Function at 0x42e007
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov esi, 0x104
xor ebx, ebx
push esi
mov edi, eax
lea eax, [ebp - 0x12f]
push ebx
push eax
mov byte [ebp - 0x130], bl
call fcn.0044fdd0
add esp, 0xc
push esi
lea eax, [ebp - 0x24f]
push ebx
push eax
mov byte [ebp - 0x250], bl
call fcn.0044fdd0
lea eax, [ebp - 0x148]
add esp, 0xc
push eax
mov dword [ebp - 4], ebx
call fcn.00451757
pop ecx
lea eax, [ebp - 0x148]
push eax
call fcn.0045218b
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x471b30]
call fcn.0044d5b0
test eax, eax
pop ecx
pop ecx
je 0x42e08b
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5b
jl 0x42e06a
mov eax, dword [ebp - 4]
cmp eax, 0x5b
jne 0x42e0ed
push 0x46c100
lea esi, [ebp - 0x18]
call fcn.0040daad
lea eax, [ebp + 8]
mov edi, esi
mov dword [ebp - 8], ebx
call fcn.0040dc14
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea esi, [ebp - 8]
call fcn.0040d892
cmp dword [ebp - 4], ebx
jne 0x42e0de
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
call fcn.0044d0f0
pop ecx
push dword [ebp + 8]
call fcn.0044d0f0
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
call fcn.0040f6ba
xor ebx, ebx
jmp 0x42e0c3
cmp eax, 0x5a
ja case.default.0x42e0f2
jmp dword [eax*4 + 0x42ec3b]
push 0x46c130
mov edi, dword [ebp + 0x14]
call fcn.0040f933
jmp case.default.0x42e0f2
push 0x469398
jmp 0x42e0fe
push 0x469b38
jmp 0x42e0fe
push 0x46c134
jmp 0x42e0fe
push dword [edi + 0x254]
jmp 0x42eadc
push dword [edi + 0x258]
jmp 0x42eadc
mov eax, dword [ebp - 8]
push dword [eax]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.0044d7ab
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
jmp 0x42e0fe
mov eax, dword [ebp - 8]
push dword [eax + 4]
jmp 0x42e138
mov eax, dword [ebp - 8]
push dword [eax + 8]
jmp 0x42e138
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
jmp 0x42e138
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
inc eax
push eax
jmp 0x42e138
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
jmp 0x42eadc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
inc eax
jmp 0x42e182
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x42e13d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42e14c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.CommonFilesDir
jmp 0x42e1d6
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e271
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Personal
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x130]
call fcn.0040ba97
jmp 0x42e14c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_AppData
jmp 0x42e1d6
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e309
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
jmp 0x42e1d6
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Documents
jmp 0x42e1d6
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e3d8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Favorites
jmp 0x42e1d6
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e468
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Programs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Programs
jmp 0x42e1d6
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e4f8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Start_Menu
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Start_Menu
jmp 0x42e1d6
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e588
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Startup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Startup
jmp 0x42e1d6
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.AppData
jmp 0x42e1d6
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e31d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e3ec
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e47c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e50c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e59c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
jmp 0x42e14c
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x42e14c
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x42e14c
push 6
jmp 0x42eadc
push 3
jmp 0x42eadc
push 9
jmp 0x42eadc
push 5
jmp 0x42eadc
push 0xa
jmp 0x42eadc
push 2
jmp 0x42eadc
push 7
jmp 0x42eadc
push 8
jmp 0x42eadc
push 4
jmp 0x42eadc
push 1
jmp 0x42eadc
cmp byte [0x47354e], 1
mov esi, dword [ebp + 0x14]
jne 0x42e6fb
push 1
jmp 0x42eadf
push ebx
jmp 0x42eadf
cmp byte [0x47ded1], 1
jmp 0x42e6ef
push 0x40
jmp 0x42eadc
push 0x41
jmp 0x42eadc
push 0x42
jmp 0x42eadc
push 0x43
jmp 0x42eadc
push dword [edi + 0x168]
jmp 0x42e0fe
push dword [edi + 0x15c]
jmp 0x42e0fe
push dword [edi + 0x174]
jmp 0x42e0fe
mov ecx, dword [edi + 0x18c]
call fcn.00406175
jmp 0x42e182
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x42e14c
mov eax, dword [0x47d654]
mov ecx, eax
dec ecx
je 0x42e79b
dec ecx
je 0x42e791
dec ecx
je 0x42e787
neg eax
push eax
push str.UNKN_d
jmp 0x42e13d
push 0x46c2a8
jmp 0x42e0fe
push str.IA64
jmp 0x42e0fe
push 0x46c29c
jmp 0x42e0fe
cmp byte [0x47d63c], 1
mov edi, dword [ebp + 0x14]
jne 0x42e7bb
push str.WIN32_NT
jmp 0x42e101
push str.WIN32_WINDOWS
jmp 0x42e101
cmp byte [0x47d63c], 1
jne 0x42e83a
cmp byte [0x47d642], 1
jne 0x42e7e1
push str.WIN_LONGHORN
jmp 0x42e0fe
cmp byte [0x47d648], 1
jne 0x42e7f4
push str.WIN_VISTA
jmp 0x42e0fe
cmp byte [0x47d646], 1
jne 0x42e807
push str.WIN_2003
jmp 0x42e0fe
cmp byte [0x47d640], 1
jne 0x42e81a
push str.WIN_XP
jmp 0x42e0fe
cmp byte [0x47d644], 1
mov edi, dword [ebp + 0x14]
jne 0x42e830
push str.WIN_2000
jmp 0x42e101
push str.WIN_NT4
jmp 0x42e101
cmp byte [0x47d64c], 1
jne 0x42e84d
push str.WIN_95
jmp 0x42e0fe
cmp byte [0x47d64a], 1
mov edi, dword [ebp + 0x14]
jne 0x42e863
push str.WIN_98
jmp 0x42e101
push str.WIN_ME
jmp 0x42e101
push dword [0x47d538]
jmp 0x42eadc
push 0x47d53c
jmp 0x42e0fe
cmp byte [0x47d63c], 1
lea eax, [ebp - 4]
push eax
push 1
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
push ebx
jne 0x42e8f8
cmp byte [0x47d645], 1
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
jne 0x42e8d3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.InstallLanguage
jmp 0x42e1d6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Default
jmp 0x42e1d6
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e930
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push 0x468eee
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x12c]
jmp 0x42e152
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x18]
jmp 0x42e152
lea eax, [ebp - 0x250]
push str.3__2__8__0
push eax
call fcn.0044cf30
lea eax, [ebp - 0x250]
push eax
xor esi, esi
xor edi, edi
call fcn.0044d720
add esp, 0xc
test eax, eax
jle 0x42e9a8
mov al, byte [ebp + edi - 0x250]
cmp al, 0x20
je 0x42e996
cmp al, 0x2c
jne 0x42e98e
mov byte [ebp + esi - 0x250], 0x2e
jmp 0x42e995
mov byte [ebp + esi - 0x250], al
inc esi
lea eax, [ebp - 0x250]
push eax
inc edi
call fcn.0044d720
cmp edi, eax
pop ecx
jl 0x42e975
mov byte [ebp + esi - 0x250], bl
lea eax, [ebp - 0x250]
jmp 0x42e152
push esi
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
jmp 0x42e14c
lea eax, [ebp - 0x28]
xor esi, esi
push eax
inc esi
call fcn.0040c89f
pop ecx
lea eax, [ebp - 0x28]
jmp 0x42e152
lea eax, [ebp - 0x28]
push eax
push 2
pop esi
jmp 0x42e9d5
lea eax, [ebp - 0x28]
push eax
push 3
jmp 0x42e9e9
lea eax, [ebp - 0x28]
push eax
push 4
jmp 0x42e9e9
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x42eadc
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x134]
jmp 0x42eadc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.0040f86e
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x42e0f2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x42ea4b
push esi
lea eax, [ebp - 0x130]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
jmp 0x42e14c
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x42e271
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x42e14c
mov eax, dword [0x47d670]
cmp eax, 2
je case.0x42e0f2.42
cmp eax, 3
je case.0x42e0f2.42
push ebx
mov esi, dword [ebp + 0x14]
call fcn.0040f86e
jmp case.default.0x42e0f2
cmp byte [0x47d63c], bl
je 0x42eb00
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERPROFILE
jmp 0x42ea8d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eb48
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130]
push eax
call fcn.0044d720
pop ecx
jmp 0x42eb61
cmp byte [ebp + eax - 0x130], 0x5c
je 0x42eb64
dec eax
jns 0x42eb57
mov byte [ebp + eax - 0x130], bl
jmp 0x42e14c
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEDRIVE
jmp 0x42ea8d
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEPATH
jmp 0x42ea8d
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMESHARE
jmp 0x42ea8d
push esi
lea eax, [ebp - 0x130]
push eax
push str.LOGONSERVER
jmp 0x42ea8d
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDOMAIN
jmp 0x42ea8d
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDNSDOMAIN
jmp 0x42ea8d
push dword [edi + 0x21c]
jmp 0x42eadc
movzx eax, byte [edi + 0x218]
jmp 0x42e182
push dword [edi + 0x25c]
jmp 0x42eadc
push dword [edi + 0x260]
jmp 0x42e0fe
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x42ec1f
fadd qword [0x46c960]
mov esi, dword [ebp + 0x14]
push ecx
push ecx
fstp qword [esp]
call fcn.0040f91a
jmp case.default.0x42e0f2
push 0x5780000
jmp 0x42eadc