Function at 0x140084230
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d0
mov rbx, rcx
mov r15, rdx
mov edi, 0x208
lea rcx, [rax - 0x466]
xor esi, esi
xor edx, edx
movaps xmmword [rax - 0x48], xmm6
mov r8, rdi
mov word [rax - 0x468], si
call fcn.140019a70
lea rcx, [rsp + 0x2b2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x2b0], si
call fcn.140019a70
lea rcx, [rsp + 0x78]
call fcn.14001c834
lea rcx, [rsp + 0x78]
call fcn.14001f3ac
mov r14, qword [r15]
lea r13, str.ERROR
mov rdi, rax
xor ebp, ebp
lea r12d, [rsi + 1]
mov rcx, qword [r13]
mov rdx, r14
call fcn.140019cfc
cmp eax, ebp
je 0x1400842da
lea rax, [0x1400ae780]
add r13, 8
add esi, r12d
cmp r13, rax
jl 0x1400842b7
mov rbp, qword [rsp + 0x520]
cmp esi, 0x60
jne 0x140084360
lea rdx, [0x1400a1b90]
lea rcx, [rsp + 0x80]
call fcn.140002350
lea rcx, [rsp + 0x80]
xor ebx, ebx
mov rdx, r15
mov dword [rsp + 0x528], ebx
call fcn.1400642f0
lea r9, [rsp + 0x528]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x80]
lea rcx, [0x1400c3d48]
mov dword [rsp + 0x20], ebx
call fcn.140013640
mov rdx, qword [rsp + 0x30]
cmp rdx, rbx
je 0x14008434e
mov rcx, rbp
call fcn.140006d90
mov r12d, ebx
lea rcx, [rsp + 0x80]
call fcn.140003410
jmp 0x140084c4f
cmp esi, 0x5f
ja case.default.0x14008437d
lea rdx, [0x140000000]
movsxd rax, esi
mov ecx, dword [rdx + rax*4 + 0x84d40]
add rcx, rdx
jmp rcx
lea rdx, [0x1400a1bf4]
mov rcx, rbp
call fcn.140015040
jmp case.default.0x14008437d
lea rdx, reloc.WSOCK32.dll_inet_addr
jmp 0x140084386
lea rdx, [0x14009d13c]
jmp 0x140084386
lea rdx, reloc.WSOCK32.dll_htons
jmp 0x140084386
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + rbx + 8]
call fcn.140003980
mov ebx, dword [rax + 0x1c]
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], ebx
jmp 0x140084c46
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + rbx + 8]
call fcn.140003980
mov ebx, dword [rax + 0x24]
jmp 0x1400843c2
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rsp + 0x3e]
lea rdx, str._.3d
lea rcx, [rsp + 0xa0]
call fcn.140019e48
lea rdx, [rsp + 0xa0]
jmp 0x140084386
mov r8d, dword [rdi]
lea rdx, str._.2d
jmp 0x140084400
mov r8d, dword [rdi + 4]
jmp 0x14008441d
mov r8d, dword [rdi + 8]
jmp 0x14008441d
mov r8d, dword [rdi + 0xc]
jmp 0x14008441d
mov r8d, dword [rdi + 0x10]
add r8d, r12d
jmp 0x14008441d
mov ebx, dword [rdi + 0x14]
add ebx, 0x76c
jmp 0x1400843c2
mov ebx, dword [rdi + 0x18]
add ebx, r12d
jmp 0x1400843c2
mov r8d, dword [rdi + 0x1c]
add r8d, r12d
jmp 0x1400843f9
lea r8, str.ProgramFilesDir
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0xa0]
mov r9d, 0x104
mov qword [rsp + 0x20], rax
call fcn.1400183e0
jmp 0x14008440d
lea r8, str.CommonFilesDir
jmp 0x14008446a
lea rax, [rsp + 0xa0]
lea r8, str.Personal
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.1400183e0
lea rcx, [rsp + 0xa0]
call fcn.1400174e0
jmp 0x14008440d
lea r8, str.Common_AppData
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x140084471
lea rax, [rsp + 0xa0]
lea r8, str.Common_Desktop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400183e0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x14008440d
lea r8, str.Desktop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
jmp 0x140084478
lea r8, str.Common_Documents
jmp 0x1400844e4
lea rax, [rsp + 0xa0]
lea r8, str.Common_Favorites
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400183e0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x14008440d
lea r8, str.Favorites
jmp 0x140084531
lea rax, [rsp + 0xa0]
lea r8, str.Common_Programs
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400183e0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x14008440d
lea r8, str.Programs
jmp 0x140084531
lea rax, [rsp + 0xa0]
lea r8, str.Common_Start_Menu
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400183e0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x14008440d
lea r8, str.Start_Menu
jmp 0x140084531
lea rax, [rsp + 0xa0]
lea r8, str.Common_Startup
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400183e0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x14008440d
lea r8, str.Startup
jmp 0x140084531
lea r8, str.AppData
jmp 0x140084531
lea rdx, [rsp + 0x518]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x518], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x14008440d
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x14008440d
mov rax, qword [0x1400c4708]
xor ecx, ecx
cmp byte [rax + 0x3e], cl
je 0x1400846f8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x30]
call fcn.140040550
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call rax
lea rcx, [rsp + 0x30]
call fcn.1400473d0
jmp 0x14008440d
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x14008440d
mov rcx, rbp
call fcn.1400038c0
xor r8d, r8d
mov dword [rbp], r8d
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 6
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 3
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 9
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 5
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 0xa
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 2
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 7
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 8
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 4
jmp 0x140084c46
cmp byte [0x1400b13ca], r12b
mov rcx, rbp
je 0x140084c3d
jmp 0x140084713
cmp byte [0x1400c29ed], r12b
jmp 0x1400847df
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 0x40
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 0x41
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 0x42
jmp 0x140084c46
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], 0x43
jmp 0x140084c46
mov rdx, qword [rbx + 0x170]
jmp 0x140084386
mov rdx, qword [rbx + 0x150]
jmp 0x140084386
mov rdx, qword [rbx + 0x190]
jmp 0x140084386
mov edx, dword [rbx + 0x1c0]
lea rcx, [0x1400c3d70]
call fcn.140045130
mov ebx, eax
jmp 0x1400843c2
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x14008440d
mov rax, qword [0x1400c4708]
movzx ecx, word [rax + 0x40]
xor eax, eax
cmp ecx, eax
je 0x1400848d5
cmp ecx, 6
je 0x1400848c9
cmp ecx, 9
mov rcx, rbp
jne 0x1400849a5
lea rdx, [0x1400a1ee0]
jmp 0x140084389
lea rdx, str.IA64
jmp 0x140084386
lea rdx, [0x1400a1ec8]
jmp 0x140084386
call fcn.140018950
xor r8d, r8d
lea rdx, [0x1400a1ee0]
cmp al, r8b
lea rcx, [0x1400a1ec8]
cmove rdx, rcx
jmp 0x140084386
lea rdx, str.WIN32_NT
jmp 0x140084386
mov rax, qword [0x1400c4708]
cmp byte [rax + 0x3c], r12b
jne 0x140084928
lea rdx, str.WIN_2008R2
jmp 0x140084386
cmp byte [rax + 0x3a], r12b
jne 0x14008493a
lea rdx, str.WIN_7
jmp 0x140084386
cmp byte [rax + 0x38], r12b
jne 0x14008494c
lea rdx, str.WIN_2008
jmp 0x140084386
cmp byte [rax + 0x36], r12b
jne 0x14008495e
lea rdx, str.WIN_VISTA
jmp 0x140084386
cmp byte [rax + 0x34], r12b
jne 0x140084970
lea rdx, str.WIN_2003
jmp 0x140084386
cmp byte [rax + 0x32], r12b
jne 0x140084990
xor r8d, r8d
lea rdx, str.WIN_XPe
lea rcx, str.WIN_XP
cmp byte [rax + 0x42], r8b
jmp 0x1400848fa
mov rcx, rbp
cmp byte [rax + 0x30], r12b
jne 0x1400849a5
lea rdx, str.WIN_2000
jmp 0x140084389
lea rdx, str.UNKNOWN
jmp 0x140084389
mov rax, qword [0x1400c4708]
mov ebx, dword [rax + 8]
jmp 0x1400843c2
mov rdx, qword [0x1400c4708]
mov rcx, rbp
add rdx, 0x10
call fcn.1400150f0
jmp case.default.0x14008437d
lea r8, str.InstallLanguage
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
jmp 0x140084471
lea rax, [rsp + 0xa0]
lea r8, str.SchemeLangID
lea rdx, str.Control_PanelAppearance
mov r9d, 0x104
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.1400183e0
movzx ecx, word [rsp + 0xa0]
lea rdx, [rsp + 0xa0]
mov r8d, 4
mov dword [rsp + 0x518], ecx
call fcn.140042a40
jmp 0x14008440d
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rsp + 0x80]
jmp 0x140084386
lea rdx, [0x1400a2088]
lea rcx, [rsp + 0x2b0]
call fcn.140019150
xor eax, eax
lea rcx, [rsp + 0x2b0]
mov edi, eax
mov r13d, eax
call fcn.140019b5c
xor ecx, ecx
cmp eax, ecx
jle 0x140084ad1
lea rbx, [rsp + 0x2b0]
lea rsi, [rsp + 0x2b0]
movzx eax, word [rsi]
cmp ax, 0x20
je 0x140084ab6
add edi, r12d
cmp ax, 0x2c
jne 0x140084aaf
mov eax, 0x2e
mov word [rbx], ax
add rbx, 2
lea rcx, [rsp + 0x2b0]
add r13d, r12d
add rsi, 2
call fcn.140019b5c
cmp r13d, eax
jl 0x140084a98
xor ecx, ecx
movsxd rax, edi
lea rdx, [rsp + 0x2b0]
mov word [rsp + rax*2 + 0x2b0], cx
jmp 0x140084386
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x14008440d
mov ecx, r12d
lea rdx, [rsp + 0x58]
call fcn.1400431b0
lea rdx, [rsp + 0x58]
jmp 0x140084386
mov ecx, 2
jmp 0x140084b07
mov ecx, 3
jmp 0x140084b07
mov ecx, 4
jmp 0x140084b07
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x50]
jmp 0x1400843c2
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x54]
jmp 0x1400843c2
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, listen
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, rbp
mov ebx, eax
call fcn.1400038c0
mov rdx, rdi
mov rcx, rsi
mov dword [rbp + 8], r12d
mov dword [rbp], ebx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x14008437d
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
jmp 0x140084b81
lea rcx, str.COMSPEC
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x14008440d
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x1400844cb
lea rdx, [rsp + 0x518]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x518], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x14008440d
mov eax, dword [0x1400c1fe8]
cmp eax, 3
je case.0x14008437d.43
cmp eax, 4
jne case.0x14008437d.30
mov rcx, rbp
call fcn.1400038c0
mov dword [rbp], r12d
mov dword [rbp + 8], r12d
xor ebp, ebp
mov r12d, ebp
mov rcx, r15
call fcn.140003410
lea r11, [rsp + 0x4d0]
mov eax, r12d
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.USERPROFILE
jmp 0x140084bcf
lea rcx, str.HOMEDRIVE
jmp 0x140084bcf
lea rcx, str.HOMEPATH
jmp 0x140084bcf
lea rcx, str.HOMESHARE
jmp 0x140084bcf
lea rcx, str.LOGONSERVER
jmp 0x140084bcf
lea rcx, str.USERDOMAIN
jmp 0x140084bcf
lea rcx, str.USERDNSDOMAIN
jmp 0x140084bcf
mov rcx, rbx
call fcn.140050e20
jmp 0x14008487c
mov rcx, rbx
call fcn.140062760
mov rcx, rbp
mov bl, al
call fcn.1400038c0
mov dword [rbp + 8], 9
mov byte [rbp], bl
jmp case.default.0x14008437d
mov ebx, dword [rbx + 0x23c]
jmp 0x1400843c2
mov rdx, qword [rbx + 0x240]
jmp 0x140084386
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
pxor xmm6, xmm6
mov rcx, rbp
mov r11d, eax
cvtsi2sd xmm6, r11
call fcn.1400038c0
movsd qword [rbp], xmm6
mov dword [rbp + 8], 3
jmp case.default.0x14008437d