0x14a4], edx
cmp dword [ebp - 0x14a4], 3
jge 0x4d6828
cmp dword [ebp - 0x1c], 0
jge 0x4d67fe
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d6814
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x16a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d67d8
mov dword [ebp - 4], 7
mov dword [ebp - 0x16a4], 0xffffffff
mov dword [ebp - 0x16a8], 0
jmp 0x4d6854
mov eax, dword [ebp - 0x16a8]
add eax, 1
mov dword [ebp - 0x16a8], eax
cmp dword [ebp - 0x16a8], 6
jge 0x4d6886
mov eax, dword [ebp - 0x16a8]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d687b
mov edx, dword [ebp - 0x16a4]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d6845
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d68a6
mov edx, 1
test edx, edx
je 0x4d68e0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x16ac], eax
mov eax, dword [ebp - 0x16ac]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d68d2
jmp 0x4d68e0
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x16ac]
mov dword [ebp - 0x1c], edx
jmp 0x4d68a6
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x16b0], 0
jmp 0x4d6904
mov ecx, dword [ebp - 0x16b0]
add ecx, 1
mov dword [ebp - 0x16b0], ecx
cmp dword [ebp - 0x16b0], 8
jge 0x4d6951
cmp dword [ebp - 0x1c], 0
jge 0x4d691b
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d6931
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x16b4], 0xfa
lea edx, [ebp - 0x16b4]
push edx
lea eax, [ebp - 0x18b0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d68f5
mov dword [ebp - 0x18b4], 0
jmp 0x4d696c
mov ecx, dword [ebp - 0x18b4]
add ecx, 1
mov dword [ebp - 0x18b4], ecx
cmp dword [ebp - 0x18b4], 4
jge 0x4d69b9
mov eax, dword [ebp - 0x18b4]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d699b
mov eax, dword [ebp - 0x18b4]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d69ab
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x18b4]
mov dword [ebp - 0x1c], edx
jmp 0x4d69b7
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x18b4]
mov dword [ebp - 0x1c], eax
jmp 0x4d695d
mov dword [ebp - 0x18b8], 0
jmp 0x4d69d4
mov ecx, dword [ebp - 0x18b8]
add ecx, 1
mov dword [ebp - 0x18b8], ecx
cmp dword [ebp - 0x18b8], 7
jge 0x4d6a15
cmp dword [ebp - 0x1c], 0
jge 0x4d69eb
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d6a01
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1ab0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d69c5
mov dword [ebp - 0x1ab4], 0
jmp 0x4d6a30
mov eax, dword [ebp - 0x1ab4]
add eax, 1
mov dword [ebp - 0x1ab4], eax
cmp dword [ebp - 0x1ab4], 7
jge 0x4d6a71
cmp dword [ebp - 0x1c], 0
jge 0x4d6a47
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d6a5d
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x1cb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d6a21
mov dword [ebp - 4], 8
mov dword [ebp - 0x1cb4], 0xffffffff
mov dword [ebp - 0x1cb8], 0
jmp 0x4d6a9d
mov eax, dword [ebp - 0x1cb8]
add eax, 1
mov dword [ebp - 0x1cb8], eax
cmp dword [ebp - 0x1cb8], 4
jge 0x4d6acf
mov eax, dword [ebp - 0x1cb8]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d6ac4
mov edx, dword [ebp - 0x1cb4]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d6a8e
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d6aef
mov dword [ebp - 0x1cbc], 0
jmp 0x4d6b0a
mov edx, dword [ebp - 0x1cbc]
add edx, 1
mov dword [ebp - 0x1cbc], edx
cmp dword [ebp - 0x1cbc], 1
jge 0x4d6b57
cmp dword [ebp - 0x1c], 0
jge 0x4d6b21
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d6b37
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1cc0], 0xfa
lea edx, [ebp - 0x1cc0]
push edx
lea eax, [ebp - 0x1eb8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d6afb
mov dword [ebp - 0x1ebc], 0
jmp 0x4d6b72
mov ecx, dword [ebp - 0x1ebc]
add ecx, 1
mov dword [ebp - 0x1ebc], ecx
cmp dword [ebp - 0x1ebc], 2
jge 0x4d6bb3
cmp dword [ebp - 0x1c], 0
jge 0x4d6b89
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d6b9f
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x20b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d6b63
mov dword [ebp - 0x20bc], 0
jmp 0x4d6bce
mov eax, dword [ebp - 0x20bc]
add eax, 1
mov dword [ebp - 0x20bc], eax
cmp dword [ebp - 0x20bc], 2
jge 0x4d6c1b
cmp dword [ebp - 0x1c], 0
jge 0x4d6be5
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d6bfb
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20c0], 0xfa
lea edx, [ebp - 0x20c0]
push edx
lea eax, [ebp - 0x22b8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d6bbf
mov dword [ebp - 0x22bc], 0
jmp 0x4d6c36
mov ecx, dword [ebp - 0x22bc]
add ecx, 1
mov dword [ebp - 0x22bc], ecx
cmp dword [ebp - 0x22bc], 1
jge 0x4d6c83
cmp dword [ebp - 0x1c], 0
jge 0x4d6c4d
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d6c63
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x22c0], 0xfa
lea edx, [ebp - 0x22c0]
push edx
lea eax, [ebp - 0x24b8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d6c27
mov dword [ebp - 0x24bc], 0
jmp 0x4d6c9e
mov ecx, dword [ebp - 0x24bc]
add ecx, 1
mov dword [ebp - 0x24bc], ecx
cmp dword [ebp - 0x24bc], 2
jge 0x4d6cdf
cmp dword [ebp - 0x1c], 0
jge 0x4d6cb5
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d6ccb
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x26b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d6c8f
mov dword [ebp - 0x26bc], 0
jmp 0x4d6cfa
mov eax, dword [ebp - 0x26bc]
add eax, 1
mov dword [ebp - 0x26bc], eax
cmp dword [ebp - 0x26bc], 3
jge 0x4d6d47
cmp dword [ebp - 0x1c], 0
jge 0x4d6d11
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d6d27
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x26c0], 0xfa
lea edx, [ebp - 0x26c0]
push edx
lea eax, [ebp - 0x28b8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d6ceb
mov dword [ebp - 0x28bc], 0
jmp 0x4d6d62
mov ecx, dword [ebp - 0x28bc]
add ecx, 1
mov dword [ebp - 0x28bc], ecx
cmp dword [ebp - 0x28bc], 0
jge 0x4d6daf
mov eax, dword [ebp - 0x28bc]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4d6d91
mov eax, dword [ebp - 0x28bc]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4d6da1
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x28bc]
mov dword [ebp - 0x1c], edx
jmp 0x4d6dad
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x28bc]
mov dword [ebp - 0x1c], eax
jmp 0x4d6d53
mov dword [ebp - 0x28c0], 0
jmp 0x4d6dca
cmp dword [ebp - 0x28c0], 3
jge 0x4d6e17
cmp dword [ebp - 0x1c], 0
jge 0x4d6de1
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d6df7
mov dword [ebp - 0x2ac4], 0
jmp 0x4d6e32
cmp dword [ebp - 0x2ac4], 0
jge 0x4d6e49