Function at 0x41cf92
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Query environment variable

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x284
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor eax, eax
push 0x104
lea ecx, [ebp - 0x18]
mov word [ebp - 0x280], ax
call fcn.00406270
xor eax, eax
mov dword [ebp - 0x1c], eax
mov edi, eax
mov eax, dword [ebx + 8]
mov esi, dword [eax]
push esi
push dword [edi*4 + 0x4b1a00]
call fcn.00425232
pop ecx
pop ecx
test eax, eax
je 0x41cfee
inc edi
cmp edi, 0x61
jl 0x41cfd5
mov esi, dword [ebp - 4]
cmp edi, 0x61
je 0x45d159
cmp edi, 0x60
ja case.0x41cfff.88
jmp dword [edi*4 + 0x41d062]
lea eax, [esi + 0xd8]
push eax
mov ecx, dword [ebx + 0xc]
call fcn.004062b5
xor edi, edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x18]
call fcn.0040988f
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push 0x49cc80
mov ecx, dword [ebx + 0xc]
call fcn.00409c6e
jmp case.0x41cfff.88
lea eax, [esi + 0xc8]
jmp 0x41d00c
mov esi, dword [ebx + 0xc]
mov ecx, esi
call fcn.0040cfa0
xor edi, edi
mov dword [esi + 0xc], 1
mov dword [esi], edi
jmp 0x41d017
push 0x4c733c
lea ecx, [ebp - 0x2c]
call fcn.00409cb3
push dword [ebx + 8]
lea ecx, [ebp - 0x2c]
call fcn.00406350
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0041d2f0
test eax, eax
jne 0x45d18e
or dword [ebp - 0x1c], 0xffffffff
jmp 0x45d197
mov ecx, dword [ebx + 0xc]
push eax
call fcn.0040aceb
lea ecx, [ebp - 0x2c]
call fcn.0040988f
jmp 0x41d01a
push 0x4c7394
jmp 0x41d036
push 0x4af368
jmp 0x41d036
push 0x4c7398
jmp 0x41d036
mov eax, dword [esi]
mov eax, dword [eax + 4]
cmp byte [eax + esi + 0xd], 0
mov edi, dword [eax + esi + 8]
je 0x45d1d5
mov edi, dword [edi + 0x38]
mov edi, dword [edi + 0x14]
jmp 0x45d1e0
mov edi, dword [esi + 0x150]
mov esi, dword [ebx + 0xc]
mov ecx, esi
call fcn.0040cfa0
mov dword [esi + 0xc], 1
mov dword [esi], edi
jmp case.0x41cfff.88
mov eax, dword [esi]
mov eax, dword [eax + 4]
cmp byte [eax + esi + 0xd], 0
mov ecx, dword [eax + esi + 8]
je 0x45d20b
mov ecx, dword [ecx + 0x38]
lea eax, [ecx + 0x20]
mov ecx, dword [ebx + 0xc]
push eax
call fcn.0040aceb
jmp case.0x41cfff.88
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x1e]
push eax
push 0x4c739c
jmp 0x45d247
lea ecx, [ebp - 8]
call fcn.00487585
mov ecx, eax
call fcn.00487528
push eax
push 0x4c672c
lea eax, [ebp - 0x280]
push eax
call fcn.0041fb21
jmp 0x45d275
lea eax, [ebp - 0x280]
mov edx, str.SYSTEMCurrentControlSetControlNlsLanguage
push eax
push 0x104
push str.InstallLanguage
mov ecx, reloc.WSOCK32.dll_bind
call fcn.00403b1c
add esp, 0xc
jmp 0x45d292
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x104
push eax
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x280]
jmp 0x45d2a8
xor ecx, ecx
inc ecx
lea edx, [ebp - 0x60]
call fcn.0046de27
lea eax, [ebp - 0x60]
push eax
jmp 0x41d036
push 0x4c73a8
jmp 0x45d2ba
push 0x4c73d0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
call fcn.00487585
mov ecx, eax
call fcn.004874cd
mov ecx, dword [ebx + 0xc]
push eax
call fcn.004062b5
lea ecx, [ebp - 0x2c]
call fcn.0040988f
jmp case.0x41cfff.88
push 0x4c73b0
jmp 0x45d2ba
push 0x4c73b8
jmp 0x45d2ba
push 0x4c672c
jmp 0x45d2ba
push 0x4c73c0
jmp 0x45d2ba
push 0x4c73c8
jmp 0x45d2ba
push 0x26
jmp 0x45d30c
push 7
lea edx, [ebp - 0x18]
pop ecx
call fcn.0046df27
jmp 0x45d31f
lea ecx, [ebp - 0x18]
call fcn.00403a5a
lea eax, [ebp - 0x18]
jmp 0x41d00c
push 0x2b
jmp 0x45d30c
push 5
jmp 0x45d30c
push 0x23
jmp 0x45d30c
push 0x19
jmp 0x45d30c
push 0x2e
jmp 0x45d30c
push 0x1f
jmp 0x45d30c
push 0x17
jmp 0x45d30c
push 0x16
jmp 0x45d30c
push 0x18
jmp 0x45d30c
push 0x1c
jmp 0x45d30c
push 0x1a
jmp 0x45d30c
push 0x10
jmp 0x45d30c
push 6
jmp 0x45d30c
push 2
jmp 0x45d30c
push 0xb
jmp 0x45d30c
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x104
push eax
lea eax, [ebp - 0x280]
push eax
invalid
invalid
invalid