Function at 0x4705bb
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get program files directory
Get session user name
Get startup folder
Query environment variable

Disassembly:
sub esp, 0x53c
push ebx
push ebp
mov ebp, dword [esp + 0x54c]
push esi
mov esi, dword [esp + 0x54c]
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x72]
push ecx
mov word [esp + 0x74], ax
call fcn.004131f0
add esp, 0xc
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x342]
push eax
mov word [esp + 0x344], dx
call fcn.004131f0
mov ecx, dword [esp + 0x564]
add esp, 0xc
xor edi, edi
mov dword [esp + 0x10], ecx
lea ebx, [edi + 1]
mov edx, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x491950]
push edx
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x47063d
add edi, ebx
cmp edi, 0x60
jl 0x47061d
cmp edi, 0x60
jne 0x4706b8
mov edi, 0x48b7e4
lea esi, [esp + 0x28]
call fcn.00401b70
lea ecx, [esp + 0x558]
push ecx
mov eax, esi
mov dword [esp + 0x14], 0
call fcn.0040c140
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
xor ecx, ecx
call fcn.0040c3e0
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4706a2
mov ecx, esi
call fcn.00402620
lea ecx, [esp + 0x558]
call fcn.00402620
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x53c
ret 0x18
push eax
mov ebx, ebp
call fcn.00409210
lea ecx, [esp + 0x28]
call fcn.00402620
jmp case.0x4706c1.87
cmp edi, 0x5f
ja case.0x4706c1.87
jmp dword [edi*4 + 0x47139f]
mov edi, 0x48b83c
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov edi, 0x484eb0
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov edi, 0x4873d0
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov edi, 0x48b840
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
lea eax, [edx + esi + 4]
call fcn.00404110
mov edi, dword [eax + 0x14]
mov esi, ebp
call fcn.004092c0
mov dword [ebp], edi
jmp 0x47137e
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx + esi + 4]
call fcn.00404110
add eax, 0x20
push eax
mov ebx, ebp
call fcn.00409210
jmp case.0x4706c1.87
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x26]
push eax
push 0x48b844
lea ecx, [esp + 0x70]
push ecx
call fcn.0041353a
add esp, 0xc
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
push 0x48b850
lea edx, [esp + 0x2d0]
push edx
lea eax, [esp + 0x2bc]
push eax
call fcn.00442478
push eax
call fcn.00451d4b
mov edi, eax
mov esi, ebp
call fcn.0040e640
lea ecx, [esp + 0x2cc]
call fcn.00402620
jmp case.0x4706c1.87
push 0x48b858
lea ecx, [esp + 0x280]
push ecx
lea edx, [esp + 0x314]
push edx
call fcn.00442478
push eax
call fcn.00451d4b
mov edi, eax
mov esi, ebp
call fcn.0040e640
lea ecx, [esp + 0x27c]
call fcn.00402620
jmp case.0x4706c1.87
push 0x48b860
lea eax, [esp + 0x2f0]
push eax
lea ecx, [esp + 0x31c]
push ecx
call fcn.00442478
push eax
call fcn.00451d4b
mov edi, eax
mov esi, ebp
call fcn.0040e640
lea ecx, [esp + 0x2ec]
call fcn.00402620
jmp case.0x4706c1.87
push 0x4858dc
lea edx, [esp + 0x290]
push edx
lea eax, [esp + 0x324]
push eax
call fcn.00442478
push eax
call fcn.00451d4b
mov edi, eax
mov esi, ebp
call fcn.0040e640
lea ecx, [esp + 0x28c]
call fcn.00402620
jmp case.0x4706c1.87
push 0x48b868
lea ecx, [esp + 0x2a8]
push ecx
lea edx, [esp + 0x30c]
push edx
call fcn.00442478
push eax
call fcn.00451d4b
mov edi, eax
mov esi, ebp
call fcn.0040e640
lea ecx, [esp + 0x2a4]
call fcn.00402620
jmp case.0x4706c1.87
push 0x48b870
lea eax, [esp + 0x2c0]
push eax
lea ecx, [esp + 0x2a4]
push ecx
call fcn.00442478
push eax
call fcn.00451d4b
mov edi, eax
mov esi, ebp
call fcn.0040e640
lea ecx, [esp + 0x2bc]
call fcn.00402620
jmp case.0x4706c1.87
lea edx, [esp + 0x2fc]
push edx
call fcn.00442478
push eax
call fcn.00451dc7
push eax
push 0x4858dc
lea eax, [esp + 0x70]
push eax
jmp 0x470765
push 0x48b878
lea ecx, [esp + 0x2e0]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00442478
push eax
call fcn.00451d4b
mov edi, eax
mov esi, ebp
call fcn.0040e640
lea ecx, [esp + 0x2dc]
call fcn.00402620
jmp case.0x4706c1.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x1f
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0x16
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x18
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0xb
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x6c]
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
push 0x104
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov ecx, dword [0x4a939c]
cmp byte [ecx + 0x2a], 0
push 0x104
lea edx, [esp + 0x6c]
push edx
je 0x470bf1
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
call fcn.004341b0
call eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004344a0
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 6
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 3
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 9
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 5
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 0xa
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 2
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 7
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 8
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 4
jmp 0x47137e
mov esi, ebp
cmp byte [0x497292], bl
jne 0x471372
call fcn.004092c0
mov dword [ebp], ebx
jmp 0x47137e
mov esi, ebp
cmp byte [0x4a84c1], bl
jne 0x471372
call fcn.004092c0
mov dword [ebp], ebx
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 0x40
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 0x41
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 0x42
jmp 0x47137e
mov esi, ebp
call fcn.004092c0
mov dword [ebp], 0x43
jmp 0x47137e
mov edi, dword [esi + 0xc8]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov edi, dword [esi + 0xb8]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov edi, dword [esi + 0xd8]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov eax, dword [esi + 0xf4]
push eax
call fcn.00437a4d
mov esi, ebp
mov edi, eax
call fcn.004092c0
mov dword [ebp], edi
jmp 0x47137e
lea ecx, [esp + 0x68]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov edx, dword [0x4a939c]
movzx eax, word [edx + 0x2c]
test eax, eax
je 0x470df7
cmp eax, 6
je 0x470dd4
mov ebx, ebp
cmp eax, 9
jne 0x470ec7
mov edi, 0x48b894
call fcn.0040e6d0
jmp case.0x4706c1.87
mov edi, str.IA64
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
call fcn.00410d10
mov edi, 0x48b894
test al, al
jne 0x470771
mov edi, 0x48b880
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov edi, str.WIN32_NT
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
mov eax, dword [0x4a939c]
cmp byte [eax + 0x28], bl
jne 0x470e34
mov edi, str.WIN_2008R2
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
cmp byte [eax + 0x26], bl
jne 0x470e4a
mov edi, str.WIN_7
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
cmp byte [eax + 0x24], bl
jne 0x470e60
mov edi, str.WIN_2008
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
cmp byte [eax + 0x22], bl
jne 0x470e76
mov edi, str.WIN_VISTA
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
cmp byte [eax + 0x20], bl
jne 0x470e8c
mov edi, str.WIN_2003
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
cmp byte [eax + 0x1e], bl
jne 0x470eb1
cmp byte [eax + 0x2e], 0
mov edi, str.WIN_XPe
jne 0x470771
mov edi, str.WIN_XP
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
cmp byte [eax + 0x1c], bl
mov ebx, ebp
jne 0x470ec7
mov edi, str.WIN_2000
call fcn.0040e6d0
jmp case.0x4706c1.87
mov edi, 0x48a258
call fcn.0040e6d0
jmp case.0x4706c1.87
mov eax, dword [0x4a939c]
mov edi, dword [eax + 8]
mov esi, ebp
call fcn.004092c0
mov dword [ebp], edi
jmp 0x47137e
mov edi, dword [0x4a939c]
add edi, 0xc
mov esi, ebp
call fcn.0040e640
jmp case.0x4706c1.87
push 0x104
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
lea esi, [esp + 0x78]
call fcn.0040f110
add esp, 0x10
mov edi, esi
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
push 0x104
push str.SchemeLangID
push str.Control_PanelAppearance
push reloc.WSOCK32.dll_accept
lea esi, [esp + 0x78]
call fcn.0040f110
movzx eax, word [esp + 0x78]
push 4
push esi
push eax
mov dword [esp + 0x30], eax
call fcn.00435eed
add esp, 0x1c
mov edi, esi
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea edx, [esp + 0x324]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea edi, [esp + 0x324]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea eax, [esp + 0x338]
push str.3__3__6__1
push eax
call fcn.00411691
lea ecx, [esp + 0x340]
push ecx
xor esi, esi
xor edi, edi
call fcn.004112d5
add esp, 0xc
test eax, eax
jle 0x470ffe
movzx eax, word [esp + edi*2 + 0x338]
cmp ax, 0x20
je 0x470fe8
cmp ax, 0x2c
jne 0x470fde
mov edx, 0x2e
mov word [esp + esi*2 + 0x338], dx
jmp 0x470fe6
mov word [esp + esi*2 + 0x338], ax
add esi, ebx
lea eax, [esp + 0x338]
push eax
add edi, ebx
call fcn.004112d5
add esp, 4
cmp edi, eax
jl 0x470fbb
xor ecx, ecx
lea edi, [esp + 0x338]
mov ebx, ebp
mov word [esp + esi*2 + 0x338], cx
call fcn.0040e6d0
jmp case.0x4706c1.87
push 0x104
lea edx, [esp + 0x6c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.00436582
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea ecx, [esp + 0x48]
push ecx
push 2
call fcn.00436582
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea edx, [esp + 0x48]
push edx
push 3
call fcn.00436582
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea eax, [esp + 0x48]
push eax
push 4
call fcn.00436582
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x40]
mov esi, ebp
call fcn.004092c0
mov dword [ebp], edi
jmp 0x47137e
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x44]
mov esi, ebp
call fcn.004092c0
mov dword [ebp], edi
jmp 0x47137e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x18], eax
call fcn.004092c0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push ecx
push edi
mov dword [ebp + 8], ebx
mov dword [ebp], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.0x4706c1.87
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x18], eax
call fcn.004092c0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push eax
push edi
mov dword [ebp + 8], ebx
mov dword [ebp], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.0x4706c1.87
push 0x104
lea ecx, [esp + 0x6c]
push ecx
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea edx, [esp + 0x68]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea esi, [esp + 0x68]
call fcn.00410110
mov edi, esi
mov ebx, ebp
call fcn.0040e6d0
jmp case.0x4706c1.87
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x6c]
push ecx
mov dword [esp + 0x1c], 0x104
invalid
invalid
adc al, 0x20