Function at 0x436876
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
mov edx, 0x82
mov esi, eax
xor eax, eax
xor ebx, ebx
mov ecx, edx
mov word [ebp - 0x260], bx
lea edi, [ebp - 0x25e]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 0x46c], bx
lea edi, [ebp - 0x46a]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0044b362
lea eax, [ebp - 0xc]
push eax
call fcn.0044b39b
pop ecx
pop ecx
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push dword [ebp + 8]
push dword [ebx*4 + 0x465e10]
call fcn.00448c09
test eax, eax
pop ecx
pop ecx
je 0x4368ec
inc ebx
cmp ebx, 0x5a
jl 0x4368d1
cmp ebx, 0x5a
jne 0x436959
push 0x46075c
lea esi, [ebp - 0x1c]
call fcn.00416a9d
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.00416bda
push 0
lea eax, [ebp - 8]
push eax
sub esp, 0xc
lea edi, [ebp - 0x1c]
mov esi, esp
call fcn.00416aeb
lea ebx, [ebp - 0x44]
mov edi, 0x47ad20
call fcn.0041687f
cmp dword [ebp - 8], 0
jne 0x436934
xor esi, esi
inc esi
jmp 0x436941
push dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
call fcn.004185c9
xor esi, esi
push dword [ebp - 0x1c]
call fcn.00448a22
push dword [ebp + 8]
call fcn.00448a22
pop ecx
mov eax, esi
jmp 0x437161
cmp ebx, 0x59
ja case.default.0x436962
jmp dword [ebx*4 + 0x43716a]
push 0x460700
jmp 0x436e5f
push 0x45c7f8
jmp 0x436e5f
push 0x45bb3c
jmp 0x436e5f
push 0x4606fc
jmp 0x436e5f
push dword [esi + 0x34c]
jmp 0x43714f
push dword [esi + 0x350]
jmp 0x43714f
push dword [edi]
push str._.2d
lea eax, [ebp - 0x260]
push eax
call fcn.00448d78
add esp, 0xc
jmp 0x436e58
push dword [edi + 4]
jmp 0x4369a9
push dword [edi + 8]
jmp 0x4369a9
push dword [edi + 0xc]
jmp 0x4369a9
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x4369a9
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x437147
mov eax, dword [edi + 0x18]
inc eax
jmp 0x437147
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x4369ae
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x436ab0
push 0x104
push str.CommonFilesDir
jmp 0x436a04
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
call fcn.004143b1
add esp, 0x10
lea esi, [ebp - 0x260]
call fcn.00414a5a
jmp 0x436e58
push 0x104
push str.Common_AppData
jmp 0x436aab
mov ebx, 0x104
push ebx
push str.Common_Desktop
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004143b1
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436e58
push ebx
push str.Desktop
push edi
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
jmp 0x436e50
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x260]
jmp 0x436e4b
mov ebx, 0x104
push ebx
push str.Common_Favorites
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004143b1
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436e58
push ebx
push str.Favorites
jmp 0x436a90
mov ebx, 0x104
push ebx
push str.Common_Programs
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004143b1
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436e58
push ebx
push str.Programs
jmp 0x436a90
mov ebx, 0x104
push ebx
push str.Common_Start_Menu
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004143b1
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436e58
push ebx
push str.Start_Menu
jmp 0x436a90
mov ebx, 0x104
push ebx
push str.Common_Startup
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004143b1
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436e58
push ebx
push str.Startup
jmp 0x436a90
push 0x104
push str.AppData
jmp 0x436bf2
push 0x104
push str.Desktop
jmp 0x436bf2
push 0x104
push str.Favorites
jmp 0x436bf2
push 0x104
push str.Programs
jmp 0x436bf2
push 0x104
push str.Start_Menu
jmp 0x436bf2
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x436a91
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
jmp 0x436e58
push 0x104
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
jmp 0x436e58
push 0x104
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
jmp 0x436e58
push 6
jmp 0x43714f
push 9
jmp 0x43714f
push 5
jmp 0x43714f
push 0xa
jmp 0x43714f
push 3
jmp 0x43714f
push 2
jmp 0x43714f
push 7
jmp 0x43714f
push 8
jmp 0x43714f
push 4
jmp 0x43714f
xor eax, eax
inc eax
cmp byte [0x4669c6], al
jmp 0x436c9a
xor eax, eax
inc eax
cmp byte [0x4796b1], al
mov esi, dword [ebp + 0x14]
jne 0x436ca5
push eax
jmp 0x437152
push 0
jmp 0x437152
push 0x40
jmp 0x43714f
push 0x41
jmp 0x43714f
push 0x42
jmp 0x43714f
push 0x43
jmp 0x43714f
push dword [esi + 0x264]
jmp 0x436e5f
push dword [esi + 0x258]
jmp 0x436e5f
push dword [esi + 0x270]
jmp 0x436e5f
mov eax, dword [esi + 0x288]
mov ecx, 0x47ad30
call fcn.0040fc12
jmp 0x437147
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
jmp 0x436e58
mov eax, dword [0x478bcc]
mov ecx, eax
dec ecx
je 0x436d46
dec ecx
je 0x436d3c
dec ecx
je 0x436d32
neg eax
push eax
push str.UNKN_d
jmp 0x4369ae
push 0x46043c
jmp 0x436e5f
push str.IA64
jmp 0x436e5f
push 0x460450
jmp 0x436e5f
cmp byte [0x478bb4], 1
mov edi, dword [ebp + 0x14]
jne 0x436d66
push str.WIN32_NT
jmp 0x436e62
push str.WIN32_WINDOWS
jmp 0x436e62
xor eax, eax
inc eax
cmp byte [0x478bb4], al
jne 0x436de2
cmp byte [0x478bba], al
jne 0x436d8d
push str.WIN_LONGHORN
jmp 0x436e5f
cmp byte [0x478bc0], al
jne 0x436d9f
push str.WIN_VISTA
jmp 0x436e5f
cmp byte [0x478bbe], al
jne 0x436db1
push str.WIN_2003
jmp 0x436e5f
cmp byte [0x478bb8], al
jne 0x436dc3
push str.WIN_XP
jmp 0x436e5f
cmp byte [0x478bbc], al
mov edi, dword [ebp + 0x14]
jne 0x436dd8
push str.WIN_2000
jmp 0x436e62
push str.WIN_NT4
jmp 0x436e62
cmp byte [0x478bc4], al
jne 0x436df1
push str.WIN_95
jmp 0x436e5f
cmp byte [0x478bc2], al
mov edi, dword [ebp + 0x14]
jne 0x436e03
push str.WIN_98
jmp 0x436e62
push str.WIN_ME
jmp 0x436e62
push dword [0x4789b0]
jmp 0x43714f
push 0x4789b4
jmp 0x436e5f
xor eax, eax
inc eax
cmp byte [0x478bb4], al
push 0x104
lea esi, [ebp - 0x260]
jne 0x436e6c
cmp byte [0x478bbd], al
jne 0x436e41
push str.InstallLanguage
jmp 0x436e46
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004143b1
add esp, 0x10
lea eax, [ebp - 0x260]
push eax
mov edi, dword [ebp + 0x14]
call fcn.0041882e
jmp case.default.0x436962
push 0x45b6e0
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.004143b1
add esp, 0x10
lea eax, [ebp - 0x258]
jmp 0x436e5e
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x20]
jmp 0x436e5e
lea eax, [ebp - 0x46c]
push str.3__2__4__1
push eax
call fcn.00448afe
lea eax, [ebp - 0x46c]
push eax
xor esi, esi
xor edi, edi
call fcn.00448d62
add esp, 0xc
test eax, eax
jle 0x436efd
mov ax, word [ebp + edi*2 - 0x46c]
cmp ax, 0x20
je 0x436eeb
cmp ax, 0x2c
jne 0x436ee2
mov word [ebp + esi*2 - 0x46c], 0x2e
jmp 0x436eea
mov word [ebp + esi*2 - 0x46c], ax
inc esi
lea eax, [ebp - 0x46c]
push eax
inc edi
call fcn.00448d62
cmp edi, eax
pop ecx
jl 0x436ec2
and word [ebp + esi*2 - 0x46c], 0
lea eax, [ebp - 0x46c]
jmp 0x436e5e
push 0x104
lea eax, [ebp - 0x260]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
jmp 0x436e58
lea eax, [ebp - 0x40]
xor edi, edi
push eax
inc edi
call fcn.0041588f
pop ecx
lea eax, [ebp - 0x40]
jmp 0x436e5e
lea eax, [ebp - 0x40]
push eax
push 2
jmp 0x436f55
lea eax, [ebp - 0x40]
push eax
push 3
jmp 0x436f55
lea eax, [ebp - 0x40]
push eax
push 4
pop edi
jmp 0x436f31
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x4c]
jmp 0x43714f
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x48]
jmp 0x43714f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
jmp 0x436fae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.00418769
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x436962
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
jmp 0x436e58
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
jmp 0x436a3c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x436e58
mov eax, dword [0x478be8]
cmp eax, 2
je case.0x436962.42
cmp eax, 3
je case.0x436962.42
push 0
jmp 0x43714f
push 1
jmp 0x43714f
cmp byte [0x478bb4], 0
push 0x104
je 0x437056
lea eax, [ebp - 0x260]
push eax
push str.USERPROFILE
jmp 0x436fde
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
call fcn.004143b1
mov eax, esi
push eax
call fcn.00448d62
add esp, 0x14
jmp 0x437088
cmp word [ebp + eax*2 - 0x260], 0x5c
je 0x43708b
dec eax
jns 0x43707d
and word [ebp + eax*2 - 0x260], 0
jmp 0x436e58
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMEDRIVE
jmp 0x436fde
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMEPATH
jmp 0x436fde
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMESHARE
jmp 0x436fde
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.LOGONSERVER
jmp 0x436fde
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.USERDOMAIN
jmp 0x436fde
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.USERDNSDOMAIN
jmp 0x436fde
push dword [esi + 0x318]
jmp 0x43714f
movzx eax, byte [esi + 0x314]
jmp 0x437147
push dword [esi + 0x354]
jmp 0x43714f
push dword [esi + 0x358]
jmp 0x436e5f
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
jmp 0x43714f
push 0x51e0001
mov esi, dword [ebp + 0x14]
call fcn.00418769
push dword [ebp + 8]
call fcn.00448a22
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10