Function at 0x43621d
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
push edi
push 0x41
pop ecx
mov esi, eax
xor eax, eax
mov byte [ebp - 0x130], 0
lea edi, [ebp - 0x12f]
rep stosd dword es:[edi], eax
push 0x41
mov byte [ebp - 0x24c], al
pop ecx
lea edi, [ebp - 0x24b]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
xor ebx, ebx
call fcn.0044ab52
lea eax, [ebp - 0x28]
push eax
call fcn.0044ab8b
pop ecx
pop ecx
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push dword [ebp + 8]
push dword [ebx*4 + 0x462e18]
call fcn.00448480
test eax, eax
pop ecx
pop ecx
je 0x43628f
inc ebx
cmp ebx, 0x5a
jl 0x436274
cmp ebx, 0x5a
jne 0x4362ff
push 0x45d4f8
lea esi, [ebp - 0x14]
call fcn.00416696
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.004167be
push 0
lea eax, [ebp - 8]
push eax
sub esp, 0xc
lea edi, [ebp - 0x14]
mov esi, esp
call fcn.004166dc
lea ebx, [ebp - 0x144]
mov edi, 0x46f2a0
call fcn.0041647b
cmp dword [ebp - 8], 0
jne 0x4362da
xor esi, esi
inc esi
jmp 0x4362e7
push dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
call fcn.0041813a
xor esi, esi
push dword [ebp - 0x14]
call fcn.00448196
push dword [ebp + 8]
call fcn.00448196
pop ecx
mov eax, esi
jmp 0x436b03
cmp ebx, 0x59
ja case.default.0x436308
jmp dword [ebx*4 + 0x436b0d]
push 0x45d4c8
jmp 0x436800
push 0x45b1fc
jmp 0x436800
push 0x45a854
jmp 0x436800
push 0x45d4c4
jmp 0x436800
push dword [esi + 0x24c]
jmp 0x436af1
push dword [esi + 0x250]
jmp 0x436af1
push dword [edi]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.0044870b
add esp, 0xc
jmp 0x4367f9
push dword [edi + 4]
jmp 0x43634f
push dword [edi + 8]
jmp 0x43634f
push dword [edi + 0xc]
jmp 0x43634f
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x43634f
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x436ae9
mov eax, dword [edi + 0x18]
inc eax
jmp 0x436ae9
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x436354
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x436455
push 0x104
push str.CommonFilesDir
jmp 0x4363aa
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x130]
call fcn.004140bf
add esp, 0x10
lea esi, [ebp - 0x130]
call fcn.00414744
jmp 0x4367f9
push 0x104
push str.Common_AppData
jmp 0x436450
mov ebx, 0x104
push ebx
push str.Common_Desktop
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004140bf
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x4367f9
push ebx
push str.Desktop
push edi
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x130]
jmp 0x4367f1
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x130]
jmp 0x4367ec
mov ebx, 0x104
push ebx
push str.Common_Favorites
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004140bf
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x4367f9
push ebx
push str.Favorites
jmp 0x436435
mov ebx, 0x104
push ebx
push str.Common_Programs
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004140bf
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x4367f9
push ebx
push str.Programs
jmp 0x436435
mov ebx, 0x104
push ebx
push str.Common_Start_Menu
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004140bf
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x4367f9
push ebx
push str.Start_Menu
jmp 0x436435
mov ebx, 0x104
push ebx
push str.Common_Startup
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x130]
call fcn.004140bf
add esp, 0x10
cmp byte [ebp - 0x130], 0
jne 0x4367f9
push ebx
push str.Startup
jmp 0x436435
push 0x104
push str.AppData
jmp 0x436593
push 0x104
push str.Desktop
jmp 0x436593
push 0x104
push str.Favorites
jmp 0x436593
push 0x104
push str.Programs
jmp 0x436593
push 0x104
push str.Start_Menu
jmp 0x436593
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x436436
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x4367f9
push 0x104
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4367f9
push 0x104
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x4367f9
push 6
jmp 0x436af1
push 9
jmp 0x436af1
push 5
jmp 0x436af1
push 0xa
jmp 0x436af1
push 3
jmp 0x436af1
push 2
jmp 0x436af1
push 7
jmp 0x436af1
push 8
jmp 0x436af1
push 4
jmp 0x436af1
xor eax, eax
inc eax
cmp byte [0x4638de], al
jmp 0x43663b
xor eax, eax
inc eax
cmp byte [0x46e2c9], al
mov esi, dword [ebp + 0x14]
jne 0x436646
push eax
jmp 0x436af4
push 0
jmp 0x436af4
push 0x40
jmp 0x436af1
push 0x41
jmp 0x436af1
push 0x42
jmp 0x436af1
push 0x43
jmp 0x436af1
push dword [esi + 0x164]
jmp 0x436800
push dword [esi + 0x158]
jmp 0x436800
push dword [esi + 0x170]
jmp 0x436800
mov eax, dword [esi + 0x188]
mov ecx, 0x46f2b0
call fcn.0040fab8
jmp 0x436ae9
lea eax, [ebp - 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x4367f9
mov eax, dword [0x46d9e4]
mov ecx, eax
dec ecx
je 0x4366e7
dec ecx
je 0x4366dd
dec ecx
je 0x4366d3
neg eax
push eax
push str.UNKN_d
jmp 0x436354
push 0x45d34c
jmp 0x436800
push str.IA64
jmp 0x436800
push 0x45d358
jmp 0x436800
cmp byte [0x46d9cc], 1
mov edi, dword [ebp + 0x14]
jne 0x436707
push str.WIN32_NT
jmp 0x436803
push str.WIN32_WINDOWS
jmp 0x436803
xor eax, eax
inc eax
cmp byte [0x46d9cc], al
jne 0x436783
cmp byte [0x46d9d2], al
jne 0x43672e
push str.WIN_LONGHORN
jmp 0x436800
cmp byte [0x46d9d8], al
jne 0x436740
push str.WIN_VISTA
jmp 0x436800
cmp byte [0x46d9d6], al
jne 0x436752
push str.WIN_2003
jmp 0x436800
cmp byte [0x46d9d0], al
jne 0x436764
push str.WIN_XP
jmp 0x436800
cmp byte [0x46d9d4], al
mov edi, dword [ebp + 0x14]
jne 0x436779
push str.WIN_2000
jmp 0x436803
push str.WIN_NT4
jmp 0x436803
cmp byte [0x46d9dc], al
jne 0x436792
push str.WIN_95
jmp 0x436800
cmp byte [0x46d9da], al
mov edi, dword [ebp + 0x14]
jne 0x4367a4
push str.WIN_98
jmp 0x436803
push str.WIN_ME
jmp 0x436803
push dword [0x46d8c8]
jmp 0x436af1
push 0x46d8cc
jmp 0x436800
xor eax, eax
inc eax
cmp byte [0x46d9cc], al
push 0x104
lea esi, [ebp - 0x130]
jne 0x43680d
cmp byte [0x46d9d5], al
jne 0x4367e2
push str.InstallLanguage
jmp 0x4367e7
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
call fcn.004140bf
add esp, 0x10
lea eax, [ebp - 0x130]
push eax
mov edi, dword [ebp + 0x14]
call fcn.0041839f
jmp case.default.0x436308
push 0x45a5cc
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.004140bf
add esp, 0x10
lea eax, [ebp - 0x12c]
jmp 0x4367ff
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x14]
jmp 0x4367ff
lea eax, [ebp - 0x24c]
push 0x45d24c
push eax
call fcn.00448210
lea eax, [ebp - 0x24c]
push eax
xor esi, esi
xor edi, edi
call fcn.00448680
add esp, 0xc
test eax, eax
jle 0x436896
mov al, byte [ebp + edi - 0x24c]
cmp al, 0x20
je 0x436884
cmp al, 0x2c
jne 0x43687c
mov byte [ebp + esi - 0x24c], 0x2e
jmp 0x436883
mov byte [ebp + esi - 0x24c], al
inc esi
lea eax, [ebp - 0x24c]
push eax
inc edi
call fcn.00448680
cmp edi, eax
pop ecx
jl 0x436863
mov byte [ebp + esi - 0x24c], 0
lea eax, [ebp - 0x24c]
jmp 0x4367ff
push 0x104
lea eax, [ebp - 0x130]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x4367f9
lea eax, [ebp - 0x24]
xor esi, esi
push eax
inc esi
call fcn.00415543
pop ecx
lea eax, [ebp - 0x24]
jmp 0x4367ff
lea eax, [ebp - 0x24]
push eax
push 2
jmp 0x4368ed
lea eax, [ebp - 0x24]
push eax
push 3
jmp 0x4368ed
lea eax, [ebp - 0x24]
push eax
push 4
pop esi
jmp 0x4368c9
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x436af1
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x134]
jmp 0x436af1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
jmp 0x436952
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.004182da
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x436308
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x4367f9
lea eax, [ebp - 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x4363e2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x4367f9
mov eax, dword [0x46da00]
cmp eax, 2
je case.0x436308.42
cmp eax, 3
je case.0x436308.42
push 0
jmp 0x436af1
push 1
jmp 0x436af1
cmp byte [0x46d9cc], 0
push 0x104
je 0x4369fa
lea eax, [ebp - 0x130]
push eax
push str.USERPROFILE
jmp 0x436982
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x130]
call fcn.004140bf
mov eax, esi
push eax
call fcn.00448680
add esp, 0x14
jmp 0x436a2b
cmp byte [ebp + eax - 0x130], 0x5c
je 0x436a2e
dec eax
jns 0x436a21
mov byte [ebp + eax - 0x130], 0
jmp 0x4367f9
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.HOMEDRIVE
jmp 0x436982
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.HOMEPATH
jmp 0x436982
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.HOMESHARE
jmp 0x436982
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.LOGONSERVER
jmp 0x436982
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.USERDOMAIN
jmp 0x436982
push 0x104
lea eax, [ebp - 0x130]
push eax
push str.USERDNSDOMAIN
jmp 0x436982
push dword [esi + 0x218]
jmp 0x436af1
movzx eax, byte [esi + 0x214]
jmp 0x436ae9
push dword [esi + 0x254]
jmp 0x436af1
push dword [esi + 0x258]
jmp 0x436800
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
jmp 0x436af1
push 0x51e0000
mov esi, dword [ebp + 0x14]
call fcn.004182da
push dword [ebp + 8]
call fcn.00448196
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10