Function at 0x479674
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get program files directory
Get session user name
Get startup folder
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x276]
push ecx
mov word [ebp - 0x278], ax
call fcn.00413580
add esp, 0xc
xor edx, edx
push 0x208
push edx
lea eax, [ebp - 0x52e]
push eax
mov word [ebp - 0x530], dx
call fcn.00413580
mov ebx, dword [ebp + 0x10]
add esp, 0xc
xor edi, edi
mov ecx, dword [edi*4 + 0x4a5820]
push ebx
push ecx
call fcn.00413f26
add esp, 8
test eax, eax
je 0x4796df
inc edi
cmp edi, 0x60
jl 0x4796c4
cmp edi, 0x60
jne 0x47975c
mov edi, 0x49fdb8
lea esi, [ebp - 0x28]
call fcn.00401ec0
lea edx, [ebp + 0x10]
push edx
mov eax, esi
mov dword [ebp - 0x14], 0
call fcn.00402a60
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
push ecx
xor edi, edi
xor ecx, ecx
mov ebx, esi
call fcn.0040b200
mov eax, dword [ebp - 4]
test eax, eax
jne 0x479738
mov ecx, esi
call fcn.00402610
lea ecx, [ebp + 0x10]
call fcn.00402610
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ebx, dword [ebp + 0xc]
push eax
call fcn.00406390
lea ecx, [ebp - 0x28]
call fcn.00402610
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edi, 0x5f
ja case.0x479765.87
jmp dword [edi*4 + 0x47a398]
mov ebx, dword [ebp + 0xc]
mov eax, 0x49fe14
call fcn.0040f3d0
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ebx, dword [ebp + 0xc]
mov eax, 0x499310
call fcn.0040f3d0
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ebx, dword [ebp + 0xc]
mov eax, 0x49ba6c
call fcn.0040f3d0
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ebx, dword [ebp + 0xc]
mov eax, 0x49fe18
call fcn.0040f3d0
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esi]
mov eax, dword [edx + 4]
lea eax, [eax + esi + 4]
call fcn.0040b6a0
mov esi, dword [ebp + 0xc]
mov edi, dword [eax + 0x14]
call fcn.00406310
mov dword [esi], edi
jmp 0x47a37e
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
lea eax, [edx + esi + 4]
call fcn.0040b6a0
mov ebx, dword [ebp + 0xc]
add eax, 0x20
push eax
call fcn.00406390
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 2]
push ecx
push 0x49fe1c
lea edx, [ebp - 0x278]
push edx
call fcn.00414085
add esp, 0xc
lea eax, [ebp - 0x278]
mov ebx, dword [ebp + 0xc]
call fcn.0040f3d0
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x49fe28
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00447ccc
push eax
call fcn.004584e7
mov esi, dword [ebp + 0xc]
mov edi, eax
call fcn.0040f470
lea ecx, [ebp - 0x288]
call fcn.00402610
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x49fe30
lea edx, [ebp - 0x300]
push edx
lea eax, [ebp - 0x2a0]
push eax
call fcn.00447ccc
push eax
call fcn.004584e7
mov esi, dword [ebp + 0xc]
mov edi, eax
call fcn.0040f470
lea ecx, [ebp - 0x300]
call fcn.00402610
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x49fe38
lea ecx, [ebp - 0x2d0]
push ecx
lea edx, [ebp - 0x2f0]
push edx
call fcn.00447ccc
push eax
call fcn.004584e7
mov esi, dword [ebp + 0xc]
mov edi, eax
call fcn.0040f470
lea ecx, [ebp - 0x2d0]
call fcn.00402610
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x499d74
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00447ccc
push eax
call fcn.004584e7
mov esi, dword [ebp + 0xc]
mov edi, eax
call fcn.0040f470
lea ecx, [ebp - 0x2e0]
call fcn.00402610
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x49fe40
lea edx, [ebp - 0x298]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.00447ccc
push eax
call fcn.004584e7
mov esi, dword [ebp + 0xc]
mov edi, eax
call fcn.0040f470
lea ecx, [ebp - 0x298]
call fcn.00402610
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x49fe48
lea ecx, [ebp - 0x2b0]
push ecx
lea edx, [ebp - 0x308]
push edx
call fcn.00447ccc
push eax
call fcn.004584e7
mov esi, dword [ebp + 0xc]
mov edi, eax
call fcn.0040f470
lea ecx, [ebp - 0x2b0]
call fcn.00402610
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea eax, [ebp - 0x2e8]
push eax
call fcn.00447ccc
push eax
call fcn.00458558
push eax
push 0x499d74
lea ecx, [ebp - 0x278]
push ecx
jmp 0x479854
push 0x49fe50
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00447ccc
push eax
call fcn.004584e7
mov esi, dword [ebp + 0xc]
mov edi, eax
call fcn.0040f470
lea ecx, [ebp - 0x48]
call fcn.00402610
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x278]
push ecx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea edx, [ebp - 0x278]
push edx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea ecx, [ebp - 0x278]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea edx, [ebp - 0x278]
push edx
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea ecx, [ebp - 0x278]
push ecx
push 0
push 0
push 0x1f
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea edx, [ebp - 0x278]
push edx
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 0x16
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea ecx, [ebp - 0x278]
push ecx
push 0
push 0
push 0x18
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea edx, [ebp - 0x278]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea ecx, [ebp - 0x278]
push ecx
push 0
push 0
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea edx, [ebp - 0x278]
push edx
push 0
push 0
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 0xb
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea ecx, [ebp - 0x278]
push ecx
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x47985c
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x278]
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x47985c
push 0x104
lea ecx, [ebp - 0x278]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je case.0x479765.87
jmp 0x47985c
mov edx, dword [0x4bd7fc]
cmp byte [edx + 0x2c], 0
push 0x104
je 0x479c94
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.00436c6f
call eax
lea edx, [ebp - 0xc]
push edx
call fcn.0043ca62
jmp 0x47985c
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x47985c
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 6
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 3
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 9
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 5
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 0xa
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 2
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 7
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 8
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 4
jmp 0x47a37e
mov ebx, 1
cmp byte [0x4ab6d2], bl
mov esi, dword [ebp + 0xc]
jne 0x479d7e
call fcn.00406310
lea ecx, [ebp + 0x10]
mov dword [esi + 8], ebx
mov dword [esi], ebx
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.00406310
lea ecx, [ebp + 0x10]
mov dword [esi + 8], ebx
mov dword [esi], 0
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ebx, 1
cmp byte [0x4bc8f1], bl
jmp 0x479d5c
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 0x40
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 0x41
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 0x42
jmp 0x47a37e
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 0x43
jmp 0x47a37e
mov eax, dword [esi + 0xc8]
jmp 0x479862
mov eax, dword [esi + 0xb8]
jmp 0x479862
mov eax, dword [esi + 0xd8]
jmp 0x479862
mov ecx, dword [esi + 0xf4]
push ecx
call fcn.0043a1f3
mov esi, dword [ebp + 0xc]
mov edi, eax
call fcn.00406310
mov dword [esi], edi
jmp 0x47a37e
lea edx, [ebp - 0x278]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x47985c
mov eax, dword [0x4bd7fc]
movzx eax, word [eax + 0x2e]
test eax, eax
je 0x479ea8
cmp eax, 6
je 0x479e75
mov ebx, dword [ebp + 0xc]
cmp eax, 9
jne 0x479f4d
mov eax, 0x49fe6c
jmp 0x479865
mov eax, str.IA64
jmp 0x479862
xor ecx, ecx
mov eax, reloc.WSOCK32.dll_accept
cpuid
lea esi, [ebp - 0x48]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [ebp - 0x3c], 0x20000000
mov eax, 0x49fe6c
jne 0x479862
mov eax, 0x49fe58
jmp 0x479862
mov eax, str.WIN32_NT
jmp 0x479862
mov eax, dword [0x4bd7fc]
mov cl, 1
cmp byte [eax + 0x2a], cl
jne 0x479ed2
mov eax, str.WIN_8
jmp 0x479862
cmp byte [eax + 0x28], cl
jne 0x479ee1
mov eax, str.WIN_2008R2
jmp 0x479862
cmp byte [eax + 0x26], cl
jne 0x479ef0
mov eax, str.WIN_7
jmp 0x479862
cmp byte [eax + 0x24], cl
jne 0x479eff
mov eax, str.WIN_2008
jmp 0x479862
cmp byte [eax + 0x22], cl
jne 0x479f0e
mov eax, str.WIN_VISTA
jmp 0x479862
cmp byte [eax + 0x20], cl
jne 0x479f1d
mov eax, str.WIN_2003
jmp 0x479862
cmp byte [eax + 0x1e], cl
jne 0x479f3b
cmp byte [eax + 0x30], 0
mov eax, str.WIN_XPe
jne 0x479862
mov eax, str.WIN_XP
jmp 0x479862
mov ebx, dword [ebp + 0xc]
cmp byte [eax + 0x1c], cl
jne 0x479f4d
mov eax, str.WIN_2000
jmp 0x479865
mov eax, str.UNKNOWN
jmp 0x479865
mov ecx, dword [0x4bd7fc]
mov esi, dword [ebp + 0xc]
mov edi, dword [ecx + 8]
call fcn.00406310
mov dword [esi], edi
jmp 0x47a37e
mov edi, dword [0x4bd7fc]
mov esi, dword [ebp + 0xc]
add edi, 0xc
call fcn.0040f470
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x104
push str.InstallLanguage
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x278]
mov edx, str.SYSTEMCurrentControlSetControlNlsLanguage
call fcn.004101c0
jmp 0x479859
push 0x104
push str.SchemeLangID
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x278]
mov edx, str.Control_PanelAppearance
call fcn.004101c0
movzx eax, word [ebp - 0x278]
add esp, 0xc
push 4
push esi
push 0
push eax
mov dword [ebp + 8], eax
call fcn.00438914
add esp, 0x10
jmp 0x47985c
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x31c]
jmp 0x479862
lea ecx, [ebp - 0x530]
push str.3__3__9__5
push ecx
call fcn.00413558
lea edx, [ebp - 0x530]
push edx
xor esi, esi
xor edi, edi
call fcn.00413501
add esp, 0xc
test eax, eax
jle 0x47a06a
movzx eax, word [ebp + edi*2 - 0x530]
cmp eax, 0x20
je 0x47a056
cmp eax, 0x2c
jne 0x47a04d
mov eax, 0x2e
mov word [ebp + esi*2 - 0x530], ax
inc esi
lea ecx, [ebp - 0x530]
push ecx
inc edi
call fcn.00413501
add esp, 4
cmp edi, eax
jl 0x47a036
xor edx, edx
mov word [ebp + esi*2 - 0x530], dx
lea eax, [ebp - 0x530]
jmp 0x479862
push 0x104
lea eax, [ebp - 0x278]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x47985c
lea ecx, [ebp - 0x68]
push ecx
push 1
call fcn.00438e4a
add esp, 8
lea eax, [ebp - 0x68]
jmp 0x479862
lea edx, [ebp - 0x68]
push edx
push 2
call fcn.00438e4a
add esp, 8
lea eax, [ebp - 0x68]
jmp 0x479862
lea eax, [ebp - 0x68]
push eax
push 3
call fcn.00438e4a
add esp, 8
lea eax, [ebp - 0x68]
jmp 0x479862
lea ecx, [ebp - 0x68]
push ecx
push 4
call fcn.00438e4a
add esp, 8
lea eax, [ebp - 0x68]
jmp 0x479862
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x30]
call fcn.00406310
mov dword [esi], edi
jmp 0x47a37e
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c]
call fcn.00406310
mov dword [esi], edi
jmp 0x47a37e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push 0xc
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.00406310
mov ecx, dword [ebp - 4]
push ebx
push edi
mov dword [esi + 8], 1
mov dword [esi], ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push 0x74
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.00406310
mov edx, dword [ebp - 4]
push ebx
push edi
mov dword [esi + 8], 1
mov dword [esi], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [ebp + 0x10]
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x104
lea eax, [ebp - 0x278]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x47985c
lea ecx, [ebp - 0x278]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea esi, [ebp - 0x278]
call fcn.004111b0
jmp 0x47985c
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x278]
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x47985c
mov eax, dword [0x4bc12c]
cmp eax, 3
je case.0x479765.43
cmp eax, 4
jne case.0x479765.30
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 1
jmp 0x47a37e
push 0x104
lea ecx, [ebp - 0x278]
push ecx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x47985c
push 0x104
lea edx, [ebp - 0x278]
push edx
push str.HOMEDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x47985c
push 0x104
lea eax, [ebp - 0x278]
push eax
push str.HOMEPATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x47985c
push 0x104
lea ecx, [ebp - 0x278]
push ecx
push str.HOMESHARE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x47985c
push 0x104
lea edx, [ebp - 0x278]
push edx
push str.LOGONSERVER
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x47985c
push 0x104
lea eax, [ebp - 0x278]
push eax
push str.USERDOMAIN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x47985c
push 0x104
lea ecx, [ebp - 0x278]
push ecx
push str.USERDNSDOMAIN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x47985c
mov edi, dword [esi + 0x148]
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], edi
jmp 0x47a37e
mov eax, dword [esi + 0x14c]
jmp 0x479862
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
test eax, eax
jns 0x47a346
fadd qword [0x4a0998]
mov esi, dword [ebp + 0xc]
fstp qword [ebp - 8]
call fcn.00406310
fld qword [ebp - 8]
lea ecx, [ebp + 0x10]
fstp qword [esi]
mov dword [esi + 8], 3
call fcn.00402610
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov esi, dword [ebp + 0xc]
call fcn.00406310
mov dword [esi], 0
mov dword [esi + 8], 1
lea ecx, [ebp + 0x10]
call fcn.00402610
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18