Function at 0x46dd6b
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
sub esp, 0x49c
push ebx
push ebp
mov ebp, dword [esp + 0x4ac]
push esi
mov esi, dword [esp + 0x4ac]
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x7a]
push ecx
mov word [esp + 0x7c], ax
call fcn.00414350
add esp, 0xc
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x2a2]
push eax
mov word [esp + 0x2a4], dx
call fcn.00414350
lea ecx, [esp + 0x54]
add esp, 0xc
push ecx
xor ebx, ebx
call fcn.00416b32
lea edx, [esp + 0x4c]
add esp, 4
push edx
call fcn.004174da
mov edi, eax
mov eax, dword [esp + 0x4bc]
add esp, 4
mov dword [esp + 0x20], eax
jmp 0x46ddeb
mov ecx, dword [esp + 0x20]
mov edx, dword [ebx*4 + 0x48c930]
push ecx
push edx
call fcn.0041455e
add esp, 8
test eax, eax
je 0x46de0a
inc ebx
cmp ebx, 0x5f
jl 0x46ddeb
cmp ebx, 0x5f
jne 0x46de88
mov edi, 0x4863c8
lea esi, [esp + 0x28]
call fcn.0040ccd0
lea eax, [esp + 0x4b8]
push eax
push esi
mov dword [esp + 0x28], 0
call fcn.00454426
lea edx, [esp + 0x14]
push edx
xor ecx, ecx
lea edi, [esp + 0x24]
mov ebx, esi
call fcn.0040e810
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x46de72
mov ecx, esi
call fcn.0040c430
lea ecx, [esp + 0x4b8]
call fcn.0040c430
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret 0x18
push eax
mov ebx, ebp
call fcn.004082a0
lea ecx, [esp + 0x28]
call fcn.0040c430
jmp case.default.0x46de91
cmp ebx, 0x5e
ja case.default.0x46de91
jmp dword [ebx*4 + 0x46e9af]
mov edi, 0x486424
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, 0x47fdfc
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, 0x48200c
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, 0x486428
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea eax, [esi + 0x14c]
call fcn.0040bd10
mov edi, dword [eax + 0x14]
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
lea eax, [esi + 0x14c]
call fcn.0040bd10
mov edi, dword [eax + 0x1c]
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx ecx, word [esp + 0x36]
push ecx
push 0x48642c
lea edx, [esp + 0x78]
push edx
call fcn.004146b4
add esp, 0xc
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov eax, dword [edi]
push eax
push 0x48642c
lea ecx, [esp + 0x78]
push ecx
jmp 0x46df31
mov edx, dword [edi + 4]
push edx
push 0x48642c
lea eax, [esp + 0x78]
push eax
jmp 0x46df31
mov ecx, dword [edi + 8]
jmp 0x46df26
mov eax, dword [edi + 0xc]
push eax
push 0x48642c
lea ecx, [esp + 0x78]
push ecx
jmp 0x46df31
mov edx, dword [edi + 0x10]
inc edx
push edx
push 0x48642c
lea eax, [esp + 0x78]
push eax
jmp 0x46df31
mov edi, dword [edi + 0x14]
mov esi, ebp
add edi, 0x76c
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
mov edi, dword [edi + 0x18]
mov esi, ebp
inc edi
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
mov ecx, dword [edi + 0x1c]
inc ecx
push ecx
push str._.3d
jmp 0x46df2c
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411c80
add esp, 0x10
mov edi, esi
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
push str.CommonFilesDir
jmp 0x46dfd2
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [esp + 0x80]
call fcn.00411c80
add esp, 0x10
call fcn.004100b0
mov edi, esi
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
push str.Common_AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x46dfd7
push 0x104
push str.Common_Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411c80
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46df39
push 0x104
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x46dfdc
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x46dfd7
push 0x104
push str.Common_Favorites
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411c80
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46df39
push 0x104
push str.Favorites
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x46dfdc
push 0x104
push str.Common_Programs
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411c80
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46df39
push 0x104
push str.Programs
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x46dfdc
push 0x104
push str.Common_Start_Menu
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411c80
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46df39
push 0x104
push str.Start_Menu
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x46dfdc
push 0x104
push str.Common_Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x80]
call fcn.00411c80
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x46df39
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x46dfdc
push 0x104
push str.AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x46dfdc
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
lea edx, [esp + 0x74]
push edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
cmp byte [0x49f412], 0
push 0x104
je 0x46e26c
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00435c35
call eax
lea edx, [esp + 0x14]
push edx
call fcn.00435d6b
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 6
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 3
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 9
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 5
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 0xa
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 2
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 7
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 8
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 4
jmp 0x46e98b
mov ebx, 1
cmp byte [0x48e8ce], bl
mov esi, ebp
jne 0x46e351
call fcn.0040bd60
mov dword [ebp + 8], ebx
mov dword [ebp], ebx
jmp case.default.0x46de91
call fcn.0040bd60
mov dword [ebp + 8], ebx
mov dword [ebp], 0
jmp case.default.0x46de91
mov ebx, 1
cmp byte [0x49fa61], bl
jmp 0x46e33d
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], pe_nt_image_headers32
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 0x41
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 0x42
jmp 0x46e98b
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 0x43
jmp 0x46e98b
mov edi, dword [esi + 0x68]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, dword [esi + 0x58]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, dword [esi + 0x78]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov ecx, dword [esi + 0x94]
push ecx
call fcn.0043987d
mov esi, ebp
mov edi, eax
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
lea edx, [esp + 0x70]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
movzx eax, word [0x49f414]
test eax, eax
je 0x46e475
cmp eax, 6
je 0x46e452
mov ebx, ebp
cmp eax, 9
jne 0x46e516
mov edi, 0x4866e4
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, str.IA64
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
call fcn.00411fd0
mov edi, 0x4866e4
test al, al
jne 0x46df3d
mov edi, 0x4866d0
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, str.WIN32_NT
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov al, 1
cmp byte [0x49f40a], al
jne 0x46e4b2
mov edi, str.WIN_2008
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
cmp byte [0x49f410], al
jne 0x46e4cb
mov edi, str.WIN_VISTA
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
cmp byte [0x49f40e], al
jne 0x46e4e4
mov edi, str.WIN_2003
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
cmp byte [0x49f408], al
jne 0x46e4fd
mov edi, str.WIN_XP
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov ebx, ebp
cmp byte [0x49f40c], al
jne 0x46e516
mov edi, str.WIN_2000
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, str.UNKNOWN
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, dword [0x49f3f4]
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
mov edi, 0x49f3f8
mov esi, ebp
call fcn.0040f790
jmp case.default.0x46de91
push 0x104
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
jmp 0x46dfd7
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea edi, [esp + 0x284]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea ecx, [esp + 0x298]
push str.3__3__0__0
push ecx
call fcn.00412546
lea edx, [esp + 0x2a0]
push edx
xor esi, esi
xor edi, edi
call fcn.004143ca
add esp, 0xc
test eax, eax
jle 0x46e5e2
nop
movzx eax, word [esp + edi*2 + 0x298]
cmp ax, 0x20
je 0x46e5cd
cmp ax, 0x2c
jne 0x46e5c4
mov eax, 0x2e
mov word [esp + esi*2 + 0x298], ax
inc esi
lea ecx, [esp + 0x298]
push ecx
inc edi
call fcn.004143ca
add esp, 4
cmp edi, eax
jl 0x46e5ab
xor edx, edx
lea edi, [esp + 0x298]
mov ebx, ebp
mov word [esp + esi*2 + 0x298], dx
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
lea eax, [esp + 0x74]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea ecx, [esp + 0x50]
push ecx
push 1
call fcn.00437efa
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea edx, [esp + 0x50]
push edx
push 2
call fcn.00437efa
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea eax, [esp + 0x50]
push eax
push 3
call fcn.00437efa
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea ecx, [esp + 0x50]
push ecx
push 4
call fcn.00437efa
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x40]
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x44]
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push 0xc
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x14], eax
call fcn.0040bd60
mov ecx, dword [esp + 0x14]
push ebx
push edi
mov dword [ebp + 8], 1
mov dword [ebp], ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x46de91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push 0x74
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x14], eax
call fcn.0040bd60
mov edx, dword [esp + 0x14]
push ebx
push edi
mov dword [ebp + 8], 1
mov dword [ebp], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x46de91
push 0x104
lea eax, [esp + 0x74]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea ecx, [esp + 0x70]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea esi, [esp + 0x70]
call fcn.004100b0
mov edi, esi
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov eax, dword [0x49f43c]
cmp eax, 2
je case.0x46de91.43
cmp eax, 3
jne case.0x46de91.30
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 1
jmp 0x46e98b
push 0x104
lea ecx, [esp + 0x74]
push ecx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
lea edx, [esp + 0x74]
push edx
push str.HOMEDRIVE
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
lea eax, [esp + 0x74]
push eax
push str.HOMEPATH
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
lea ecx, [esp + 0x74]
push ecx
push str.HOMESHARE
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
lea edx, [esp + 0x74]
push edx
push str.LOGONSERVER
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
lea eax, [esp + 0x74]
push eax
push str.USERDOMAIN
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
push 0x104
lea ecx, [esp + 0x74]
push ecx
push str.USERDNSDOMAIN
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
mov edi, dword [esi + 0x13c]
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
movzx edi, byte [esi + 0x138]
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
mov edi, dword [esi + 0x16c]
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], edi
jmp 0x46e98b
mov edi, dword [esi + 0x170]
mov ebx, ebp
call fcn.0040f6d0
jmp case.default.0x46de91
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
test eax, eax
jge 0x46e962
fadd qword [0x487210]
mov esi, ebp
fstp qword [esp + 0x14]
call fcn.0040bd60
fld qword [esp + 0x14]
fstp qword [ebp]
mov dword [ebp + 8], 3
jmp case.default.0x46de91
mov esi, ebp
call fcn.0040bd60
mov dword [ebp], 0
mov dword [ebp + 8], 1
lea ecx, [esp + 0x4b8]
call fcn.0040c430
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x49c
ret 0x18