Function at 0x1400475d8
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Initialize winsock library
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x7a0
mov rbx, rcx
mov rsi, r8
mov r15, rdx
mov edi, 0x208
lea rcx, [rsp + 0xc2]
xor r14d, r14d
mov r8, rdi
xor edx, edx
mov word [rsp + 0xc0], r14w
call fcn.1400761e0
lea rcx, [rsp + 0x3f2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x3f0], r14w
call fcn.1400761e0
mov r13, qword [r15]
mov ebp, r14d
lea r12, str.ERROR
lea edi, [r14 + 1]
mov rcx, qword [r12]
mov rdx, r13
call fcn.140076450
cmp eax, r14d
je 0x14004766a
lea rax, [0x1400a7770]
add r12, 8
add ebp, edi
cmp r12, rax
jl 0x140047647
cmp ebp, 0x60
jne 0x1400476e8
lea rdx, [0x14009cbf8]
lea rcx, [rsp + 0x98]
call fcn.140001d54
lea rcx, [rsp + 0x98]
mov rdx, r15
mov dword [rsp + 0x7f8], r14d
call fcn.140005264
lea r9, [rsp + 0x7f8]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x98]
lea rcx, [0x1400bceb8]
mov dword [rsp + 0x20], r14d
call fcn.140013d44
mov rdx, qword [rsp + 0x30]
cmp rdx, r14
je 0x1400476d6
mov rcx, rsi
call fcn.140017b30
mov edi, r14d
lea rcx, [rsp + 0x98]
call fcn.140001e50
jmp 0x140048067
cmp ebp, 0x5f
ja case.default.0x140047705
lea rdx, [0x140000000]
movsxd rax, ebp
mov ecx, dword [rdx + rax*4 + 0x48180]
add rcx, rdx
jmp rcx
lea rdx, [0x14009cc54]
mov rcx, rsi
call fcn.140017fc0
jmp case.default.0x140047705
lea rdx, reloc.WSOCK32.dll_inet_addr
jmp 0x14004770e
lea rdx, [0x1400981e4]
jmp 0x14004770e
lea rdx, reloc.WSOCK32.dll_htons
jmp 0x14004770e
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
cmp byte [rcx + rbx + 0x19], r14b
je 0x14004774f
mov rax, qword [rcx + rbx + 0x10]
mov rcx, qword [rax + 0x30]
jmp 0x140047754
mov rcx, qword [rcx + rbx + 0x10]
mov edx, dword [rcx + 0x1c]
jmp 0x14004805c
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
cmp byte [rcx + rbx + 0x19], r14b
je 0x140047775
mov rax, qword [rcx + rbx + 0x10]
mov rcx, qword [rax + 0x30]
jmp 0x14004777a
mov rcx, qword [rcx + rbx + 0x10]
mov edx, dword [rcx + 0x24]
jmp 0x14004805c
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rsp + 0x2de]
lea rdx, str._.3d
lea rcx, [rsp + 0xc0]
call fcn.14007659c
lea rdx, [rsp + 0xc0]
jmp 0x14004770e
xor ecx, ecx
call fcn.14007911c
lea r8, [0x14009cc6c]
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x7f8]
mov qword [rsp + 0x7f8], rax
call fcn.14004697c
mov rcx, rsi
mov rdx, rax
call fcn.14001800c
lea rcx, [rsp + 0x2e0]
call fcn.140001e50
jmp case.default.0x140047705
xor ecx, ecx
call fcn.14007911c
lea r8, [0x14009cc74]
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14004697c
mov rcx, rsi
mov rdx, rax
call fcn.14001800c
lea rcx, [rsp + 0x380]
jmp 0x1400477f8
xor ecx, ecx
call fcn.14007911c
lea r8, [0x14009cc7c]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], rax
call fcn.14004697c
mov rcx, rsi
mov rdx, rax
call fcn.14001800c
lea rcx, [rsp + 0x320]
jmp 0x1400477f8
xor ecx, ecx
call fcn.14007911c
lea r8, [0x1400981dc]
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rax
call fcn.14004697c
mov rcx, rsi
mov rdx, rax
call fcn.14001800c
lea rcx, [rsp + 0x360]
jmp 0x1400477f8
xor ecx, ecx
call fcn.14007911c
lea r8, [0x14009cc84]
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
call fcn.14004697c
mov rcx, rsi
mov rdx, rax
call fcn.14001800c
lea rcx, [rsp + 0x3a0]
jmp 0x1400477f8
xor ecx, ecx
call fcn.14007911c
lea r8, [0x14009cc8c]
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
call fcn.14004697c
mov rcx, rsi
mov rdx, rax
call fcn.14001800c
lea rcx, [rsp + 0x340]
jmp 0x1400477f8
xor ecx, ecx
call fcn.14007911c
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x3c0]
mov qword [rsp + 0x80], rax
call fcn.14007bac4
cmp eax, r14d
jne 0x140047972
mov r8d, dword [rsp + 0x3d8]
inc r8d
jmp 0x140047975
mov r8d, r14d
lea rdx, [0x1400981dc]
jmp 0x1400477a0
xor ecx, ecx
call fcn.14007911c
lea r8, [0x14009cc94]
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.14004697c
mov rcx, rsi
mov rdx, rax
call fcn.14001800c
lea rcx, [rsp + 0x300]
jmp 0x1400477f8
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroyData
lea rax, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x1400477ad
mov edx, 0x2b
jmp 0x1400479c3
mov edx, 5
jmp 0x1400479c3
mov edx, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
jmp 0x1400479c3
mov edx, 0x19
jmp 0x1400479c3
mov edx, 0x2e
jmp 0x1400479c3
mov edx, SafeArrayAllocDescriptor
jmp 0x1400479c3
mov edx, reloc.WSOCK32.dll_socket
jmp 0x1400479c3
mov edx, SafeArrayGetElement
jmp 0x1400479c3
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x1400479c3
mov edx, 0x1a
jmp 0x1400479c3
mov edx, reloc.WSOCK32.dll_recv
jmp 0x1400479c3
mov edx, 6
jmp 0x1400479c3
mov edx, 2
jmp 0x1400479c3
mov edx, reloc.WSOCK32.dll_inet_ntoa
jmp 0x1400479c3
mov edx, 7
jmp 0x1400479c3
lea rdx, [rsp + 0x7e8]
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x7e8], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x1400477ad
lea rcx, [rsp + 0xc0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1400477ad
mov rax, qword [0x1400bd8b8]
cmp byte [rax + 0x3e], r14b
je 0x140047af4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
cmp rax, r14
je 0x140047ac7
lea rdx, str.GetSystemWow64DirectoryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r14
jne 0x140047ace
lea rax, [fcn.140007c50]
lea rcx, [rsp + 0xc0]
mov edx, 0x104
call rax
cmp rbx, r14
je 0x1400477ad
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400477ad
lea rcx, [rsp + 0xc0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1400477ad
xor edx, edx
jmp 0x14004805c
mov edx, 6
jmp 0x14004805c
mov edx, 3
jmp 0x14004805c
mov edx, 9
jmp 0x14004805c
mov edx, 5
jmp 0x14004805c
mov edx, 0xa
jmp 0x14004805c
mov edx, 2
jmp 0x14004805c
mov edx, 7
jmp 0x14004805c
mov edx, 8
jmp 0x14004805c
mov edx, 4
jmp 0x14004805c
cmp byte [0x1400aa61a], dil
mov rcx, rsi
jne 0x140047b80
mov edx, edi
jmp 0x14004805f
xor edx, edx
jmp 0x14004805f
cmp byte [0x1400bbb5d], dil
jmp 0x140047b74
mov edx, 0x40
jmp 0x14004805c
mov edx, 0x41
jmp 0x14004805c
mov edx, 0x42
jmp 0x14004805c
mov edx, 0x43
jmp 0x14004805c
mov rdx, qword [rbx + 0x170]
jmp 0x14004770e
mov rdx, qword [rbx + 0x150]
jmp 0x14004770e
mov rdx, qword [rbx + 0x190]
jmp 0x14004770e
mov edx, dword [rbx + 0x1c0]
lea rcx, [0x1400bcef0]
call fcn.14000ad6c
mov edx, eax
jmp 0x14004805c
lea rdx, [rsp + 0xc0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x1400477ad
mov rax, qword [0x1400bd8b8]
movzx ecx, word [rax + 0x40]
cmp ecx, r14d
je 0x140047c46
cmp ecx, 6
je 0x140047c3a
cmp ecx, 9
mov rcx, rsi
jne 0x140047d10
lea rdx, [0x14009ccb8]
jmp 0x140047711
lea rdx, str.IA64
jmp 0x14004770e
lea rdx, [0x14009cca0]
jmp 0x14004770e
call fcn.1400750b0
lea rcx, [0x14009ccb8]
lea rdx, [0x14009cca0]
cmp al, r14b
cmovne rdx, rcx
jmp 0x14004770e
lea rdx, str.WIN32_NT
jmp 0x14004770e
mov rax, qword [0x1400bd8b8]
cmp byte [rax + 0x3c], dil
jne 0x140047c96
lea rdx, str.WIN_2008R2
jmp 0x14004770e
cmp byte [rax + 0x3a], dil
jne 0x140047ca8
lea rdx, str.WIN_7
jmp 0x14004770e
cmp byte [rax + 0x38], dil
jne 0x140047cba
lea rdx, str.WIN_2008
jmp 0x14004770e
cmp byte [rax + 0x36], dil
jne 0x140047ccc
lea rdx, str.WIN_VISTA
jmp 0x14004770e
cmp byte [rax + 0x34], dil
jne 0x140047cde
lea rdx, str.WIN_2003
jmp 0x14004770e
cmp byte [rax + 0x32], dil
jne 0x140047cfb
cmp byte [rax + 0x42], r14b
lea rcx, str.WIN_XPe
lea rdx, str.WIN_XP
jmp 0x140047c68
mov rcx, rsi
cmp byte [rax + 0x30], dil
jne 0x140047d10
lea rdx, str.WIN_2000
jmp 0x140047711
lea rdx, str.UNKNOWN
jmp 0x140047711
mov rax, qword [0x1400bd8b8]
mov edx, dword [rax + 8]
jmp 0x14004805c
mov rdx, qword [0x1400bd8b8]
mov rcx, rsi
add rdx, 0x10
call fcn.14001800c
jmp case.default.0x140047705
lea rax, [rsp + 0xc0]
lea r8, str.InstallLanguage
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400113b0
jmp 0x1400477ad
lea rax, [rsp + 0xc0]
lea r8, str.SchemeLangID
lea rdx, str.Control_PanelAppearance
mov r9d, 0x104
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.1400113b0
movzx ecx, word [rsp + 0xc0]
lea rdx, [rsp + 0xc0]
mov r8d, 4
mov dword [rsp + 0x7e8], ecx
call fcn.1400135f4
jmp 0x1400477ad
lea rcx, [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rsp + 0x98]
jmp 0x14004770e
lea rdx, [0x14009ce58]
lea rcx, [rsp + 0x3f0]
call fcn.140075b0c
lea rcx, [rsp + 0x3f0]
mov ebp, r14d
call fcn.140075704
test eax, eax
jle 0x140047e5b
lea rbx, [rsp + 0x3f0]
lea r13, [rsp + 0x3f0]
mov r12d, 0x2e
movzx eax, word [r13]
cmp ax, 0x20
je 0x140047e42
add ebp, edi
cmp ax, 0x2c
jne 0x140047e3b
mov word [rbx], r12w
jmp 0x140047e3e
mov word [rbx], ax
add rbx, 2
lea rcx, [rsp + 0x3f0]
add r14d, edi
add r13, 2
call fcn.140075704
cmp r14d, eax
jl 0x140047e22
movsxd rax, ebp
xor r14d, r14d
lea rdx, [rsp + 0x3f0]
mov word [rsp + rax*2 + 0x3f0], r14w
jmp 0x14004770e
lea rdx, [rsp + 0xc0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x1400477ad
lea rdx, [rsp + 0x600]
mov ecx, 0x101
call sub.WSOCK32.dll_WSAStartup
cmp eax, r14d
jne 0x140047eb7
mov ecx, edi
lea rdx, [rsp + 0x38]
call fcn.140012a5c
jmp 0x140047ec8
lea rdx, [0x1400956d0]
lea rcx, [rsp + 0x38]
call fcn.140075b0c
lea rdx, [rsp + 0x38]
jmp 0x14004770e
lea rdx, [rsp + 0x600]
mov ecx, 0x101
call sub.WSOCK32.dll_WSAStartup
cmp eax, r14d
jne 0x140047eb7
mov ecx, 2
jmp 0x140047eab
lea rdx, [rsp + 0x600]
mov ecx, 0x101
call sub.WSOCK32.dll_WSAStartup
cmp eax, r14d
jne 0x140047eb7
mov ecx, 3
jmp 0x140047eab
lea rdx, [rsp + 0x600]
mov ecx, 0x101
call sub.WSOCK32.dll_WSAStartup
cmp eax, r14d
jne 0x140047eb7
mov ecx, 4
jmp 0x140047eab
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rsp + 0x68]
jmp 0x14004805c
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rsp + 0x6c]
jmp 0x14004805c
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, listen
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, rsi
mov edx, eax
call fcn.140017da8
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x140047705
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
jmp 0x140047f80
lea rcx, str.COMSPEC
lea rdx, [rsp + 0xc0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x1400477ad
lea rdx, [rsp + 0xc0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0xc0]
call fcn.140075704
sub rax, rdi
cmp word [rsp + rax*2 + 0xc0], 0x5c
jne 0x1400477ad
mov word [rsp + rax*2 + 0xc0], r14w
jmp 0x1400477ad
lea rdx, [rsp + 0x7e8]
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x7e8], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x1400477ad
mov eax, dword [0x1400bb0c8]
cmp eax, 3
je case.0x140047705.43
cmp eax, 4
jne case.0x140047705.30
mov edx, edi
mov rcx, rsi
call fcn.140017da8
mov edi, r14d
mov rcx, r15
call fcn.140001e50
mov rbx, qword [rsp + 0x7e0]
mov eax, edi
add rsp, 0x7a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.USERPROFILE
jmp 0x140047fc7
lea rcx, str.HOMEDRIVE
jmp 0x140047fc7
lea rcx, str.HOMEPATH
jmp 0x140047fc7
lea rcx, str.HOMESHARE
jmp 0x140047fc7
lea rcx, str.LOGONSERVER
jmp 0x140047fc7
lea rcx, str.USERDOMAIN
jmp 0x140047fc7
lea rcx, str.USERDNSDOMAIN
jmp 0x140047fc7
mov rax, qword [rbx + 8]
cmp rax, r14
je 0x1400480f4
mov rcx, qword [rax]
mov edx, dword [rcx + 0x10]
jmp 0x14004805c
or edx, 0xffffffff
jmp 0x14004805c
mov rax, qword [rbx]
mov rcx, qword [rax + 0x190]
cmp rcx, r14
je 0x14004811e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, r14d
cmp eax, r14d
sete cl
jmp 0x140048121
mov ecx, r14d
cmp cl, r14b
je 0x140048132
mov rbx, qword [rbx + 8]
cmp rbx, r14
jne 0x1400480fc
mov dil, r14b
mov rcx, rsi
call fcn.14001739c
mov dword [rsi + 8], 9
mov byte [rsi], dil
jmp case.default.0x140047705
mov edx, dword [rbx + 0x23c]
jmp 0x14004805c
mov rdx, qword [rbx + 0x240]
jmp 0x14004770e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rsi
mov r11d, eax
pxor xmm1, xmm1
cvtsi2sd xmm1, r11
call fcn.140017f90
jmp case.default.0x140047705