Function at 0x4366d0
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
push edi
push 0x41
pop ecx
mov esi, eax
xor eax, eax
mov byte [ebp - 0x130], 0
lea edi, [ebp - 0x12f]
rep stosd dword es:[edi], eax
push 0x41
mov byte [ebp - 0x24c], al
pop ecx
lea edi, [ebp - 0x24b]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
xor ebx, ebx
call fcn.0044b3b2
lea eax, [ebp - 0x28]
push eax
call fcn.0044b3eb
pop ecx
pop ecx
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push dword [ebp + 8]
push dword [ebx*4 + 0x462e08]
call fcn.00448c50
test eax, eax
pop ecx
pop ecx
je 0x436742
inc ebx
cmp ebx, 0x5b
jl 0x436727
cmp ebx, 0x5b
jne 0x4367b2
push 0x45d540
lea esi, [ebp - 0x14]
call fcn.00416898
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.004169c0
push 0
lea eax, [ebp - 8]
push eax
sub esp, 0xc
lea edi, [ebp - 0x14]
mov esi, esp
call fcn.004168de
lea ebx, [ebp - 0x144]
mov edi, 0x46f280
call fcn.0041667d
cmp dword [ebp - 8], 0
jne 0x43678d
xor esi, esi
inc esi
jmp 0x43679a
push dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
call fcn.004184a3
xor esi, esi
push dword [ebp - 0x14]
call fcn.0044896c
push dword [ebp + 8]
call fcn.0044896c
pop ecx
mov eax, esi
jmp 0x436fc2
cmp ebx, 0x5a
ja case.default.0x4367bb
jmp dword [ebx*4 + 0x436fcc]
push 0x45d510
jmp 0x436a9e
push 0x45b20c
jmp 0x436a9e
push 0x45a864
jmp 0x436a9e
push 0x45d50c
jmp 0x436a9e
push dword [esi + 0x24c]
jmp 0x436fb0
push dword [esi + 0x250]
jmp 0x436fb0
push dword [edi]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.00448edb
add esp, 0xc
jmp 0x436a97
push dword [edi + 4]
jmp 0x436802
push dword [edi + 8]
jmp 0x436802
push dword [edi + 0xc]
jmp 0x436802
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x436802
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x436fa4
mov eax, dword [edi + 0x18]
inc eax
jmp 0x436fa4
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x436807
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004142b5
add esp, 0x10
jmp 0x436a97
push 0x104
push str.CommonFilesDir
jmp 0x43685d
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x130]
call fcn.004142b5
add esp, 0x10
lea esi, [ebp - 0x130]
call fcn.0041493a
jmp 0x436a97
push 0x104
push str.Common_AppData
jmp 0x43690b
mov ebx, 0x104
push ebx
push str.Common_Desktop
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004142b5
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x436a97
push ebx
push str.Desktop
push edi
jmp 0x436a4d
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x436862
mov ebx, 0x104
push ebx
push str.Common_Favorites
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004142b5
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x436a97
push ebx
push str.Favorites
jmp 0x4368fb
mov ebx, 0x104
push ebx
push str.Common_Programs
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004142b5
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x436a97
push ebx
push str.Programs
jmp 0x4368fb
mov ebx, 0x104
push ebx
push str.Common_Start_Menu
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004142b5
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x436a97
push ebx
push str.Start_Menu
jmp 0x4368fb
mov ebx, 0x104
push ebx
push str.Common_Startup
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004142b5
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x436a97
push ebx
push str.Startup
jmp 0x4368fb
push 0x104
push str.AppData
jmp 0x436a48
push 0x104
push str.Desktop
jmp 0x436a48
push 0x104
push str.Favorites
jmp 0x436a48
push 0x104
push str.Programs
jmp 0x436a48
push 0x104
push str.Start_Menu
jmp 0x436a48
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x436867
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x436a97
push 0x104
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x436a97
push 0x104
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x130]
push eax
mov edi, dword [ebp + 0x14]
call fcn.00418708
jmp case.default.0x4367bb
push 6
jmp 0x436fb0
push 9
jmp 0x436fb0
push 5
jmp 0x436fb0
push 0xa
jmp 0x436fb0
push 3
jmp 0x436fb0
push 2
jmp 0x436fb0
push 7
jmp 0x436fb0
push 8
jmp 0x436fb0
push 4
jmp 0x436fb0
xor eax, eax
inc eax
cmp byte [0x4638be], al
jmp 0x436afe
xor eax, eax
inc eax
cmp byte [0x46e2a9], al
mov esi, dword [ebp + 0x14]
jne 0x436b09
push eax
jmp 0x436fb3
push 0
jmp 0x436fb3
push 0x40
jmp 0x436fb0
push 0x41
jmp 0x436fb0
push 0x42
jmp 0x436fb0
push 0x43
jmp 0x436fb0
push dword [esi + 0x164]
jmp 0x436a9e
push dword [esi + 0x158]
jmp 0x436a9e
push dword [esi + 0x170]
jmp 0x436a9e
mov eax, dword [esi + 0x188]
mov ecx, 0x46f290
call fcn.0040fa6d
jmp 0x436fa4
lea eax, [ebp - 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x436a97
mov eax, dword [0x46d9c4]
mov ecx, eax
dec ecx
je 0x436baa
dec ecx
je 0x436ba0
dec ecx
je 0x436b96
neg eax
push eax
push str.UNKN_d
jmp 0x436807
push 0x45d398
jmp 0x436a9e
push str.IA64
jmp 0x436a9e
push 0x45d3a4
jmp 0x436a9e
cmp byte [0x46d9ac], 1
mov edi, dword [ebp + 0x14]
jne 0x436bca
push str.WIN32_NT
jmp 0x436aa1
push str.WIN32_WINDOWS
jmp 0x436aa1
xor eax, eax
inc eax
cmp byte [0x46d9ac], al
jne 0x436c46
cmp byte [0x46d9b2], al
jne 0x436bf1
push str.WIN_LONGHORN
jmp 0x436a9e
cmp byte [0x46d9b8], al
jne 0x436c03
push str.WIN_VISTA
jmp 0x436a9e
cmp byte [0x46d9b6], al
jne 0x436c15
push str.WIN_2003
jmp 0x436a9e
cmp byte [0x46d9b0], al
jne 0x436c27
push str.WIN_XP
jmp 0x436a9e
cmp byte [0x46d9b4], al
mov edi, dword [ebp + 0x14]
jne 0x436c3c
push str.WIN_2000
jmp 0x436aa1
push str.WIN_NT4
jmp 0x436aa1
cmp byte [0x46d9bc], al
jne 0x436c58
push str.WIN_95
jmp 0x436a9e
cmp byte [0x46d9ba], al
mov edi, dword [ebp + 0x14]
jne 0x436c6d
push str.WIN_98
jmp 0x436aa1
push str.WIN_ME
jmp 0x436aa1
push dword [0x46d8a8]
jmp 0x436fb0
push 0x46d8ac
jmp 0x436a9e
xor eax, eax
inc eax
cmp byte [0x46d9ac], al
push 0x104
lea esi, [ebp - 0x130]
jne 0x436cc5
cmp byte [0x46d9b5], al
jne 0x436cb1
push str.InstallLanguage
jmp 0x436cb6
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
jmp 0x43686d
push 0x45a5dc
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.004142b5
add esp, 0x10
lea eax, [ebp - 0x12c]
jmp 0x436a9d
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x14]
jmp 0x436a9d
lea eax, [ebp - 0x24c]
push str.3__2__4__9
push eax
call fcn.004489e0
lea eax, [ebp - 0x24c]
push eax
xor esi, esi
xor edi, edi
call fcn.00448e50
add esp, 0xc
test eax, eax
jle 0x436d54
mov al, byte [ebp + edi - 0x24c]
cmp al, 0x20
je 0x436d42
cmp al, 0x2c
jne 0x436d3a
mov byte [ebp + esi - 0x24c], 0x2e
jmp 0x436d41
mov byte [ebp + esi - 0x24c], al
inc esi
lea eax, [ebp - 0x24c]
push eax
inc edi
call fcn.00448e50
cmp edi, eax
pop ecx
jl 0x436d21
mov byte [ebp + esi - 0x24c], 0
lea eax, [ebp - 0x24c]
jmp 0x436a9d
push 0x104
lea eax, [ebp - 0x130]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x436a97
lea eax, [ebp - 0x24]
xor esi, esi
push eax
inc esi
call fcn.00415739
pop ecx
lea eax, [ebp - 0x24]
jmp 0x436a9d
lea eax, [ebp - 0x24]
push eax
push 2
jmp 0x436dab
lea eax, [ebp - 0x24]
push eax
push 3
jmp 0x436dab
lea eax, [ebp - 0x24]
push eax
push 4
pop esi
jmp 0x436d87
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x436fb0
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x134]
jmp 0x436fb0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
jmp 0x436e10
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.00418643
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x4367bb
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x436a97
lea eax, [ebp - 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x4368a8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x436a97
mov eax, dword [0x46d9e0]
cmp eax, 2
je case.0x4367bb.42
cmp eax, 3
jne case.0x4367bb.29
push 1
jmp 0x436fb0
cmp byte [0x46d9ac], 0
push 0x104
je 0x436eb5
lea eax, [ebp - 0x130]
push eax
push str.USERPROFILE
jmp 0x436e40
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x130]
call fcn.004142b5
mov eax, esi
push eax
call fcn.00448e50
add esp, 0x14
jmp 0x436ee6
cmp byte [ebp + eax - 0x130], 0x5c
je 0x436ee9
dec eax
jns 0x436edc
mov byte [ebp + eax - 0x130], 0
jmp 0x436a97
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.HOMEDRIVE
jmp 0x436e40
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.HOMEPATH
jmp 0x436e40
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.HOMESHARE
jmp 0x436e40
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.LOGONSERVER
jmp 0x436e40
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.USERDOMAIN
jmp 0x436e40
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.USERDNSDOMAIN
jmp 0x436e40
push dword [esi + 0x218]
jmp 0x436fb0
movzx eax, byte [esi + 0x214]
jmp 0x436fa4
push dword [esi + 0x254]
jmp 0x436fb0
push dword [esi + 0x258]
jmp 0x436a9e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
jmp 0x436fb0
push 0x51e0000
jmp 0x436fb0
push 0
mov esi, dword [ebp + 0x14]
call fcn.00418643
push dword [ebp + 8]
call fcn.0044896c
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10