Function at 0x1400126f0
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x2f0
mov r12, rdx
movaps xmmword [rax - 0x48], xmm6
mov rbx, rcx
xor r15d, r15d
mov edx, 0x104
mov word [rbp - 0x30], r15w
lea rcx, [rsp + 0x30]
mov r14, r8
call fcn.1400090f0
mov r13, qword [r12]
lea rsi, str.ERROR
mov edi, r15d
mov rcx, qword [rsi]
mov rdx, r13
call fcn.140027b40
mov r8d, 1
test eax, eax
je 0x14001276a
add edi, r8d
lea rax, [0x1400c5728]
add rsi, 8
cmp rsi, rax
jl 0x140012742
cmp edi, 0x61
je 0x14005c3b8
cmp edi, 0x60
ja case.0x14001278c.88
lea rdx, [0x140000000]
movsxd rax, edi
mov ecx, dword [rdx + rax*4 + 0x127fc]
add rcx, rdx
jmp rcx
lea rdx, [rbx + 0x190]
mov rcx, r14
call fcn.14000c280
lea rcx, [rsp + 0x30]
call fcn.1400079ac
lea r11, [rsp + 0x2f0]
mov eax, r15d
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x1400b886c]
mov rcx, r14
call fcn.14000c2f0
jmp case.0x14001278c.88
lea rdx, [rbx + 0x170]
jmp 0x140012795
mov rcx, r14
call fcn.14000c050
mov eax, 1
mov dword [r14 + 0x10], eax
mov dword [r14], eax
jmp case.0x14001278c.88
lea rdx, [0x1400dccd8]
lea rcx, [rbp - 0x58]
call fcn.1400094fc
mov rdx, r12
lea rcx, [rbp - 0x58]
call fcn.1400091f4
xor r9d, r9d
mov dword [rbp + 0x248], r15d
lea r8, [rbp + 0x248]
lea rdx, [rbp - 0x58]
call fcn.1400230dc
test rax, rax
jne 0x14005c3f9
or r15d, 0xffffffff
jmp 0x14005c404
mov rdx, rax
mov rcx, r14
call fcn.14000c720
lea rcx, [rbp - 0x58]
jmp 0x14005c52d
lea rdx, [0x1400dcd34]
jmp 0x1400127d1
lea rdx, [0x1400c2a98]
jmp 0x1400127d1
lea rdx, reloc.WSOCK32.dll_htons
jmp 0x1400127d1
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
mov rax, qword [rcx + rbx + 0x10]
cmp byte [rcx + rbx + 0x19], r15b
je 0x14005c448
mov rax, qword [rax + 0x48]
mov ebx, dword [rax + 0x1c]
jmp 0x14005c453
mov ebx, dword [rbx + 0x23c]
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], ebx
jmp case.0x14001278c.88
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
mov rdx, qword [rcx + rbx + 0x10]
cmp byte [rcx + rbx + 0x19], r15b
je 0x14005c482
mov rdx, qword [rdx + 0x48]
add rdx, 0x28
mov rcx, r14
call fcn.14000c720
nop
jmp case.0x14001278c.88
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rsp + 0x5e]
lea rdx, str._.3d
jmp 0x14005c4b8
mov r8d, r15d
lea rdx, [0x1400dc030]
lea rcx, [rbp - 0x30]
call fcn.140024b1c
jmp 0x14005c4de
lea rdx, [rbp + 0x238]
mov dword [rbp + 0x238], 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp - 0x30]
jmp 0x1400127d1
xor ecx, ecx
call fcn.140032d2c
lea r8, [0x1400dcd4c]
jmp 0x14005c505
xor ecx, ecx
call fcn.140032d2c
lea r8, [0x1400dcd74]
lea rdx, [rsp + 0x50]
mov qword [rbp + 0x248], rax
lea rcx, [rbp + 0x248]
call fcn.14009a1d8
mov rdx, rax
mov rcx, r14
call fcn.14000c280
lea rcx, [rsp + 0x50]
call fcn.1400079ac
nop
jmp case.0x14001278c.88
xor ecx, ecx
call fcn.140032d2c
lea r8, [0x1400dcd54]
jmp 0x14005c505
xor ecx, ecx
call fcn.140032d2c
lea r8, [0x1400dcd5c]
jmp 0x14005c505
xor ecx, ecx
call fcn.140032d2c
lea r8, [0x1400dc030]
jmp 0x14005c505
xor ecx, ecx
call fcn.140032d2c
lea r8, [0x1400dcd64]
jmp 0x14005c505
xor ecx, ecx
call fcn.140032d2c
lea r8, [0x1400dcd6c]
jmp 0x14005c505
xor ecx, ecx
call fcn.140032d2c
lea rdx, [rsp + 0x50]
mov qword [rbp + 0x248], rax
lea rcx, [rbp + 0x248]
call fcn.14009a250
test rax, rax
je 0x14005c4ae
mov r8d, dword [rax + 0x18]
inc r8d
jmp 0x14005c4b1
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroyData
jmp 0x14005c5cb
mov ecx, 7
lea rdx, [rsp + 0x30]
call fcn.14007ba14
jmp 0x14005c5e1
lea rcx, [rsp + 0x30]
call fcn.1400238e8
lea rdx, [rsp + 0x30]
jmp 0x140012795
mov ecx, 0x2b
jmp 0x14005c5cb
mov ecx, 5
jmp 0x14005c5cb
mov ecx, SafeArrayRedim
jmp 0x14005c5cb
mov ecx, 0x19
jmp 0x14005c5cb
mov ecx, 0x2e
jmp 0x14005c5cb
mov ecx, reloc.OLEAUT32.dll_CreateStdDispatch
jmp 0x14005c5cb
mov ecx, reloc.WSOCK32.dll_socket
jmp 0x14005c5cb
mov ecx, socket
jmp 0x14005c5cb
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x14005c5cb
mov ecx, RegisterActiveObject
jmp 0x14005c5cb
mov ecx, 0x1a
jmp 0x14005c5cb
mov ecx, reloc.WSOCK32.dll_recv
jmp 0x14005c5cb
mov ecx, 6
jmp 0x14005c5cb
mov ecx, 2
jmp 0x14005c5cb
mov ecx, reloc.WSOCK32.dll_inet_ntoa
jmp 0x14005c5cb
lea rdx, [rbp + 0x238]
mov dword [rbp + 0x238], 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x14005c4de
mov edx, 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je case.0x14001278c.88
jmp 0x14005c4de
cmp byte [0x1400ef408], r15b
je 0x14005c6f2
lea rcx, [0x1400b53a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14005c6c9
lea rdx, str.GetSystemWow64DirectoryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14005c6d0
lea rax, [fcn.140024b6c]
mov edx, 0x104
lea rcx, [rbp - 0x30]
call rax
test rbx, rbx
je 0x14005c4de
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14005c4de
mov edx, 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x14005c4de
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], r15d
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 6
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 3
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 9
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 5
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 0xa
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 2
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 7
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 8
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 4
jmp case.0x14001278c.88
cmp byte [0x1400ef35c], r8b
jmp 0x14005c82a
cmp byte [0x1400efe3d], r8b
mov ebx, r15d
sete bl
jmp 0x14005c453
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 0x40
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 0x41
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 0x42
jmp case.0x14001278c.88
mov rcx, r14
call fcn.14000c050
mov dword [r14 + 0x10], 1
mov dword [r14], 0x43
jmp case.0x14001278c.88
lea rdx, [rbx + 0x150]
jmp 0x140012795
mov edx, dword [rbx + 0x1c0]
call fcn.140076620
mov ebx, eax
jmp 0x14005c453
lea rdx, [rbp - 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x14005c4de
movzx eax, word [0x1400ef40a]
test eax, eax
je 0x14005c90d
cmp eax, 6
je 0x14005c901
cmp eax, 9
lea rdx, str.UNKNOWN
lea rcx, [0x1400dcd98]
cmove rdx, rcx
jmp 0x1400127d1
lea rdx, str.IA64
jmp 0x1400127d1
lea rdx, [0x1400dcd80]
jmp 0x1400127d1
xor ecx, ecx
mov eax, 0x80000001
cpuid
bt edx, 0x1d
lea rcx, [0x1400dcd98]
lea rdx, [0x1400dcd80]
cmovae rcx, rdx
mov rdx, rcx
jmp 0x1400127d1
lea rdx, str.WIN32_NT
jmp 0x1400127d1
cmp byte [0x1400ef404], r8b
jne 0x14005c961
lea rdx, str.WIN_10
jmp 0x1400127d1
cmp byte [0x1400ef406], r8b
jne 0x14005c976
lea rdx, str.WIN_2016
jmp 0x1400127d1
cmp byte [0x1400ef400], r8b
jne 0x14005c98b
lea rdx, str.WIN_81
jmp 0x1400127d1
cmp byte [0x1400ef402], r8b
jne 0x14005c9a0
lea rdx, str.WIN_2012R2
jmp 0x1400127d1
cmp byte [0x1400ef3fe], r8b
jne 0x14005c9b5
lea rdx, str.WIN_2012
jmp 0x1400127d1
cmp byte [0x1400ef3fc], r8b
jne 0x14005c9ca
lea rdx, str.WIN_8
jmp 0x1400127d1
cmp byte [0x1400ef3fa], r8b
jne 0x14005c9df
lea rdx, str.WIN_2008R2
jmp 0x1400127d1
cmp byte [0x1400ef3f8], r8b
jne 0x14005c9f4
lea rdx, str.WIN_7
jmp 0x1400127d1
cmp byte [0x1400ef3f6], r8b
jne 0x14005ca09
lea rdx, str.WIN_2008
jmp 0x1400127d1
cmp byte [0x1400ef3f4], r8b
jne 0x14005ca1e
lea rdx, str.WIN_VISTA
jmp 0x1400127d1
cmp byte [0x1400ef3f2], r8b
jne 0x14005ca33
lea rdx, str.WIN_2003
jmp 0x1400127d1
cmp byte [0x1400ef3f0], r8b
jne 0x14005ca5a
cmp byte [0x1400ef40c], r15b
lea rdx, str.WIN_XPe
lea rax, str.WIN_XP
cmove rdx, rax
jmp 0x1400127d1
lea rdx, str.UNKNOWN
jmp 0x1400127d1
mov ebx, dword [0x1400ef3c8]
jmp 0x14005c453
lea rdx, [0x1400ef3d0]
jmp 0x140012795
lea rax, [rbp - 0x30]
mov r9d, 0x104
lea r8, str.InstallLanguage
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
mov rcx, 0xffffffff80000002
call fcn.140001324
jmp 0x14005c4de
lea rax, [rbp - 0x30]
mov r9d, 0x104
lea r8, str.SchemeLangID
mov qword [rsp + 0x20], rax
lea rdx, str.Control_PanelAppearance
mov rcx, 0xffffffff80000001
call fcn.140001324
movzx ecx, word [rbp - 0x30]
lea rdx, [rbp - 0x30]
mov r8d, 4
mov dword [rbp + 0x238], ecx
call fcn.140022e80
jmp 0x14005c4de
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rbp - 0x58]
jmp 0x1400127d1
lea rdx, str.3__3__15__1
lea rcx, [rbp - 0x30]
call fcn.140027300
lea rcx, [rbp - 0x30]
mov ebx, r15d
mov r13d, r15d
call fcn.1400272dc
test eax, eax
jle 0x14005cb6e
mov rdi, r15
lea r12, [rbp - 0x30]
mov esi, 0x2e
movzx eax, word [r12]
mov rcx, rdi
cmp ax, 0x20
je 0x14005cb59
inc ebx
inc rdi
cmp ax, 0x2c
jne 0x14005cb54
mov word [rbp + rcx*2 - 0x30], si
jmp 0x14005cb59
mov word [rbp + rcx*2 - 0x30], ax
lea rcx, [rbp - 0x30]
inc r13d
add r12, 2
call fcn.1400272dc
cmp r13d, eax
jl 0x14005cb34
movsxd rax, ebx
mov word [rbp + rax*2 - 0x30], r15w
jmp 0x14005c4de
mov ecx, r8d
jmp 0x14005cb86
mov ecx, 4
lea rdx, [rbp - 0x78]
call fcn.14007b914
lea rdx, [rbp - 0x78]
jmp 0x1400127d1
mov ecx, 2
jmp 0x14005cb86
mov ecx, 3
jmp 0x14005cb86
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rbp - 0x80]
jmp 0x14005c453
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rbp - 0x7c]
jmp 0x14005c453
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_ioctlsocket
jmp 0x14005cc0e
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, r14
mov ebx, eax
call fcn.14000c050
mov rdx, rdi
mov dword [r14 + 0x10], 1
mov rcx, rsi
mov dword [r14], ebx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
jmp case.0x14001278c.88
lea rcx, str.COMSPEC
jmp 0x14005cc51
lea rcx, str.USERDNSDOMAIN
lea rdx, [rbp - 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x14005c4de
lea rdx, [rbp - 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp - 0x30]
call fcn.140024520
jmp 0x14005c4de
mov eax, dword [0x1400ef450]
mov ebx, r15d
add eax, 0xfffffffd
cmp eax, r8d
setbe bl
jmp 0x14005c453
lea rcx, str.USERPROFILE
jmp 0x14005cc51
lea rcx, str.HOMEDRIVE
jmp 0x14005cc51
lea rcx, str.HOMEPATH
jmp 0x14005cc51
lea rcx, str.HOMESHARE
jmp 0x14005cc51
lea rcx, str.LOGONSERVER
jmp 0x14005cc51
lea rcx, str.USERDOMAIN
jmp 0x14005cc51
lea rdx, [rbx + 0x240]
jmp 0x140012795
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
xorps xmm6, xmm6
mov rcx, r14
cvtsi2sd xmm6, rax
call fcn.14000c050
mov dword [r14 + 0x10], 3
movsd qword [r14], xmm6
jmp case.0x14001278c.88