Function at 0x4cf080
Capabilities:
Check os version
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x513aa8
push 0x40b390
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x18c0
call fcn.004149d0
mov eax, dword [0x517138]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x34], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov eax, 1
test eax, eax
je 0x4cf0f8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cf0ed
jmp 0x4cf0f8
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
jmp 0x4cf0c7
mov eax, dword [ebp - 0x1c]
add eax, 0x39
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0
jmp 0x4cf113
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x1e
jge 0x4cf151
mov eax, dword [ebp - 0x24]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cf139
mov eax, dword [ebp - 0x24]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cf146
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
jmp 0x4cf14f
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
jmp 0x4cf10a
mov dword [ebp - 0x28], 0
jmp 0x4cf163
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0x16
jge 0x4cf174
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
jmp 0x4cf15a
cmp dword [ebp - 0x1c], 0
jge 0x4cf182
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cf19a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0
jmp 0x4cf1ac
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xe
jge 0x4cf1f0
cmp dword [ebp - 0x1c], 0
jge 0x4cf1c0
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cf1d6
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], 0xfa
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4cf1a3
mov dword [ebp - 0x234], 0
jmp 0x4cf20b
mov ecx, dword [ebp - 0x234]
add ecx, 1
mov dword [ebp - 0x234], ecx
cmp dword [ebp - 0x234], 8
jge 0x4cf258
cmp dword [ebp - 0x1c], 0
jge 0x4cf222
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cf238
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x238], 0xfa
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4cf1fc
mov dword [ebp - 0x434], 0
jmp 0x4cf273
mov ecx, dword [ebp - 0x434]
add ecx, 1
mov dword [ebp - 0x434], ecx
cmp dword [ebp - 0x434], 0xe
jge 0x4cf2c0
mov eax, dword [ebp - 0x434]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cf2a2
mov eax, dword [ebp - 0x434]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cf2b2
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x434]
mov dword [ebp - 0x1c], edx
jmp 0x4cf2be
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x434]
mov dword [ebp - 0x1c], eax
jmp 0x4cf264
mov dword [ebp - 0x438], 0
jmp 0x4cf2db
mov ecx, dword [ebp - 0x438]
add ecx, 1
mov dword [ebp - 0x438], ecx
cmp dword [ebp - 0x438], 7
jge 0x4cf328
cmp dword [ebp - 0x1c], 0
jge 0x4cf2f2
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cf308
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x43c], 0xfa
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4cf2cc
mov dword [ebp - 0x63c], 0
jmp 0x4cf343
mov ecx, dword [ebp - 0x63c]
add ecx, 1
mov dword [ebp - 0x63c], ecx
cmp dword [ebp - 0x63c], 6
jge 0x4cf390
cmp dword [ebp - 0x1c], 0
jge 0x4cf35a
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cf370
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x640], 0xfa
lea edx, [ebp - 0x640]
push edx
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4cf334
mov dword [ebp - 0x83c], 0
jmp 0x4cf3ab
mov ecx, dword [ebp - 0x83c]
add ecx, 1
mov dword [ebp - 0x83c], ecx
cmp dword [ebp - 0x83c], 0xa
jge 0x4cf3f8
mov eax, dword [ebp - 0x83c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cf3da
mov eax, dword [ebp - 0x83c]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cf3ea
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x83c]
mov dword [ebp - 0x1c], edx
jmp 0x4cf3f6
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x83c]
mov dword [ebp - 0x1c], eax
jmp 0x4cf39c
mov ecx, 1
test ecx, ecx
je 0x4cf432
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0x840]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cf424
jmp 0x4cf432
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x840]
mov dword [ebp - 0x1c], edx
jmp 0x4cf3f8
mov eax, dword [ebp - 0x1c]
add eax, 7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x844], 0
jmp 0x4cf456
mov ecx, dword [ebp - 0x844]
add ecx, 1
mov dword [ebp - 0x844], ecx
cmp dword [ebp - 0x844], 1
jge 0x4cf46d
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x844]
mov dword [ebp - 0x1c], edx
jmp 0x4cf447
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cf47f
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cf497
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x848], 0
jmp 0x4cf4b2
mov edx, dword [ebp - 0x848]
add edx, 1
mov dword [ebp - 0x848], edx
cmp dword [ebp - 0x848], 0xf
jge 0x4cf4ff
cmp dword [ebp - 0x1c], 0
jge 0x4cf4c9
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cf4df
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x84c], 0xfa
lea edx, [ebp - 0x84c]
push edx
lea eax, [ebp - 0xa48]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4cf4a3
mov dword [ebp - 0xa4c], 0
jmp 0x4cf51a
mov ecx, dword [ebp - 0xa4c]
add ecx, 1
mov dword [ebp - 0xa4c], ecx
cmp dword [ebp - 0xa4c], 4
jge 0x4cf55b
cmp dword [ebp - 0x1c], 0
jge 0x4cf531
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cf547
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xc48]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4cf50b
mov eax, 1
test eax, eax
je 0x4cf595
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0xc4c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cf587
jmp 0x4cf595
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xc4c]
mov dword [ebp - 0x1c], edx
jmp 0x4cf55b
mov eax, dword [ebp - 0x1c]
add eax, 0xa
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc50], 0
jmp 0x4cf5b9
mov ecx, dword [ebp - 0xc50]
add ecx, 1
mov dword [ebp - 0xc50], ecx
cmp dword [ebp - 0xc50], 0xa
jge 0x4cf606
mov eax, dword [ebp - 0xc50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cf5e8
mov eax, dword [ebp - 0xc50]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cf5f8
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc50]
mov dword [ebp - 0x1c], edx
jmp 0x4cf604
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc50]
mov dword [ebp - 0x1c], eax
jmp 0x4cf5aa
mov ecx, 1
test ecx, ecx
je 0x4cf640
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 0xc54]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cf632
jmp 0x4cf640
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0xc54]
mov dword [ebp - 0x1c], edx
jmp 0x4cf606
mov eax, dword [ebp - 0x1c]
add eax, 0xb
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc58], 0
jmp 0x4cf664
mov ecx, dword [ebp - 0xc58]
add ecx, 1
mov dword [ebp - 0xc58], ecx
cmp dword [ebp - 0xc58], 0
jge 0x4cf67b
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0xc58]
mov dword [ebp - 0x1c], edx
jmp 0x4cf655
cmp dword [ebp - 0x1c], 0
jge 0x4cf689
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cf6a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc5c], 0
jmp 0x4cf6bc
mov edx, dword [ebp - 0xc5c]
add edx, 1
mov dword [ebp - 0xc5c], edx
cmp dword [ebp - 0xc5c], 2
jge 0x4cf6fd
cmp dword [ebp - 0x1c], 0
jge 0x4cf6d3
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cf6e9
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0xe58]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4cf6ad
mov dword [ebp - 0xe5c], 0
jmp 0x4cf718
mov eax, dword [ebp - 0xe5c]
add eax, 1
mov dword [ebp - 0xe5c], eax
cmp dword [ebp - 0xe5c], 0x10
jge 0x4cf72f
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0xe5c]
mov dword [ebp - 0x1c], ecx
jmp 0x4cf709
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cf741
mov edx, dword [ebp - 0x1c]
imul edx, edx, 0xfffffffb
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cf759
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe60], 0
jmp 0x4cf774
mov edx, dword [ebp - 0xe60]
add edx, 1
mov dword [ebp - 0xe60], edx
cmp dword [ebp - 0xe60], 0xf
jge 0x4cf78b
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xe60]
mov dword [ebp - 0x1c], eax
jmp 0x4cf765
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cf79d
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cf7b5
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xe64], 0
jmp 0x4cf7d0
mov edx, dword [ebp - 0xe64]
add edx, 1
mov dword [ebp - 0xe64], edx
cmp dword [ebp - 0xe64], 6
jge 0x4cf81d
cmp dword [ebp - 0x1c], 0
jge 0x4cf7e7
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cf7fd
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xe68], 0xfa
lea edx, [ebp - 0xe68]
push edx
lea eax, [ebp - 0x1060]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4cf7c1
mov ecx, 1
test ecx, ecx
je 0x4cf857
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0x1064]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cf849
jmp 0x4cf857
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1064]
mov dword [ebp - 0x1c], edx
jmp 0x4cf81d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1068], 0xffffffff
mov dword [ebp - 0x106c], 0
jmp 0x4cf889
mov ecx, dword [ebp - 0x106c]
add ecx, 1
mov dword [ebp - 0x106c], ecx
cmp dword [ebp - 0x106c], 0
jge 0x4cf8bb
mov eax, dword [ebp - 0x106c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4cf8b0
mov edx, dword [ebp - 0x1068]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4cf87a
mov dword [ebp - 4], 0xfffffffe
jmp 0x4cf8db
mov dword [ebp - 0x1070], 0
jmp 0x4cf8f6
mov edx, dword [ebp - 0x1070]
add edx, 1
mov dword [ebp - 0x1070], edx
cmp dword [ebp - 0x1070], 6
jge 0x4cf943
mov eax, dword [ebp - 0x1070]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cf925
mov eax, dword [ebp - 0x1070]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cf935
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1070]
mov dword [ebp - 0x1c], edx
jmp 0x4cf941
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1070]
mov dword [ebp - 0x1c], eax
jmp 0x4cf8e7
mov dword [ebp - 0x1074], 0
jmp 0x4cf95e
mov ecx, dword [ebp - 0x1074]
add ecx, 1
mov dword [ebp - 0x1074], ecx
cmp dword [ebp - 0x1074], 0
jge 0x4cf975
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1074]
mov dword [ebp - 0x1c], edx
jmp 0x4cf94f
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cf987
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cf99f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x1078], 0xffffffff
mov dword [ebp - 0x107c], 0
jmp 0x4cf9cb
mov edx, dword [ebp - 0x107c]
add edx, 1
mov dword [ebp - 0x107c], edx
cmp dword [ebp - 0x107c], 2
jge 0x4cf9fd
mov eax, dword [ebp - 0x107c]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4cf9f2
mov edx, dword [ebp - 0x1078]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4cf9bc
mov dword [ebp - 4], 0xfffffffe
jmp 0x4cfa1d
mov dword [ebp - 0x1080], 0
jmp 0x4cfa38
mov edx, dword [ebp - 0x1080]
add edx, 1
mov dword [ebp - 0x1080], edx
cmp dword [ebp - 0x1080], 8
jge 0x4cfa85
mov eax, dword [ebp - 0x1080]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cfa67
mov eax, dword [ebp - 0x1080]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cfa77
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1080]
mov dword [ebp - 0x1c], edx
jmp 0x4cfa83
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1080]
mov dword [ebp - 0x1c], eax
jmp 0x4cfa29
mov dword [ebp - 0x1084], 0
jmp 0x4cfaa0
mov ecx, dword [ebp - 0x1084]
add ecx, 1
mov dword [ebp - 0x1084], ecx
cmp dword [ebp - 0x1084], 0
jge 0x4cfaed
mov eax, dword [ebp - 0x1084]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cfacf
mov eax, dword [ebp - 0x1084]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cfadf
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1084]
mov dword [ebp - 0x1c], edx
jmp 0x4cfaeb
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1084]
mov dword [ebp - 0x1c], eax
jmp 0x4cfa91
mov dword [ebp - 0x1088], 0
jmp 0x4cfb08
mov ecx, dword [ebp - 0x1088]
add ecx, 1
mov dword [ebp - 0x1088], ecx
cmp dword [ebp - 0x1088], 0
jge 0x4cfb1f
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1088]
mov dword [ebp - 0x1c], edx
jmp 0x4cfaf9
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cfb31
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cfb49
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x108c], 0
jmp 0x4cfb64
mov edx, dword [ebp - 0x108c]
add edx, 1
mov dword [ebp - 0x108c], edx
cmp dword [ebp - 0x108c], 2
jge 0x4cfb7b
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x108c]
mov dword [ebp - 0x1c], eax
jmp 0x4cfb55
cmp dword [ebp - 0x1c], 0
jge 0x4cfb89
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cfba1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x1090], 0xffffffff
mov dword [ebp - 0x1094], 0
jmp 0x4cfbcd
mov edx, dword [ebp - 0x1094]
add edx, 1
mov dword [ebp - 0x1094], edx
cmp dword [ebp - 0x1094], 4
jge 0x4cfbff
mov eax, dword [ebp - 0x1094]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4cfbf4
mov edx, dword [ebp - 0x1090]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4cfbbe
mov dword [ebp - 4], 0xfffffffe
jmp 0x4cfc1f
mov dword [ebp - 0x1098], 0
jmp 0x4cfc3a
mov edx, dword [ebp - 0x1098]
add edx, 1
mov dword [ebp - 0x1098], edx
cmp dword [ebp - 0x1098], 1
jge 0x4cfc87
mov eax, dword [ebp - 0x1098]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cfc69
mov eax, dword [ebp - 0x1098]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cfc79
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1098]
mov dword [ebp - 0x1c], edx
jmp 0x4cfc85
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x1098]
mov dword [ebp - 0x1c], eax
jmp 0x4cfc2b
mov ecx, 1
test ecx, ecx
je 0x4cfcc1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x109c]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cfcb3
jmp 0x4cfcc1
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x109c]
mov dword [ebp - 0x1c], edx
jmp 0x4cfc87
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10a0], 0
jmp 0x4cfce5
mov ecx, dword [ebp - 0x10a0]
add ecx, 1
mov dword [ebp - 0x10a0], ecx
cmp dword [ebp - 0x10a0], 5
jge 0x4cfcfc
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x10a0]
mov dword [ebp - 0x1c], edx
jmp 0x4cfcd6
cmp dword [ebp - 0x1c], 0
jge 0x4cfd0a
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4cfd22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, 1
test edx, edx
je 0x4cfd5c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10a4], eax
mov eax, dword [ebp - 0x10a4]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4cfd4e
jmp 0x4cfd5c
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x10a4]
mov dword [ebp - 0x1c], edx
jmp 0x4cfd22
mov eax, dword [ebp - 0x1c]
add eax, 6
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10a8], 0
jmp 0x4cfd80
mov ecx, dword [ebp - 0x10a8]
add ecx, 1
mov dword [ebp - 0x10a8], ecx
cmp dword [ebp - 0x10a8], 8
jge 0x4cfd97
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10a8]
mov dword [ebp - 0x1c], edx
jmp 0x4cfd71
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cfda9
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cfdc1
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 3
mov dword [ebp - 0x10ac], 0xffffffff
mov dword [ebp - 0x10b0], 0
jmp 0x4cfded
mov edx, dword [ebp - 0x10b0]
add edx, 1
mov dword [ebp - 0x10b0], edx
cmp dword [ebp - 0x10b0], 1
jge 0x4cfe1f
mov eax, dword [ebp - 0x10b0]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4cfe14
mov edx, dword [ebp - 0x10ac]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4cfdde
mov dword [ebp - 4], 0xfffffffe
jmp 0x4cfe3f
mov dword [ebp - 0x10b4], 0
jmp 0x4cfe5a
mov edx, dword [ebp - 0x10b4]
add edx, 1
mov dword [ebp - 0x10b4], edx
cmp dword [ebp - 0x10b4], 8
jge 0x4cfe9b
cmp dword [ebp - 0x1c], 0
jge 0x4cfe71
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cfe87
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x12b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4cfe4b
mov dword [ebp - 4], 4
mov dword [ebp - 0x12b4], 0xffffffff
mov dword [ebp - 0x12b8], 0
jmp 0x4cfec7
mov eax, dword [ebp - 0x12b8]
add eax, 1
mov dword [ebp - 0x12b8], eax
cmp dword [ebp - 0x12b8], 5
jge 0x4cfef9
mov eax, dword [ebp - 0x12b8]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4cfeee
mov edx, dword [ebp - 0x12b4]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4cfeb8
mov dword [ebp - 4], 0xfffffffe
jmp 0x4cff19
mov dword [ebp - 0x12bc], 0
jmp 0x4cff34
mov edx, dword [ebp - 0x12bc]
add edx, 1
mov dword [ebp - 0x12bc], edx
cmp dword [ebp - 0x12bc], 2
jge 0x4cff81
mov eax, dword [ebp - 0x12bc]
cdq
mov ecx, 5
idiv ecx
cmp edx, 1
je 0x4cff63
mov eax, dword [ebp - 0x12bc]
cdq
mov ecx, 5
idiv ecx
cmp edx, 4
jne 0x4cff73
nop
nop
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x12bc]
mov dword [ebp - 0x1c], edx
jmp 0x4cff7f
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x12bc]
mov dword [ebp - 0x1c], eax
jmp 0x4cff25
mov dword [ebp - 0x12c0], 0
jmp 0x4cff9c
mov ecx, dword [ebp - 0x12c0]
add ecx, 1
mov dword [ebp - 0x12c0], ecx
cmp dword [ebp - 0x12c0], 1
jge 0x4cffb3
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x12c0]
mov dword [ebp - 0x1c], edx
jmp 0x4cff8d
cmp dword [ebp - 0x1c], 0xffff0001
jge 0x4cffc5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4cffdd
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x12c4], 0xffffffff
mov dword [ebp - 0x12c8], 0
jmp 0x4d0009
mov edx, dword [ebp - 0x12c8]
add edx, 1
mov dword [ebp - 0x12c8], edx
cmp dword [ebp - 0x12c8], 2
jge 0x4d003b
mov eax, dword [ebp - 0x12c8]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d0030
mov edx, dword [ebp - 0x12c4]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4cfffa
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d005b
mov dword [ebp - 4], 6
mov dword [ebp - 0x12cc], 0xffffffff
mov dword [ebp - 0x12d0], 0
jmp 0x4d0087
mov edx, dword [ebp - 0x12d0]
add edx, 1
mov dword [ebp - 0x12d0], edx
cmp dword [ebp - 0x12d0], 1
jge 0x4d00b9
mov eax, dword [ebp - 0x12d0]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d00ae
mov edx, dword [ebp - 0x12cc]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d0078
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d00d9
mov dword [ebp - 4], 7
mov dword [ebp - 0x12d4], 0xffffffff
mov dword [ebp - 0x12d8], 0
jmp 0x4d0105
mov edx, dword [ebp - 0x12d8]
add edx, 1
mov dword [ebp - 0x12d8], edx
cmp dword [ebp - 0x12d8], 2
jge 0x4d0137
mov eax, dword [ebp - 0x12d8]
cdq
mov ecx, 0x25
idiv ecx
test edx, edx
jne 0x4d012c
mov edx, dword [ebp - 0x12d4]
movsx eax, byte [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x4d00f6
mov dword [ebp - 4], 0xfffffffe
jmp 0x4d0157
mov dword [ebp - 0x12dc], 0
jmp 0x4d0172
mov edx, dword [ebp - 0x12dc]
add edx, 1
mov dword [ebp - 0x12dc], edx
cmp dword [ebp - 0x12dc], 1
jge 0x4d01bf
cmp dword [ebp - 0x1c], 0
jge 0x4d0189
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
jne 0x4d019f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x12e0], 0xfa
lea edx, [ebp - 0x12e0]
push edx
lea eax, [ebp - 0x14d8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4d0163
mov ecx, 1
test ecx, ecx
je 0x4d01f9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14dc], eax
mov eax, dword [ebp - 0x14dc]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x4d01eb
jmp 0x4d01f9
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14dc]
mov dword [ebp - 0x1c], edx
jmp 0x4d01bf
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14e0], 0
jmp 0x4d021d
mov ecx, dword [ebp - 0x14e0]
add ecx, 1
mov dword [ebp - 0x14e0], ecx
cmp dword [ebp - 0x14e0], 4
jge 0x4d025e
cmp dword [ebp - 0x1c], 0
jge 0x4d0234
mov edx, dword [ebp - 0x1c]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d024a
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x16d8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d020e
mov dword [ebp - 0x16dc], 0
jmp 0x4d0279
mov eax, dword [ebp - 0x16dc]
add eax, 1
mov dword [ebp - 0x16dc], eax
cmp dword [ebp - 0x16dc], 4
jge 0x4d02ba
cmp dword [ebp - 0x1c], 0
jge 0x4d0290
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 7
idiv ecx
test edx, edx
je 0x4d02a6
mov dword [ebp - 0x1c], 0
push 0xfa
lea edx, [ebp - 0x18d8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4d026a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.004079a5
mov esp, ebp
pop ebp
ret