Function at 0x46dc78
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
sub esp, 0x49c
push ebx
push ebp
mov ebp, dword [esp + 0x4ac]
push esi
mov esi, dword [esp + 0x4ac]
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x7a]
push ecx
mov word [esp + 0x7c], ax
call fcn.00414380
add esp, 0xc
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x2a2]
push eax
mov word [esp + 0x2a4], dx
call fcn.00414380
lea ecx, [esp + 0x54]
add esp, 0xc
push ecx
xor ebx, ebx
call fcn.00416b62
lea edx, [esp + 0x4c]
add esp, 4
push edx
call fcn.0041750a
mov edi, eax
mov eax, dword [esp + 0x4bc]
add esp, 4
mov dword [esp + 0x20], eax
jmp 0x46dcf8
mov ecx, dword [esp + 0x20]
mov edx, dword [ebx*4 + 0x48c930]
push ecx
push edx
call fcn.0041458e
add esp, 8
test eax, eax
je 0x46dd17
inc ebx
cmp ebx, 0x5f
jl 0x46dcf8
cmp ebx, 0x5f
jne 0x46dd95
mov edi, 0x4863c0
lea esi, [esp + 0x28]
call fcn.0040d210
lea eax, [esp + 0x4b8]
push eax
push esi
mov dword [esp + 0x28], 0
call fcn.004543dd
lea edx, [esp + 0x14]
push edx
xor ecx, ecx
lea edi, [esp + 0x24]
mov ebx, esi
call fcn.0040eaa0
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x46dd7f
mov ecx, esi
call fcn.0040c680
lea ecx, [esp + 0x4b8]
call fcn.0040c680
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret 0x18
push eax
mov ebx, ebp
call fcn.004084d0
lea ecx, [esp + 0x28]
call fcn.0040c680
jmp case.default.0x46dd9e
cmp ebx, 0x5e
ja case.default.0x46dd9e
jmp dword [ebx*4 + 0x46e8bc]
mov edi, 0x48641c
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, 0x47fdfc
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, 0x48200c
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, 0x486420
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea eax, [esi + 0x14c]
call fcn.0040bf40
mov edi, dword [eax + 0x14]
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
lea eax, [esi + 0x14c]
call fcn.0040bf40
mov edi, dword [eax + 0x1c]
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx ecx, word [esp + 0x36]
push ecx
push 0x486424
lea edx, [esp + 0x78]
push edx
call fcn.004146e4
add esp, 0xc
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov eax, dword [edi]
push eax
push 0x486424
lea ecx, [esp + 0x78]
push ecx
jmp 0x46de3e
mov edx, dword [edi + 4]
push edx
push 0x486424
lea eax, [esp + 0x78]
push eax
jmp 0x46de3e
mov ecx, dword [edi + 8]
jmp 0x46de33
mov eax, dword [edi + 0xc]
push eax
push 0x486424
lea ecx, [esp + 0x78]
push ecx
jmp 0x46de3e
mov edx, dword [edi + 0x10]
inc edx
push edx
push 0x486424
lea eax, [esp + 0x78]
push eax
jmp 0x46de3e
mov edi, dword [edi + 0x14]
mov esi, ebp
add edi, 0x76c
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
mov edi, dword [edi + 0x18]
mov esi, ebp
inc edi
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
mov ecx, dword [edi + 0x1c]
inc ecx
push ecx
push 0x486430
jmp 0x46de39
push 0x104
push 0x48643c
push 0x486460
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411cb0
add esp, 0x10
mov edi, esi
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
push 0x4864b4
jmp 0x46dedf
push 0x104
push 0x4864d4
push 0x4864e8
push reloc.WSOCK32.dll_accept
lea esi, [esp + 0x80]
call fcn.00411cb0
add esp, 0x10
call fcn.004100e0
mov edi, esi
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
push 0x48656c
push 0x4864e8
jmp 0x46dee4
push 0x104
push 0x48658c
push 0x4864e8
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411cb0
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46de46
push 0x104
push 0x4865ac
push 0x4864e8
push reloc.WSOCK32.dll_accept
jmp 0x46dee9
push 0x104
push 0x4865bc
push 0x4864e8
jmp 0x46dee4
push 0x104
push 0x4865e0
push 0x4864e8
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411cb0
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46de46
push 0x104
push 0x486604
push 0x4864e8
push reloc.WSOCK32.dll_accept
jmp 0x46dee9
push 0x104
push 0x486618
push 0x4864e8
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411cb0
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46de46
push 0x104
push 0x486638
push 0x4864e8
push reloc.WSOCK32.dll_accept
jmp 0x46dee9
push 0x104
push 0x48664c
push 0x4864e8
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411cb0
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46de46
push 0x104
push 0x486670
push 0x4864e8
push reloc.WSOCK32.dll_accept
jmp 0x46dee9
push 0x104
push 0x486688
push 0x4864e8
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411cb0
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46de46
push 0x104
push 0x4866a8
push 0x4864e8
push reloc.WSOCK32.dll_accept
jmp 0x46dee9
push 0x104
push 0x4866b8
push 0x4864e8
push reloc.WSOCK32.dll_accept
jmp 0x46dee9
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
lea edx, [esp + 0x74]
push edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
cmp byte [0x49f412], 0
push 0x104
je 0x46e179
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00435ccd
call eax
lea edx, [esp + 0x14]
push edx
call fcn.00435cec
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 6
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 3
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 9
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 5
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 0xa
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 2
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 7
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 8
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 4
jmp 0x46e898
mov ebx, 1
cmp byte [0x48e8ce], bl
mov esi, ebp
jne 0x46e25e
call fcn.0040bfb0
mov dword [ebp + 8], ebx
mov dword [ebp], ebx
jmp case.default.0x46dd9e
call fcn.0040bfb0
mov dword [ebp + 8], ebx
mov dword [ebp], 0
jmp case.default.0x46dd9e
mov ebx, 1
cmp byte [0x49fa61], bl
jmp 0x46e24a
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 0x40
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 0x41
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 0x42
jmp 0x46e898
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 0x43
jmp 0x46e898
mov edi, dword [esi + 0x68]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, dword [esi + 0x58]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, dword [esi + 0x78]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov ecx, dword [esi + 0x94]
push ecx
call fcn.0043989a
mov esi, ebp
mov edi, eax
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
lea edx, [esp + 0x70]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
movzx eax, word [0x49f414]
test eax, eax
je 0x46e382
cmp eax, 6
je 0x46e35f
mov ebx, ebp
cmp eax, 9
jne 0x46e423
mov edi, 0x4866dc
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, 0x4866d0
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
call fcn.00412000
mov edi, 0x4866dc
test al, al
jne 0x46de4a
mov edi, 0x4866c8
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, 0x4866e4
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov al, 1
cmp byte [0x49f40a], al
jne 0x46e3bf
mov edi, 0x4866f8
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
cmp byte [0x49f410], al
jne 0x46e3d8
mov edi, 0x48670c
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
cmp byte [0x49f40e], al
jne 0x46e3f1
mov edi, 0x486720
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
cmp byte [0x49f408], al
jne 0x46e40a
mov edi, 0x486734
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov ebx, ebp
cmp byte [0x49f40c], al
jne 0x46e423
mov edi, 0x486744
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, 0x484dfc
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, dword [0x49f3f4]
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
mov edi, 0x49f3f8
mov esi, ebp
call fcn.0040f7c0
jmp case.default.0x46dd9e
push 0x104
push 0x486758
push 0x486778
jmp 0x46dee4
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea edi, [esp + 0x284]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea ecx, [esp + 0x298]
push 0x4867d4
push ecx
call fcn.00412576
lea edx, [esp + 0x2a0]
push edx
xor esi, esi
xor edi, edi
call fcn.004143fa
add esp, 0xc
test eax, eax
jle 0x46e4ef
nop
movzx eax, word [esp + edi*2 + 0x298]
cmp ax, 0x20
je 0x46e4da
cmp ax, 0x2c
jne 0x46e4d1
mov eax, 0x2e
mov word [esp + esi*2 + 0x298], ax
inc esi
lea ecx, [esp + 0x298]
push ecx
inc edi
call fcn.004143fa
add esp, 4
cmp edi, eax
jl 0x46e4b8
xor edx, edx
lea edi, [esp + 0x298]
mov ebx, ebp
mov word [esp + esi*2 + 0x298], dx
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
lea eax, [esp + 0x74]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea ecx, [esp + 0x50]
push ecx
push 1
call fcn.00437eeb
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea edx, [esp + 0x50]
push edx
push 2
call fcn.00437eeb
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea eax, [esp + 0x50]
push eax
push 3
call fcn.00437eeb
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea ecx, [esp + 0x50]
push ecx
push 4
call fcn.00437eeb
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x40]
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x44]
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push 0xc
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x14], eax
call fcn.0040bfb0
mov ecx, dword [esp + 0x14]
push ebx
push edi
mov dword [ebp + 8], 1
mov dword [ebp], ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x46dd9e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push 0x74
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x14], eax
call fcn.0040bfb0
mov edx, dword [esp + 0x14]
push ebx
push edi
mov dword [ebp + 8], 1
mov dword [ebp], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x46dd9e
push 0x104
lea eax, [esp + 0x74]
push eax
push 0x485c98
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea ecx, [esp + 0x70]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea esi, [esp + 0x70]
call fcn.004100e0
mov edi, esi
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov eax, dword [0x49f43c]
cmp eax, 2
je case.0x46dd9e.43
cmp eax, 3
jne case.0x46dd9e.30
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 1
jmp 0x46e898
push 0x104
lea ecx, [esp + 0x74]
push ecx
push 0x4867f0
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
lea edx, [esp + 0x74]
push edx
push 0x485c38
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
lea eax, [esp + 0x74]
push eax
push 0x485c24
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
lea ecx, [esp + 0x74]
push ecx
push 0x485c10
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
lea edx, [esp + 0x74]
push edx
push 0x485bf8
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
lea eax, [esp + 0x74]
push eax
push 0x486808
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
push 0x104
lea ecx, [esp + 0x74]
push ecx
push 0x486820
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
mov edi, dword [esi + 0x13c]
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
movzx edi, byte [esi + 0x138]
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
mov edi, dword [esi + 0x16c]
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], edi
jmp 0x46e898
mov edi, dword [esi + 0x170]
mov ebx, ebp
call fcn.0040f700
jmp case.default.0x46dd9e
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
test eax, eax
jge 0x46e86f
fadd qword [0x487210]
mov esi, ebp
fstp qword [esp + 0x14]
call fcn.0040bfb0
fld qword [esp + 0x14]
fstp qword [ebp]
mov dword [ebp + 8], 3
jmp case.default.0x46dd9e
mov esi, ebp
call fcn.0040bfb0
mov dword [ebp], 0
mov dword [ebp + 8], 1
lea ecx, [esp + 0x4b8]
call fcn.0040c680
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x49c
ret 0x18