Function at 0x40ca4e
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, 0x42b598
push edi
push ebx
lea ecx, [ebp - 0x134]
call fcn.00401000
mov dl, byte [0x42b598]
push 0x41
pop ecx
xor eax, eax
and dword [ebp - 4], eax
lea edi, [ebp - 0x127]
mov byte [ebp - 0x128], dl
push 0x41
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x24b]
mov byte [ebp - 0x24c], dl
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00417c53
lea eax, [ebp - 0x20]
push eax
call fcn.00418427
mov esi, dword [ebp + 0xc]
pop ecx
mov edi, eax
pop ecx
mov eax, dword [esi]
push eax
lea ecx, [eax + 1]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
call fcn.00402205
mov ecx, eax
add ecx, 8
call fcn.004018ad
push eax
lea ecx, [ebp - 0x134]
call fcn.004010e1
mov dword [ebp + 0xc], 0x426a18
push dword [ebp - 0x134]
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
je 0x40cb07
add dword [ebp + 0xc], 4
inc dword [ebp - 4]
cmp dword [ebp + 0xc], 0x426b18
jl 0x40cae1
cmp dword [ebp - 4], 0x40
jne 0x40cb34
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
dec eax
push eax
call fcn.00402205
push dword [eax + 0x80]
mov ecx, dword [ebp - 8]
push 0x86
call fcn.004027ec
push 1
pop esi
jmp 0x40d1a0
cmp dword [ebp - 4], 0x3f
ja case.default.0x40cb41
mov eax, dword [ebp - 4]
jmp dword [eax*4 + 0x40d1b4]
push 0x42707c
jmp 0x40d196
push 0x4264b8
jmp 0x40d196
push 0x42650c
jmp 0x40d196
push 0x427078
jmp 0x40d196
mov eax, dword [ebp - 8]
push dword [eax + 0x10ec]
jmp 0x40d0c6
push dword [edi]
push str._.2d
lea eax, [ebp - 0x128]
push eax
call fcn.00417b44
add esp, 0xc
jmp 0x40d18f
push dword [edi + 4]
jmp 0x40cb80
push dword [edi + 8]
jmp 0x40cb80
push dword [edi + 0xc]
jmp 0x40cb80
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x40cb80
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x40cbc2
mov eax, dword [edi + 0x18]
jmp 0x40cbc1
mov eax, dword [edi + 0x1c]
inc eax
push eax
push 0x42706c
jmp 0x40cb85
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00414c81
add esp, 0x14
jmp 0x40d18f
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.CommonFilesDir
jmp 0x40cbdb
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00414c81
lea eax, [ebp - 0x128]
push eax
call fcn.0041517d
add esp, 0x18
jmp 0x40d18f
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.Common_AppData
jmp 0x40cca2
lea eax, [ebp - 0x128]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Desktop
push esi
push 0x80000002
call fcn.00414c81
add esp, 0x14
cmp byte [ebp - 0x128], 0
jne 0x40d18f
lea eax, [ebp - 0x128]
push eax
push edi
push str.Desktop
push esi
jmp 0x40ce2e
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x40cbe0
lea eax, [ebp - 0x128]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Favorites
push esi
push 0x80000002
call fcn.00414c81
add esp, 0x14
cmp byte [ebp - 0x128], 0
jne 0x40d18f
lea eax, [ebp - 0x128]
push eax
push edi
push str.Favorites
jmp 0x40cc8b
lea eax, [ebp - 0x128]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Programs
push esi
push 0x80000002
call fcn.00414c81
add esp, 0x14
cmp byte [ebp - 0x128], 0
jne 0x40d18f
lea eax, [ebp - 0x128]
push eax
push edi
push str.Programs
jmp 0x40cc8b
lea eax, [ebp - 0x128]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Start_Menu
push esi
push 0x80000002
call fcn.00414c81
add esp, 0x14
cmp byte [ebp - 0x128], 0
jne 0x40d18f
lea eax, [ebp - 0x128]
push eax
push edi
push str.Start_Menu
jmp 0x40cc8b
lea eax, [ebp - 0x128]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Startup
push esi
push 0x80000002
call fcn.00414c81
add esp, 0x14
cmp byte [ebp - 0x128], 0
jne 0x40d18f
lea eax, [ebp - 0x128]
push eax
push edi
push str.Startup
jmp 0x40cc8b
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.AppData
jmp 0x40ce29
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.Desktop
jmp 0x40ce29
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.Favorites
jmp 0x40ce29
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.Programs
jmp 0x40ce29
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.Start_Menu
jmp 0x40ce29
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
jmp 0x40cbe5
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
jmp 0x40d18f
lea eax, [ebp - 0x128]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x40d18f
lea eax, [ebp - 0x128]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x40d18f
push 0
jmp 0x40d0c6
push 6
jmp 0x40d0c6
push 3
jmp 0x40d0c6
push 9
jmp 0x40d0c6
push 5
jmp 0x40d0c6
mov eax, dword [ebp - 8]
push dword [eax + 0x30]
jmp 0x40d196
mov eax, dword [ebp - 8]
push dword [eax + 0x24]
jmp 0x40d196
mov eax, dword [ebp - 8]
push dword [eax + 0x3c]
jmp 0x40d196
lea eax, [ebp - 0x128]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x40d18f
cmp byte [0x433c6c], 1
jne 0x40cef1
push str.WIN32_NT
jmp 0x40d196
push str.WIN32_WINDOWS
jmp 0x40d196
mov al, 1
cmp byte [0x433c6c], al
jne 0x40cf33
cmp byte [0x433c70], al
jne 0x40cf17
push str.WIN_XP
jmp 0x40d196
cmp byte [0x433c72], al
jne 0x40cf29
push str.WIN_2000
jmp 0x40d196
push str.WIN_NT4
jmp 0x40d196
cmp byte [0x433c76], al
jne 0x40cf45
push str.WIN_95
jmp 0x40d196
cmp byte [0x433c74], al
jne 0x40cf57
push str.WIN_98
jmp 0x40d196
push str.WIN_ME
jmp 0x40d196
push dword [0x433b68]
jmp 0x40d0c6
push 0x433b6c
jmp 0x40d196
mov al, 1
cmp byte [0x433c6c], al
jne 0x40cfaa
cmp byte [0x433c73], al
lea eax, [ebp - 0x128]
push eax
push 0x104
jne 0x40cf9b
push str.InstallLanguage
jmp 0x40cfa0
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
jmp 0x40cbe0
lea eax, [ebp - 0x128]
push eax
push 0x104
push ebx
push str..DEFAULTControl_PanelDesktopResourceLocale
push 0x80000003
call fcn.00414c81
add esp, 0x14
lea eax, [ebp - 0x124]
jmp 0x40d195
lea eax, [ebp - 0x128]
push 0x105
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0041520e
pop ecx
lea eax, [ebp - 0x24c]
pop ecx
jmp 0x40d195
lea eax, [ebp - 0x1c]
push eax
push 1
jmp 0x40d026
lea eax, [ebp - 0x1c]
push eax
push 2
jmp 0x40d026
lea eax, [ebp - 0x1c]
push eax
push 3
jmp 0x40d026
lea eax, [ebp - 0x1c]
push eax
push 4
call fcn.00415da1
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
jmp 0x40d195
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x13c]
jmp 0x40d0c6
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x40d0c6
lea eax, [ebp - 0x128]
push 0x104
push eax
push str.COMSPEC
jmp 0x40d189
lea eax, [ebp - 0x128]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea eax, [ebp - 0x128]
push eax
call fcn.0041517d
pop ecx
jmp 0x40d18f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x40d18f
push 1
mov ecx, dword [ebp + 0x10]
call fcn.00401aa7
jmp case.default.0x40cb41
lea eax, [ebp - 0x128]
push eax
push 0x104
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00414c81
lea eax, [ebp - 0x128]
push eax
call fcn.00417850
add esp, 0x18
dec eax
js 0x40d10f
cmp byte [ebp + eax - 0x128], 0x5c
jne 0x40d102
and byte [ebp + eax - 0x128], 0
jmp 0x40d18f
lea eax, [ebp - 0x128]
push 0x104
push eax
push str.HOMEDRIVE
jmp 0x40d189
lea eax, [ebp - 0x128]
push 0x104
push eax
push str.HOMEPATH
jmp 0x40d189
lea eax, [ebp - 0x128]
push 0x104
push eax
push str.HOMESHARE
jmp 0x40d189
lea eax, [ebp - 0x128]
push 0x104
push eax
push str.LOGONSERVER
jmp 0x40d189
lea eax, [ebp - 0x128]
push 0x104
push eax
push str.USERDOMAIN
jmp 0x40d189
lea eax, [ebp - 0x128]
push 0x104
push eax
push str.USERDNSDOMAIN
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00401af4
xor esi, esi
lea ecx, [ebp - 0x134]
call fcn.0040107a
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc