Function at 0x41370d
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.0040101d
mov dl, byte [0x43a030]
push 0x41
pop ecx
xor eax, eax
and dword [ebp - 4], eax
lea edi, [ebp - 0x12f]
mov byte [ebp - 0x130], dl
push 0x41
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x253]
mov byte [ebp - 0x254], dl
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004293e4
lea eax, [ebp - 0xc]
push eax
call fcn.0042a3e5
pop ecx
mov edi, eax
pop ecx
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_CharUpperA]
mov ebx, dword [ebp - 0x28]
mov dword [ebp + 8], 0x435800
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call fcn.00428f30
pop ecx
test eax, eax
pop ecx
je 0x41379d
inc dword [ebp - 4]
add dword [ebp + 8], 4
cmp dword [ebp + 8], 0x435940
jl 0x41377c
mov eax, dword [ebp - 4]
cmp eax, 0x50
jne 0x41381f
push 0x436164
lea ecx, [ebp - 0x13c]
call fcn.0040101d
and byte [ebp + 0xb], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x13c]
call fcn.004011a5
xor esi, esi
lea eax, [ebp + 0xb]
push esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x13c]
sub esp, 0xc
mov ecx, esp
push eax
call fcn.00401073
mov ecx, 0x43cd30
call fcn.00427d22
cmp dword [ebp - 4], esi
jne 0x4137f8
push 1
pop esi
jmp 0x413803
push dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
call fcn.00402148
push dword [ebp - 0x13c]
call fcn.00428f1b
push dword [ebp - 0x28]
call fcn.00428f1b
pop ecx
mov eax, esi
pop ecx
jmp 0x413f77
cmp eax, 0x4f
ja case.default.0x413828
jmp dword [eax*4 + 0x413f7e]
push 0x436160
jmp 0x413ccd
push 0x4352c0
jmp 0x413ccd
push 0x435358
jmp 0x413ccd
push 0x43615c
jmp 0x413ccd
push dword [esi + 0x164]
jmp 0x413f64
push dword [esi + 0x168]
jmp 0x413f64
push dword [edi]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.00429357
add esp, 0xc
jmp 0x413cc6
push dword [edi + 4]
jmp 0x41386f
push dword [edi + 8]
jmp 0x41386f
push dword [edi + 0xc]
jmp 0x41386f
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x41386f
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x413f5b
mov eax, dword [edi + 0x18]
inc eax
jmp 0x413f5b
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x413874
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x413cb9
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.CommonFilesDir
jmp 0x4138d1
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00425ff9
lea eax, [ebp - 0x130]
push eax
call fcn.0042653e
add esp, 0x18
jmp 0x413cc6
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.Common_AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x413cb9
lea eax, [ebp - 0x130]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Desktop
push esi
push 0x80000002
call fcn.00425ff9
add esp, 0x14
cmp byte [ebp - 0x130], 0
jne 0x413cc6
lea eax, [ebp - 0x130]
push eax
push edi
push str.Desktop
push esi
push 0x80000001
jmp 0x413cbe
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.Common_Documents
jmp 0x413933
lea eax, [ebp - 0x130]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Favorites
push esi
push 0x80000002
call fcn.00425ff9
add esp, 0x14
cmp byte [ebp - 0x130], 0
jne 0x413cc6
lea eax, [ebp - 0x130]
push eax
push edi
push str.Favorites
jmp 0x41397c
lea eax, [ebp - 0x130]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Programs
push esi
push 0x80000002
call fcn.00425ff9
add esp, 0x14
cmp byte [ebp - 0x130], 0
jne 0x413cc6
lea eax, [ebp - 0x130]
push eax
push edi
push str.Programs
jmp 0x41397c
lea eax, [ebp - 0x130]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Start_Menu
push esi
push 0x80000002
call fcn.00425ff9
add esp, 0x14
cmp byte [ebp - 0x130], 0
jne 0x413cc6
lea eax, [ebp - 0x130]
push eax
push edi
push str.Start_Menu
jmp 0x41397c
lea eax, [ebp - 0x130]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Startup
push esi
push 0x80000002
call fcn.00425ff9
add esp, 0x14
cmp byte [ebp - 0x130], 0
jne 0x413cc6
lea eax, [ebp - 0x130]
push eax
push edi
push str.Startup
jmp 0x41397c
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.AppData
jmp 0x413b17
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.Desktop
jmp 0x413b17
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.Favorites
jmp 0x413b17
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.Programs
jmp 0x413b17
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.Start_Menu
jmp 0x413b17
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x41397d
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
jmp 0x413cc6
lea eax, [ebp - 0x130]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x413cc6
lea eax, [ebp - 0x130]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x413cc6
push 0
jmp 0x413f64
push 6
jmp 0x413f64
push 9
jmp 0x413f64
push 5
jmp 0x413f64
push 0xa
jmp 0x413f64
push 3
jmp 0x413f64
push 2
jmp 0x413f64
push 7
jmp 0x413f64
push 8
jmp 0x413f64
push 4
jmp 0x413f64
push pe_nt_image_headers32
jmp 0x413f64
push 0x41
jmp 0x413f64
push dword [esi + 0x6c]
jmp 0x413ccd
push dword [esi + 0x60]
jmp 0x413ccd
push dword [esi + 0x78]
jmp 0x413ccd
lea eax, [ebp - 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x413cc6
cmp byte [0x44002c], 1
jne 0x413c02
push str.WIN32_NT
jmp 0x413ccd
push str.WIN32_WINDOWS
jmp 0x413ccd
mov al, 1
cmp byte [0x44002c], al
jne 0x413c53
cmp byte [0x440034], al
jne 0x413c28
push str.WIN_2003
jmp 0x413ccd
cmp byte [0x440030], al
jne 0x413c3a
push str.WIN_XP
jmp 0x413ccd
cmp byte [0x440032], al
jne 0x413c4c
push str.WIN_2000
jmp 0x413ccd
push str.WIN_NT4
jmp 0x413ccd
cmp byte [0x440038], al
jne 0x413c62
push str.WIN_95
jmp 0x413ccd
cmp byte [0x440036], al
jne 0x413c71
push str.WIN_98
jmp 0x413ccd
push str.WIN_ME
jmp 0x413ccd
push dword [0x43ff28]
jmp 0x413f64
push 0x43ff2c
jmp 0x413ccd
mov al, 1
cmp byte [0x44002c], al
jne 0x413cda
cmp byte [0x440033], al
lea eax, [ebp - 0x130]
push eax
push 0x104
jne 0x413caf
push str.InstallLanguage
jmp 0x413cb4
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push 0x80000002
call fcn.00425ff9
add esp, 0x14
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004022ff
jmp case.default.0x413828
lea eax, [ebp - 0x130]
push eax
push 0x104
push 0x43a030
push str..DEFAULTControl_PanelDesktopResourceLocale
push 0x80000003
call fcn.00425ff9
add esp, 0x14
lea eax, [ebp - 0x12c]
jmp 0x413ccc
lea eax, [ebp - 0x130]
push 0x105
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.004265c7
pop ecx
lea eax, [ebp - 0x254]
pop ecx
jmp 0x413ccc
lea eax, [ebp - 0x130]
push 0x105
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
jmp 0x413cc6
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.00427157
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
jmp 0x413ccc
lea eax, [ebp - 0x1c]
push eax
push 2
jmp 0x413d55
lea eax, [ebp - 0x1c]
push eax
push 3
jmp 0x413d55
lea eax, [ebp - 0x1c]
push eax
push 4
jmp 0x413d55
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x144]
jmp 0x413f64
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x140]
jmp 0x413f64
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0xc
jmp 0x413de2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x74
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0040228c
push edi
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x413828
lea eax, [ebp - 0x130]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
jmp 0x413cc6
lea eax, [ebp - 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea eax, [ebp - 0x130]
push eax
call fcn.0042653e
pop ecx
jmp 0x413cc6
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x413cc6
push 1
jmp 0x413f64
cmp byte [0x44002c], 0
je 0x413e7f
lea eax, [ebp - 0x130]
push 0x104
push eax
push str.USERPROFILE
jmp 0x413e10
lea eax, [ebp - 0x130]
push eax
push 0x104
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00425ff9
lea eax, [ebp - 0x130]
push eax
call fcn.00428ea0
add esp, 0x18
dec eax
js 0x413ebb
cmp byte [ebp + eax - 0x130], 0x5c
jne 0x413eae
and byte [ebp + eax - 0x130], 0
jmp 0x413cc6
lea eax, [ebp - 0x130]
push 0x104
push eax
push str.HOMEDRIVE
jmp 0x413e10
lea eax, [ebp - 0x130]
push 0x104
push eax
push str.HOMEPATH
jmp 0x413e10
lea eax, [ebp - 0x130]
push 0x104
push eax
push str.HOMESHARE
jmp 0x413e10
lea eax, [ebp - 0x130]
push 0x104
push eax
push str.LOGONSERVER
jmp 0x413e10
lea eax, [ebp - 0x130]
push 0x104
push eax
push str.USERDOMAIN
jmp 0x413e10
lea eax, [ebp - 0x130]
push 0x104
push eax
push str.USERDNSDOMAIN
jmp 0x413e10
push dword [esi + 0x11c]
jmp 0x413f64
movzx eax, byte [esi + 0x118]
push eax
jmp 0x413f64
push dword [esi + 0x16c]
mov ecx, dword [ebp + 0xc]
call fcn.0040228c
push dword [ebp - 0x28]
call fcn.00428f1b
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8