Function at 0x4338df
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
mov eax, 0x455584
call fcn.00454158
sub esp, 0x260
push ebx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 0x1c]
mov ebx, ecx
call fcn.00413053
and dword [ebp - 4], 0
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x13c], 0
lea edi, [ebp - 0x13b]
rep stosd dword es:[edi], eax
push 0x41
mov byte [ebp - 0x26c], al
pop ecx
lea edi, [ebp - 0x26b]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
xor esi, esi
call fcn.00448932
lea eax, [ebp - 0x20]
push eax
call fcn.0044896b
pop ecx
pop ecx
push dword [ebp - 0x18]
mov edi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push dword [ebp - 0x1c]
push dword [esi*4 + 0x462f10]
call fcn.004464a0
test eax, eax
pop ecx
pop ecx
je 0x433967
inc esi
cmp esi, 0x59
jl 0x43394c
cmp esi, 0x59
jne 0x4339f1
push 0x45c198
lea esi, [ebp - 0x148]
call fcn.00413053
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004131a6
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
sub esp, 0xc
lea edi, [ebp - 0x148]
mov esi, esp
mov dword [ebp - 0x24], esp
call fcn.004130a3
mov ebx, 0x46fd54
call fcn.00412e06
cmp dword [ebp - 0x10], 0
jne 0x4339c1
xor esi, esi
inc esi
jmp 0x4339ce
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
call fcn.00414e9c
xor esi, esi
mov byte [ebp - 4], 0
push dword [ebp - 0x148]
call fcn.0044624a
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.0044624a
pop ecx
mov eax, esi
jmp 0x4341e4
cmp esi, 0x58
ja case.default.0x4339fa
jmp dword [esi*4 + 0x4341f7]
push 0x45c168
jmp 0x433ede
push 0x459e50
jmp 0x433ede
push 0x459584
jmp 0x433ede
push 0x45c164
jmp 0x433ede
push dword [ebx + 0x124]
jmp 0x4341ce
push dword [ebx + 0x128]
jmp 0x4341ce
push dword [edi]
push str._.2d
lea eax, [ebp - 0x13c]
push eax
call fcn.00447329
add esp, 0xc
jmp 0x433ed7
push dword [edi + 4]
jmp 0x433a41
push dword [edi + 8]
jmp 0x433a41
push dword [edi + 0xc]
jmp 0x433a41
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x433a41
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x4341cd
mov eax, dword [edi + 0x18]
inc eax
jmp 0x4341cd
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x433a46
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x433b47
push 0x104
push str.CommonFilesDir
jmp 0x433a9c
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x13c]
call fcn.00410b8f
add esp, 0x10
lea esi, [ebp - 0x13c]
call fcn.0041123f
jmp 0x433ed7
push 0x104
push str.Common_AppData
jmp 0x433b42
mov ebx, 0x104
push ebx
push str.Common_Desktop
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x13c]
call fcn.00410b8f
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433ed7
push ebx
push str.Desktop
push edi
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x13c]
jmp 0x433ecf
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x13c]
jmp 0x433eca
mov ebx, 0x104
push ebx
push str.Common_Favorites
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x13c]
call fcn.00410b8f
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433ed7
push ebx
push str.Favorites
jmp 0x433b27
mov ebx, 0x104
push ebx
push str.Common_Programs
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x13c]
call fcn.00410b8f
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433ed7
push ebx
push str.Programs
jmp 0x433b27
mov ebx, 0x104
push ebx
push str.Common_Start_Menu
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x13c]
call fcn.00410b8f
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433ed7
push ebx
push str.Start_Menu
jmp 0x433b27
mov ebx, 0x104
push ebx
push str.Common_Startup
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x13c]
call fcn.00410b8f
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433ed7
push ebx
push str.Startup
jmp 0x433b27
push 0x104
push str.AppData
jmp 0x433c85
push 0x104
push str.Desktop
jmp 0x433c85
push 0x104
push str.Favorites
jmp 0x433c85
push 0x104
push str.Programs
jmp 0x433c85
push 0x104
push str.Start_Menu
jmp 0x433c85
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x433b28
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x433ed7
push 0x104
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x433ed7
push 0x104
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x433ed7
push 6
jmp 0x4341ce
push 9
jmp 0x4341ce
push 5
jmp 0x4341ce
push 0xa
jmp 0x4341ce
push 3
jmp 0x4341ce
push 2
jmp 0x4341ce
push 7
jmp 0x4341ce
push 8
jmp 0x4341ce
push 4
jmp 0x4341ce
cmp byte [0x463aef], 1
jmp 0x433d29
cmp byte [0x46eaa9], 1
mov esi, dword [ebp + 0xc]
jne 0x433d35
push 1
jmp 0x4341d1
push 0
jmp 0x4341d1
push 0x40
jmp 0x4341ce
push 0x41
jmp 0x4341ce
push 0x42
jmp 0x4341ce
push 0x43
jmp 0x4341ce
push dword [ebx + 0x34]
jmp 0x433ede
push dword [ebx + 0x28]
jmp 0x433ede
push dword [ebx + 0x40]
jmp 0x433ede
mov eax, dword [ebx + 0x54]
mov ecx, 0x46fd68
call fcn.0040d107
jmp 0x4341cd
lea eax, [ebp - 0x13c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x433ed7
mov eax, dword [0x46dfec]
mov ecx, eax
dec ecx
je 0x433dca
dec ecx
je 0x433dc0
dec ecx
je 0x433db6
neg eax
push eax
push str.UNKN_d
jmp 0x433a46
push 0x45bfec
jmp 0x433ede
push str.IA64
jmp 0x433ede
push 0x45bff8
jmp 0x433ede
cmp byte [0x46dfd4], 1
mov esi, dword [ebp + 0xc]
jne 0x433dea
push str.WIN32_NT
jmp 0x433ee1
push str.WIN32_WINDOWS
jmp 0x433ee1
mov al, 1
cmp byte [0x46dfd4], al
jne 0x433e62
cmp byte [0x46dfda], al
jne 0x433e10
push str.WIN_LONGHORN
jmp 0x433ede
cmp byte [0x46dfe0], al
jne 0x433e22
push str.WIN_VISTA
jmp 0x433ede
cmp byte [0x46dfde], al
jne 0x433e34
push str.WIN_2003
jmp 0x433ede
cmp byte [0x46dfd8], al
jne 0x433e46
push str.WIN_XP
jmp 0x433ede
cmp byte [0x46dfdc], al
mov esi, dword [ebp + 0xc]
jne 0x433e5b
push str.WIN_2000
jmp 0x433ee1
push str.WIN_NT4
jmp 0x433ee1
cmp byte [0x46dfe4], al
jne 0x433e71
push str.WIN_95
jmp 0x433ede
cmp byte [0x46dfe2], al
mov esi, dword [ebp + 0xc]
jne 0x433e83
push str.WIN_98
jmp 0x433ee1
push str.WIN_ME
jmp 0x433ee1
push dword [0x46ded0]
jmp 0x4341ce
push 0x46ded4
jmp 0x433ede
cmp byte [0x46dfd4], 1
push 0x104
lea esi, [ebp - 0x13c]
jne 0x433eeb
cmp byte [0x46dfdd], 1
jne 0x433ec0
push str.InstallLanguage
jmp 0x433ec5
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
call fcn.00410b8f
add esp, 0x10
lea eax, [ebp - 0x13c]
push eax
mov esi, dword [ebp + 0xc]
call fcn.00415109
jmp case.default.0x4339fa
push 0x459596
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.00410b8f
add esp, 0x10
lea eax, [ebp - 0x138]
jmp 0x433edd
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x164]
jmp 0x433edd
lea eax, [ebp - 0x26c]
push 0x45bef0
push eax
call fcn.00446250
lea eax, [ebp - 0x26c]
push eax
xor esi, esi
xor edi, edi
call fcn.004466d0
add esp, 0xc
test eax, eax
jle 0x433f7a
mov al, byte [ebp + edi - 0x26c]
cmp al, 0x20
je 0x433f68
cmp al, 0x2c
jne 0x433f60
mov byte [ebp + esi - 0x26c], 0x2e
jmp 0x433f67
mov byte [ebp + esi - 0x26c], al
inc esi
lea eax, [ebp - 0x26c]
push eax
inc edi
call fcn.004466d0
cmp edi, eax
pop ecx
jl 0x433f47
mov byte [ebp + esi - 0x26c], 0
lea eax, [ebp - 0x26c]
jmp 0x433edd
push 0x105
lea eax, [ebp - 0x13c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x433ed7
lea eax, [ebp - 0x34]
xor esi, esi
push eax
inc esi
call fcn.00411f89
pop ecx
lea eax, [ebp - 0x34]
jmp 0x433edd
lea eax, [ebp - 0x34]
push eax
push 2
jmp 0x433fd1
lea eax, [ebp - 0x34]
push eax
push 3
jmp 0x433fd1
lea eax, [ebp - 0x34]
push eax
push 4
pop esi
jmp 0x433fad
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x150]
jmp 0x4341ce
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x14c]
jmp 0x4341ce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
jmp 0x434036
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0xc]
push eax
call fcn.00415008
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x4339fa
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x433ed7
lea eax, [ebp - 0x13c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x433ad4
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x433ed7
mov eax, dword [0x46e0a0]
cmp eax, 2
je case.0x4339fa.42
cmp eax, 3
je case.0x4339fa.42
push 0
jmp 0x4341ce
push 1
jmp 0x4341ce
cmp byte [0x46dfd4], 0
push 0x104
je 0x4340de
lea eax, [ebp - 0x13c]
push eax
push str.USERPROFILE
jmp 0x434066
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x13c]
call fcn.00410b8f
mov eax, esi
push eax
call fcn.004466d0
add esp, 0x14
jmp 0x43410f
cmp byte [ebp + eax - 0x13c], 0x5c
je 0x434112
dec eax
jns 0x434105
mov byte [ebp + eax - 0x13c], 0
jmp 0x433ed7
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.HOMEDRIVE
jmp 0x434066
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.HOMEPATH
jmp 0x434066
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.HOMESHARE
jmp 0x434066
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.LOGONSERVER
jmp 0x434066
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.USERDOMAIN
jmp 0x434066
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.USERDNSDOMAIN
jmp 0x434066
push dword [ebx + 0xe4]
jmp 0x4341ce
movzx eax, byte [ebx + 0xe0]
jmp 0x4341cd
push dword [ebx + 0x12c]
jmp 0x4341ce
push dword [ebx + 0x130]
jmp 0x433ede
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov esi, dword [ebp + 0xc]
call fcn.00415008
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.0044624a
xor eax, eax
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8