Function at 0x42fa2f
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
and word [ebp - 0x268], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, 0x208
push ebx
mov esi, eax
lea eax, [ebp - 0x266]
push 0
push eax
call fcn.00451700
and word [ebp - 0x478], 0
add esp, 0xc
push ebx
lea eax, [ebp - 0x476]
push 0
push eax
call fcn.00451700
and dword [ebp - 4], 0
lea eax, [ebp - 0x48]
add esp, 0xc
push eax
call fcn.00453e41
pop ecx
lea eax, [ebp - 0x48]
push eax
call fcn.004547b7
pop ecx
mov ebx, eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x477a18]
call fcn.004518ea
test eax, eax
pop ecx
pop ecx
je 0x42fab4
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5c
jl 0x42fa93
cmp dword [ebp - 4], 0x5c
jne 0x42fb19
push 0x4716fc
lea esi, [ebp - 0x1c]
call fcn.0040ffd4
and dword [ebp - 0xc], 0
lea eax, [ebp + 8]
mov ecx, esi
call fcn.004101eb
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea esi, [ebp - 0xc]
lea edi, [ebp - 0x1c]
call fcn.0040fdbf
cmp dword [ebp - 4], 0
jne 0x42fb0a
xor esi, esi
inc esi
push dword [ebp - 0x1c]
call fcn.0044f951
pop ecx
push dword [ebp + 8]
call fcn.0044f951
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
call fcn.00412760
xor esi, esi
jmp 0x42faef
cmp dword [ebp - 4], 0x5b
ja case.default.0x42fb26
mov eax, dword [ebp - 4]
jmp dword [eax*4 + 0x430357]
push 0x471754
call fcn.004129d9
jmp case.default.0x42fb26
push 0x46c758
jmp 0x42fb32
push 0x46d1e0
jmp 0x42fb32
push 0x471758
jmp 0x42fb32
lea eax, [esi + 0x320]
call fcn.0041c916
push dword [eax + 0x14]
jmp 0x43020f
lea eax, [esi + 0x320]
call fcn.0041c916
push dword [eax + 0x1c]
jmp 0x43020f
push dword [ebx]
push 0x47175c
lea eax, [ebp - 0x268]
push eax
call fcn.00451a06
add esp, 0xc
lea eax, [ebp - 0x268]
push eax
jmp 0x42fb32
push dword [ebx + 4]
jmp 0x42fb79
push dword [ebx + 8]
jmp 0x42fb79
push dword [ebx + 0xc]
jmp 0x42fb79
mov eax, dword [ebx + 0x10]
inc eax
push eax
jmp 0x42fb79
mov eax, dword [ebx + 0x14]
add eax, 0x76c
push eax
jmp 0x43020f
mov eax, dword [ebx + 0x18]
inc eax
jmp 0x42fbb4
mov eax, dword [ebx + 0x1c]
inc eax
push eax
push 0x471768
jmp 0x42fb7e
push 0x104
push 0x471774
push 0x471798
push 0x80000002
lea esi, [ebp - 0x268]
call fcn.0040d871
add esp, 0x10
jmp 0x42fb8d
push 0x104
push 0x4717ec
jmp 0x42fbd6
push 0x104
push 0x47180c
push 0x471820
push 0x80000001
lea esi, [ebp - 0x268]
call fcn.0040d871
add esp, 0x10
lea esi, [ebp - 0x268]
call fcn.0040df37
jmp 0x42fb8d
push 0x104
push 0x4718a4
push 0x471820
jmp 0x42fbdb
mov ebx, 0x104
push ebx
push 0x4718c4
mov edi, 0x471820
push edi
push 0x80000002
lea esi, [ebp - 0x268]
call fcn.0040d871
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42fc87
push ebx
push 0x4718e4
push edi
push 0x80000001
lea esi, [ebp - 0x268]
call fcn.0040d871
add esp, 0x10
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x268]
push eax
jmp 0x42fb32
push 0x104
push 0x4718f4
jmp 0x42fc38
mov ebx, 0x104
push ebx
push 0x471918
mov edi, 0x471820
push edi
push 0x80000002
lea esi, [ebp - 0x268]
call fcn.0040d871
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42fc87
push ebx
push 0x47193c
jmp 0x42fc73
mov ebx, 0x104
push ebx
push 0x471950
mov edi, 0x471820
push edi
push 0x80000002
lea esi, [ebp - 0x268]
call fcn.0040d871
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42fc87
push ebx
push 0x471970
jmp 0x42fc73
mov ebx, 0x104
push ebx
push 0x471984
mov edi, 0x471820
push edi
push 0x80000002
lea esi, [ebp - 0x268]
call fcn.0040d871
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42fc87
push ebx
push 0x4719a8
jmp 0x42fc73
mov ebx, 0x104
push ebx
push 0x4719c0
mov edi, 0x471820
push edi
push 0x80000002
lea esi, [ebp - 0x268]
call fcn.0040d871
add esp, 0x10
cmp word [ebp - 0x268], 0
jne 0x42fc87
push ebx
push 0x4719e0
jmp 0x42fc73
push 0x104
push 0x4719f0
push 0x471820
push 0x80000001
jmp 0x42fbe0
push 0x104
push 0x4718e4
jmp 0x42fd95
push 0x104
push 0x47193c
jmp 0x42fd95
push 0x104
push 0x471970
jmp 0x42fd95
push 0x104
push 0x4719a8
jmp 0x42fd95
push 0x104
push 0x4719e0
jmp 0x42fd95
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x268]
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x42fb8d
push 0x104
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x42fb8d
push 0x104
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x42fb8d
push 6
jmp 0x43020f
push 3
jmp 0x43020f
push 9
jmp 0x43020f
push 5
jmp 0x43020f
push 0xa
jmp 0x43020f
push 2
jmp 0x43020f
push 7
jmp 0x43020f
push 8
jmp 0x43020f
push 4
jmp 0x43020f
push 1
jmp 0x43020f
xor eax, eax
inc eax
cmp byte [0x4795be], al
mov esi, edi
jne 0x42fe84
push eax
jmp 0x430211
push 0
jmp 0x430211
xor eax, eax
inc eax
cmp byte [0x48aaf9], al
jmp 0x42fe7a
push 0x40
jmp 0x43020f
push 0x41
jmp 0x43020f
push 0x42
jmp 0x43020f
push 0x43
jmp 0x43020f
push dword [esi + 0x260]
jmp 0x42fb32
push dword [esi + 0x254]
jmp 0x42fb32
push dword [esi + 0x26c]
jmp 0x42fb32
mov ecx, dword [esi + 0x284]
call fcn.004084da
jmp 0x42fbb4
lea eax, [ebp - 0x268]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x42fb8d
mov eax, dword [0x48a304]
mov ecx, eax
dec ecx
je 0x42ff2b
dec ecx
je 0x42ff21
dec ecx
je 0x42ff17
neg eax
push eax
push 0x471a1c
jmp 0x42fb7e
push 0x471a14
jmp 0x42fb32
push 0x471a08
jmp 0x42fb32
push 0x471a00
jmp 0x42fb32
cmp byte [0x48a2ec], 1
jne 0x42ff48
push 0x471a2c
jmp 0x42fb32
push 0x471a40
jmp 0x42fb32
xor eax, eax
inc eax
cmp byte [0x48a2ec], al
jne 0x42ffc1
cmp byte [0x48a2f2], al
jne 0x42ff6f
push 0x471a5c
jmp 0x42fb32
cmp byte [0x48a2f8], al
jne 0x42ff81
push 0x471a70
jmp 0x42fb32
cmp byte [0x48a2f6], al
jne 0x42ff93
push 0x471a84
jmp 0x42fb32
cmp byte [0x48a2f0], al
jne 0x42ffa5
push 0x471a98
jmp 0x42fb32
cmp byte [0x48a2f4], al
jne 0x42ffb7
push 0x471aa8
jmp 0x42fb32
push 0x471abc
jmp 0x42fb32
cmp byte [0x48a2fc], al
jne 0x42ffd3
push 0x471acc
jmp 0x42fb32
cmp byte [0x48a2fa], al
jne 0x42ffe5
push 0x471adc
jmp 0x42fb32
push 0x471aec
jmp 0x42fb32
push dword [0x48a0e8]
jmp 0x43020f
push 0x48a0ec
jmp 0x42fb32
xor eax, eax
inc eax
cmp byte [0x48a2ec], al
push 0x104
lea esi, [ebp - 0x268]
jne 0x43003d
cmp byte [0x48a2f5], al
jne 0x430029
push 0x471afc
jmp 0x43002e
push 0x46d4b0
push 0x471b20
push 0x80000002
jmp 0x42fbe6
push 0x46bf80
push 0x471b80
push 0x80000003
call fcn.0040d871
add esp, 0x10
lea eax, [ebp - 0x260]
jmp 0x42fb93
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x20]
jmp 0x42fb93
lea eax, [ebp - 0x478]
push 0x471bdc
push eax
call fcn.0044f86d
lea eax, [ebp - 0x478]
push eax
xor esi, esi
xor ebx, ebx
call fcn.0045177a
add esp, 0xc
test eax, eax
jle 0x4300d4
movzx eax, word [ebp + ebx*2 - 0x478]
cmp ax, 0x20
je 0x4300c2
cmp ax, 0x2c
jne 0x4300b9
mov word [ebp + esi*2 - 0x478], 0x2e
jmp 0x4300c1
mov word [ebp + esi*2 - 0x478], ax
inc esi
lea eax, [ebp - 0x478]
push eax
inc ebx
call fcn.0045177a
cmp ebx, eax
pop ecx
jl 0x430099
and word [ebp + esi*2 - 0x478], 0
lea eax, [ebp - 0x478]
jmp 0x42fb93
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x42fb8d
lea eax, [ebp - 0x40]
push eax
xor eax, eax
inc eax
call fcn.0040ee2c
pop ecx
lea eax, [ebp - 0x40]
jmp 0x42fb93
lea eax, [ebp - 0x40]
push eax
push 2
pop eax
jmp 0x430108
lea eax, [ebp - 0x40]
push eax
push 3
jmp 0x43011c
lea eax, [ebp - 0x40]
push eax
push 4
jmp 0x43011c
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x50]
jmp 0x43020f
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x4c]
jmp 0x43020f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [ebp + 0x14], eax
call dword [0x4670f8]
push eax
mov esi, edi
call fcn.00412914
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x42fb26
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x430172
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x471000
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x42fb8d
lea eax, [ebp - 0x268]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x42fc1e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x268]
push eax
mov dword [ebp - 8], 0x104
call dword [0x467014]
jmp 0x42fb8d
mov eax, dword [0x48a324]
cmp eax, 2
je case.0x42fb26.42
cmp eax, 3
je case.0x42fb26.42
push 0
mov esi, edi
call fcn.00412914
xor esi, esi
jmp 0x42faf8
cmp byte [0x48a2ec], 0
push 0x104
je 0x43023c
lea eax, [ebp - 0x268]
push eax
push 0x471bf8
jmp 0x4301b7
push 0x4718e4
push 0x471820
push 0x80000001
lea esi, [ebp - 0x268]
call fcn.0040d871
mov eax, esi
push eax
call fcn.0045177a
add esp, 0x14
jmp 0x43026e
cmp word [ebp + eax*2 - 0x268], 0x5c
je 0x430271
dec eax
jns 0x430263
and word [ebp + eax*2 - 0x268], 0
jmp 0x42fb8d
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x470fa0
jmp 0x4301b7
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x470f8c
jmp 0x4301b7
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x470f78
jmp 0x4301b7
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x470f60
jmp 0x4301b7
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x471c10
jmp 0x4301b7
push 0x104
lea eax, [ebp - 0x268]
push eax
push 0x471c28
jmp 0x4301b7
push dword [esi + 0x310]
jmp 0x43020f
movzx eax, byte [esi + 0x30c]
jmp 0x42fbb4
push dword [esi + 0x340]
jmp 0x43020f
push dword [esi + 0x344]
jmp 0x42fb32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
mov dword [ebp + 0x14], eax
fild dword [ebp + 0x14]
jge 0x430346
fadd qword [0x4726a8]
push ecx
push ecx
mov esi, edi
fstp qword [esp]
call fcn.004129c0
jmp case.default.0x42fb26