Function at 0x42e5d8
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
and word [ebp - 0x268], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, 0x208
push ebx
mov esi, eax
lea eax, [ebp - 0x266]
push 0
push eax
call fcn.00451260
and word [ebp - 0x478], 0
add esp, 0xc
push ebx
lea eax, [ebp - 0x476]
push 0
push eax
call fcn.00451260
and dword [ebp - 4], 0
lea eax, [ebp - 0x48]
add esp, 0xc
push eax
call fcn.00452f3f
pop ecx
lea eax, [ebp - 0x48]
push eax
call fcn.004538b7
pop ecx
mov ebx, eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x477a18]
call fcn.0044ef27
test eax, eax
pop ecx
pop ecx
je 0x42e65d
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5c
jl 0x42e63c
cmp dword [ebp - 4], 0x5c
jne 0x42e6c2
push 0x471404
lea esi, [ebp - 0x1c]
call fcn.0040e30a
and dword [ebp - 0xc], 0
lea eax, [ebp + 8]
mov ecx, esi
call fcn.0040e4c9
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea esi, [ebp - 0xc]
lea edi, [ebp - 0x1c]
call fcn.0040e0b7
cmp dword [ebp - 4], 0
jne 0x42e6b3
xor esi, esi
inc esi
push dword [ebp - 0x1c]
call fcn.0044e722
pop ecx
push dword [ebp + 8]
call fcn.0044e722
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
call fcn.00410048
xor esi, esi
jmp 0x42e698
cmp dword [ebp - 4], 0x5b
ja case.default.0x42e6cf
mov eax, dword [ebp - 4]
jmp dword [eax*4 + 0x42eefc]
push 0x47145c
call fcn.004102c1
jmp case.default.0x42e6cf
push 0x46c428
jmp 0x42e6db
push 0x46cecc
jmp 0x42e6db
push 0x471460
jmp 0x42e6db
push dword [esi + 0x34c]
jmp 0x42eda8
push dword [esi + 0x350]
jmp 0x42eda8
push dword [ebx]
push 0x471464
lea eax, [ebp - 0x268]
push eax
call fcn.0044f059
add esp, 0xc
lea eax, [ebp - 0x268]
push eax
jmp 0x42e6db
push dword [ebx + 4]
jmp 0x42e712
push dword [ebx + 8]
jmp 0x42e712
push dword [ebx + 0xc]
jmp 0x42e712
mov eax, dword [ebx + 0x10]
inc eax
push eax
jmp 0x42e712
mov eax, dword [ebx + 0x14]
add eax, 0x76c
push eax
jmp 0x42eda8
mov eax, dword [ebx + 0x18]
inc eax
jmp 0x42e74d
mov eax, dword [ebx + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x42e717
push 0x104
push str.ProgramF
push str.SOFTWA
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x268]
call fcn.0040bbb0
add esp, 0x10
jmp 0x42e726
push 0x104
push 0x4714f4
jmp 0x42e76f
push 0x104
push str.PeR3
push str.SOFTWAR
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x268]
call fcn.0040bbb0
add esp, 0x10
lea esi, [ebp - 0x268]
call fcn.0040c247
jmp 0x42e726
push 0x104
push 0x4715ac
push str.SOFTWAR
jmp 0x42e774
mov ebx, 0x104
push ebx
push 0x4715cc
mov edi, str.SOFTWAR
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x268]
call fcn.0040bbb0
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42e820
push ebx
push str.Desktop
push edi
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x268]
call fcn.0040bbb0
add esp, 0x10
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x268]
push eax
jmp 0x42e6db
push 0x104
push 0x4715fc
jmp 0x42e7d1
mov ebx, 0x104
push ebx
push str.Comon
mov edi, str.SOFTWAR
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x268]
call fcn.0040bbb0
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42e820
push ebx
push str.FavOri
jmp 0x42e80c
mov ebx, 0x104
push ebx
push 0x471658
mov edi, str.SOFTWAR
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x268]
call fcn.0040bbb0
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42e820
push ebx
push 0x471678
jmp 0x42e80c
mov ebx, 0x104
push ebx
push 0x47168c
mov edi, str.SOFTWAR
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x268]
call fcn.0040bbb0
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42e820
push ebx
push 0x4716b0
jmp 0x42e80c
mov ebx, 0x104
push ebx
push 0x4716c8
mov edi, str.SOFTWAR
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x268]
call fcn.0040bbb0
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42e820
push ebx
push str.Startup
jmp 0x42e80c
push 0x104
push str.ArpData
push str.SOFTWAR
push reloc.WSOCK32.dll_accept
jmp 0x42e779
push 0x104
push str.Desktop
jmp 0x42e92e
push 0x104
push str.FavOri
jmp 0x42e92e
push 0x104
push 0x471678
jmp 0x42e92e
push 0x104
push 0x4716b0
jmp 0x42e92e
push 0x104
push str.Startup
jmp 0x42e92e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x268]
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
jmp 0x42e726
push 0x104
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
jmp 0x42e726
push 0x104
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
jmp 0x42e726
push 6
jmp 0x42eda8
push 3
jmp 0x42eda8
push 9
jmp 0x42eda8
push 5
jmp 0x42eda8
push 0xa
jmp 0x42eda8
push 2
jmp 0x42eda8
push 7
jmp 0x42eda8
push 8
jmp 0x42eda8
push 4
jmp 0x42eda8
push 1
jmp 0x42eda8
xor eax, eax
inc eax
cmp byte [0x4795bf], al
mov esi, edi
jne 0x42ea1d
push eax
jmp 0x42edaa
push 0
jmp 0x42edaa
xor eax, eax
inc eax
cmp byte [0x48c261], al
jmp 0x42ea13
push 0x40
jmp 0x42eda8
push 0x41
jmp 0x42eda8
push 0x42
jmp 0x42eda8
push 0x43
jmp 0x42eda8
push dword [esi + 0x260]
jmp 0x42e6db
push dword [esi + 0x254]
jmp 0x42e6db
push dword [esi + 0x26c]
jmp 0x42e6db
mov ecx, dword [esi + 0x284]
call fcn.0040682f
jmp 0x42e74d
lea eax, [ebp - 0x268]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
jmp 0x42e726
mov eax, dword [0x48b7cc]
mov ecx, eax
dec ecx
je 0x42eac4
dec ecx
je 0x42eaba
dec ecx
je 0x42eab0
neg eax
push eax
push str.UNIN_d
jmp 0x42e717
push 0x47171c
jmp 0x42e6db
push 0x471710
jmp 0x42e6db
push 0x471708
jmp 0x42e6db
cmp byte [0x48b7b4], 1
jne 0x42eae1
push 0x471734
jmp 0x42e6db
push 0x471748
jmp 0x42e6db
xor eax, eax
inc eax
cmp byte [0x48b7b4], al
jne 0x42eb5a
cmp byte [0x48b7ba], al
jne 0x42eb08
push 0x471764
jmp 0x42e6db
cmp byte [0x48b7c0], al
jne 0x42eb1a
push 0x471780
jmp 0x42e6db
cmp byte [0x48b7be], al
jne 0x42eb2c
push 0x471794
jmp 0x42e6db
cmp byte [0x48b7b8], al
jne 0x42eb3e
push 0x4717a8
jmp 0x42e6db
cmp byte [0x48b7bc], al
jne 0x42eb50
push str.WIN_
jmp 0x42e6db
push 0x4717cc
jmp 0x42e6db
cmp byte [0x48b7c4], al
jne 0x42eb6c
push 0x4717dc
jmp 0x42e6db
cmp byte [0x48b7c2], al
jne 0x42eb7e
push str.WIN_98
jmp 0x42e6db
push 0x4717fc
jmp 0x42e6db
push dword [0x48b5b0]
jmp 0x42eda8
push 0x48b5b4
jmp 0x42e6db
xor eax, eax
inc eax
cmp byte [0x48b7b4], al
push 0x104
lea esi, [ebp - 0x268]
jne 0x42ebd6
cmp byte [0x48b7bd], al
jne 0x42ebc2
push 0x47180c
jmp 0x42ebc7
push str.Default
push str.SYSTMM
push reloc.OLEAUT32.dll_SysReAllocString
jmp 0x42e77f
push 0x46bf68
push 0x471890
push reloc.WSOCK32.dll_closesocket
call fcn.0040bbb0
add esp, 0x10
lea eax, [ebp - 0x260]
jmp 0x42e72c
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x20]
jmp 0x42e72c
lea eax, [ebp - 0x478]
push 0x4718ec
push eax
call fcn.0044e973
lea eax, [ebp - 0x478]
push eax
xor esi, esi
xor ebx, ebx
call fcn.0044f00e
add esp, 0xc
test eax, eax
jle 0x42ec6d
movzx eax, word [ebp + ebx*2 - 0x478]
cmp ax, 0x20
je 0x42ec5b
cmp ax, 0x2c
jne 0x42ec52
mov word [ebp + esi*2 - 0x478], 0x2e
jmp 0x42ec5a
mov word [ebp + esi*2 - 0x478], ax
inc esi
lea eax, [ebp - 0x478]
push eax
inc ebx
call fcn.0044f00e
cmp ebx, eax
pop ecx
jl 0x42ec32
and word [ebp + esi*2 - 0x478], 0
lea eax, [ebp - 0x478]
jmp 0x42e72c
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
jmp 0x42e726
lea eax, [ebp - 0x40]
push eax
xor eax, eax
inc eax
call fcn.0040d0aa
pop ecx
lea eax, [ebp - 0x40]
jmp 0x42e72c
lea eax, [ebp - 0x40]
push eax
push 2
pop eax
jmp 0x42eca1
lea eax, [ebp - 0x40]
push eax
push 3
jmp 0x42ecb5
lea eax, [ebp - 0x40]
push eax
push 4
jmp 0x42ecb5
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x50]
jmp 0x42eda8
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x4c]
jmp 0x42eda8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [ebp + 0x14], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
mov esi, edi
call fcn.004101fc
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x42e6cf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x42ed0b
push 0x104
lea eax, [ebp - 0x268]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
jmp 0x42e726
lea eax, [ebp - 0x268]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
jmp 0x42e7b7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x268]
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x42e726
mov eax, dword [0x48b7e8]
cmp eax, 2
je case.0x42e6cf.42
cmp eax, 3
je case.0x42e6cf.42
push 0
mov esi, edi
call fcn.004101fc
xor esi, esi
jmp 0x42e6a1
cmp byte [0x48b7b4], 0
push 0x104
je 0x42edd5
lea eax, [ebp - 0x268]
push eax
push 0x471908
jmp 0x42ed50
push str.Desktop
push str.SOFTWAR
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x268]
call fcn.0040bbb0
mov eax, esi
push eax
call fcn.0044f00e
add esp, 0x14
jmp 0x42ee07
cmp word [ebp + eax*2 - 0x268], 0x5c
je 0x42ee0a
dec eax
jns 0x42edfc
and word [ebp + eax*2 - 0x268], 0
jmp 0x42e726
push 0x104
lea eax, [ebp - 0x268]
push eax
push str.HOMEDR
jmp 0x42ed50
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x470c94
jmp 0x42ed50
push 0x104
lea eax, [ebp - 0x268]
push eax
push str.IOMESHARE
jmp 0x42ed50
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x470c68
jmp 0x42ed50
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x471920
jmp 0x42ed50
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x471938
jmp 0x42ed50
push dword [esi + 0x314]
jmp 0x42eda8
movzx eax, byte [esi + 0x310]
jmp 0x42e74d
push dword [esi + 0x354]
jmp 0x42eda8
push dword [esi + 0x358]
jmp 0x42e6db
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
test eax, eax
mov dword [ebp + 0x14], eax
fild dword [ebp + 0x14]
jge 0x42eedf
fadd qword [0x472380]
push ecx
push ecx
mov esi, edi
fstp qword [esp]
call fcn.004102a8
jmp case.default.0x42e6cf
push 0x5780001
jmp 0x42eda8