Function at 0x42e6b5
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov esi, 0x104
xor ebx, ebx
push esi
mov edi, eax
lea eax, [ebp - 0x12f]
push ebx
push eax
mov byte [ebp - 0x130], bl
call fcn.004507e0
add esp, 0xc
push esi
lea eax, [ebp - 0x24f]
push ebx
push eax
mov byte [ebp - 0x250], bl
call fcn.004507e0
lea eax, [ebp - 0x148]
add esp, 0xc
push eax
mov dword [ebp - 4], ebx
call fcn.00452177
pop ecx
lea eax, [ebp - 0x148]
push eax
call fcn.00452bab
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x472b30]
call fcn.0044dfd0
test eax, eax
pop ecx
pop ecx
je 0x42e739
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5b
jl 0x42e718
mov eax, dword [ebp - 4]
cmp eax, 0x5b
jne 0x42e79b
push 0x46d128
lea esi, [ebp - 0x18]
call fcn.0040e021
lea eax, [ebp + 8]
mov edi, esi
mov dword [ebp - 8], ebx
call fcn.0040e188
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea esi, [ebp - 8]
call fcn.0040dddd
cmp dword [ebp - 4], ebx
jne 0x42e78c
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
call fcn.0044db10
pop ecx
push dword [ebp + 8]
call fcn.0044db10
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
call fcn.0040fc2e
xor ebx, ebx
jmp 0x42e771
cmp eax, 0x5a
ja case.default.0x42e7a0
jmp dword [eax*4 + 0x42f2e9]
push 0x46d158
mov edi, dword [ebp + 0x14]
call fcn.0040fea7
jmp case.default.0x42e7a0
push 0x46a384
jmp 0x42e7ac
push 0x46ab2c
jmp 0x42e7ac
push 0x46d15c
jmp 0x42e7ac
push dword [edi + 0x254]
jmp 0x42f18a
push dword [edi + 0x258]
jmp 0x42f18a
mov eax, dword [ebp - 8]
push dword [eax]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.0044e1cb
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
jmp 0x42e7ac
mov eax, dword [ebp - 8]
push dword [eax + 4]
jmp 0x42e7e6
mov eax, dword [ebp - 8]
push dword [eax + 8]
jmp 0x42e7e6
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
jmp 0x42e7e6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
inc eax
push eax
jmp 0x42e7e6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
jmp 0x42f18a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
inc eax
jmp 0x42e830
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x42e7eb
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.CommonFilesDir
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e91f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Personal
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x130]
call fcn.0040bfe2
jmp 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_AppData
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e9b7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Documents
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ea86
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Favorites
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eb16
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Programs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Programs
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eba6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Start_Menu
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Start_Menu
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ec36
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Startup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Startup
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.AppData
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e9cb
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42ea9a
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42eb2a
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42ebba
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42ec4a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
jmp 0x42e7fa
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x42e7fa
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x42e7fa
push 6
jmp 0x42f18a
push 3
jmp 0x42f18a
push 9
jmp 0x42f18a
push 5
jmp 0x42f18a
push 0xa
jmp 0x42f18a
push 2
jmp 0x42f18a
push 7
jmp 0x42f18a
push 8
jmp 0x42f18a
push 4
jmp 0x42f18a
push 1
jmp 0x42f18a
cmp byte [0x4745ae], 1
mov esi, dword [ebp + 0x14]
jne 0x42eda9
push 1
jmp 0x42f18d
push ebx
jmp 0x42f18d
cmp byte [0x47ef31], 1
jmp 0x42ed9d
push 0x40
jmp 0x42f18a
push 0x41
jmp 0x42f18a
push 0x42
jmp 0x42f18a
push 0x43
jmp 0x42f18a
push dword [edi + 0x16c]
jmp 0x42e7ac
push dword [edi + 0x160]
jmp 0x42e7ac
push dword [edi + 0x178]
jmp 0x42e7ac
mov ecx, dword [edi + 0x190]
call fcn.004065e9
jmp 0x42e830
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x42e7fa
mov eax, dword [0x47e6b4]
mov ecx, eax
dec ecx
je 0x42ee49
dec ecx
je 0x42ee3f
dec ecx
je 0x42ee35
neg eax
push eax
push str.UNKN_d
jmp 0x42e7eb
push 0x46d2d0
jmp 0x42e7ac
push str.IA64
jmp 0x42e7ac
push 0x46d2c4
jmp 0x42e7ac
cmp byte [0x47e69c], 1
mov edi, dword [ebp + 0x14]
jne 0x42ee69
push str.WIN32_NT
jmp 0x42e7af
push str.WIN32_WINDOWS
jmp 0x42e7af
cmp byte [0x47e69c], 1
jne 0x42eee8
cmp byte [0x47e6a2], 1
jne 0x42ee8f
push str.WIN_LONGHORN
jmp 0x42e7ac
cmp byte [0x47e6a8], 1
jne 0x42eea2
push str.WIN_VISTA
jmp 0x42e7ac
cmp byte [0x47e6a6], 1
jne 0x42eeb5
push str.WIN_2003
jmp 0x42e7ac
cmp byte [0x47e6a0], 1
jne 0x42eec8
push str.WIN_XP
jmp 0x42e7ac
cmp byte [0x47e6a4], 1
mov edi, dword [ebp + 0x14]
jne 0x42eede
push str.WIN_2000
jmp 0x42e7af
push str.WIN_NT4
jmp 0x42e7af
cmp byte [0x47e6ac], 1
jne 0x42eefb
push str.WIN_95
jmp 0x42e7ac
cmp byte [0x47e6aa], 1
mov edi, dword [ebp + 0x14]
jne 0x42ef11
push str.WIN_98
jmp 0x42e7af
push str.WIN_ME
jmp 0x42e7af
push dword [0x47e598]
jmp 0x42f18a
push 0x47e59c
jmp 0x42e7ac
cmp byte [0x47e69c], 1
lea eax, [ebp - 4]
push eax
push 1
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
push ebx
jne 0x42efa6
cmp byte [0x47e6a5], 1
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
jne 0x42ef81
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.InstallLanguage
jmp 0x42e884
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Default
jmp 0x42e884
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42efde
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push 0x469ede
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x12c]
jmp 0x42e800
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x18]
jmp 0x42e800
lea eax, [ebp - 0x250]
push str.3__2__9__1
push eax
call fcn.0044d950
lea eax, [ebp - 0x250]
push eax
xor esi, esi
xor edi, edi
call fcn.0044e140
add esp, 0xc
test eax, eax
jle 0x42f056
mov al, byte [ebp + edi - 0x250]
cmp al, 0x20
je 0x42f044
cmp al, 0x2c
jne 0x42f03c
mov byte [ebp + esi - 0x250], 0x2e
jmp 0x42f043
mov byte [ebp + esi - 0x250], al
inc esi
lea eax, [ebp - 0x250]
push eax
inc edi
call fcn.0044e140
cmp edi, eax
pop ecx
jl 0x42f023
mov byte [ebp + esi - 0x250], bl
lea eax, [ebp - 0x250]
jmp 0x42e800
push esi
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
jmp 0x42e7fa
lea eax, [ebp - 0x28]
xor esi, esi
push eax
inc esi
call fcn.0040cdea
pop ecx
lea eax, [ebp - 0x28]
jmp 0x42e800
lea eax, [ebp - 0x28]
push eax
push 2
pop esi
jmp 0x42f083
lea eax, [ebp - 0x28]
push eax
push 3
jmp 0x42f097
lea eax, [ebp - 0x28]
push eax
push 4
jmp 0x42f097
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x42f18a
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x134]
jmp 0x42f18a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.0040fde2
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x42e7a0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x42f0f9
push esi
lea eax, [ebp - 0x130]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
jmp 0x42e7fa
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x42e91f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x42e7fa
mov eax, dword [0x47e6d0]
cmp eax, 2
je case.0x42e7a0.42
cmp eax, 3
je case.0x42e7a0.42
push ebx
mov esi, dword [ebp + 0x14]
call fcn.0040fde2
jmp case.default.0x42e7a0
cmp byte [0x47e69c], bl
je 0x42f1ae
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERPROFILE
jmp 0x42f13b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f1f6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130]
push eax
call fcn.0044e140
pop ecx
jmp 0x42f20f
cmp byte [ebp + eax - 0x130], 0x5c
je 0x42f212
dec eax
jns 0x42f205
mov byte [ebp + eax - 0x130], bl
jmp 0x42e7fa
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEDRIVE
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEPATH
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMESHARE
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.LOGONSERVER
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDOMAIN
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDNSDOMAIN
jmp 0x42f13b
push dword [edi + 0x220]
jmp 0x42f18a
movzx eax, byte [edi + 0x21c]
jmp 0x42e830
push dword [edi + 0x25c]
jmp 0x42f18a
push dword [edi + 0x260]
jmp 0x42e7ac
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x42f2cd
fadd qword [0x46d9b0]
mov esi, dword [ebp + 0x14]
push ecx
push ecx
fstp qword [esp]
call fcn.0040fe8e
jmp case.default.0x42e7a0
push 0x5780000
jmp 0x42f18a