Function at 0x140084700
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5e0
mov rbx, rcx
mov rbp, r8
mov r15, rdx
mov edi, 0x208
lea rcx, [rax - 0x576]
xor r14d, r14d
movaps xmmword [rax - 0x48], xmm6
mov r8, rdi
xor edx, edx
mov word [rax - 0x578], r14w
call fcn.140017520
lea rcx, [rsp + 0x3c2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x3c0], r14w
call fcn.140017520
mov r13, qword [r15]
mov edi, r14d
lea rsi, str.ERROR
lea r12d, [r14 + 1]
mov rcx, qword [rsi]
mov rdx, r13
call fcn.140017790
cmp eax, r14d
je 0x140084796
lea rax, [0x1400af790]
add rsi, 8
add edi, r12d
cmp rsi, rax
jl 0x140084773
cmp edi, 0x60
jne 0x140084814
lea rdx, [0x1400a2e08]
lea rcx, [rsp + 0x80]
call fcn.140001d30
lea rcx, [rsp + 0x80]
mov rdx, r15
mov dword [rsp + 0x638], r14d
call fcn.140004740
lea r9, [rsp + 0x638]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x80]
lea rcx, [0x1400c69c8]
mov dword [rsp + 0x20], r14d
call fcn.140010580
mov rdx, qword [rsp + 0x30]
cmp rdx, r14
je 0x140084802
mov rcx, rbp
call fcn.140007af0
mov r12d, r14d
lea rcx, [rsp + 0x80]
call fcn.140002610
jmp 0x140085129
cmp edi, 0x5f
ja case.0x140084831.87
lea rdx, [0x140000000]
movsxd rax, edi
mov ecx, dword [rdx + rax*4 + 0x851ec]
add rcx, rdx
jmp rcx
lea rdx, [0x1400a2e64]
mov rcx, rbp
call fcn.140012d80
jmp case.0x140084831.87
lea rdx, reloc.WSOCK32.dll_inet_addr
jmp 0x14008483a
lea rdx, [0x14009e46c]
jmp 0x14008483a
lea rdx, reloc.WSOCK32.dll_htons
jmp 0x14008483a
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + rbx + 8]
call fcn.140013b00
mov ebx, dword [rax + 0x1c]
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], ebx
jmp 0x140085122
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + rbx + 8]
call fcn.140013b00
mov rcx, rbp
lea rdx, [rax + 0x28]
call fcn.140007af0
jmp case.0x140084831.87
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rsp + 0x56]
lea rdx, str._.3d
lea rcx, [rsp + 0xa0]
call fcn.1400178dc
lea rdx, [rsp + 0xa0]
jmp 0x14008483a
lea rcx, [rsp + 0x638]
call fcn.14004e4a0
lea r8, [0x1400a2e7c]
lea rdx, [rsp + 0x380]
mov rcx, rax
call fcn.140060cb0
mov rcx, rbp
mov rdx, rax
call fcn.140013120
lea rcx, [rsp + 0x380]
call fcn.140002610
jmp case.0x140084831.87
lea rcx, [rsp + 0x30]
call fcn.14004e4a0
lea r8, [0x1400a2e84]
lea rdx, [rsp + 0x2e0]
mov rcx, rax
call fcn.140060cb0
mov rcx, rbp
mov rdx, rax
call fcn.140013120
lea rcx, [rsp + 0x2e0]
jmp 0x140084911
lea rcx, [rsp + 0x2c0]
call fcn.14004e4a0
lea r8, [0x1400a2e8c]
lea rdx, [rsp + 0x320]
mov rcx, rax
call fcn.140060cb0
mov rcx, rbp
mov rdx, rax
call fcn.140013120
lea rcx, [rsp + 0x320]
jmp 0x140084911
lea rcx, [rsp + 0x2b0]
call fcn.14004e4a0
lea r8, [0x14009c920]
lea rdx, [rsp + 0x3a0]
mov rcx, rax
call fcn.140060cb0
mov rcx, rbp
mov rdx, rax
call fcn.140013120
lea rcx, [rsp + 0x3a0]
jmp 0x140084911
lea rcx, [rsp + 0x2b8]
call fcn.14004e4a0
lea r8, [0x1400a2e94]
lea rdx, [rsp + 0x360]
mov rcx, rax
call fcn.140060cb0
mov rcx, rbp
mov rdx, rax
call fcn.140013120
lea rcx, [rsp + 0x360]
jmp 0x140084911
lea rcx, [rsp + 0x2c8]
call fcn.14004e4a0
lea r8, [0x1400a2e9c]
lea rdx, [rsp + 0x300]
mov rcx, rax
call fcn.140060cb0
mov rcx, rbp
mov rdx, rax
call fcn.140013120
lea rcx, [rsp + 0x300]
jmp 0x140084911
lea rcx, [rsp + 0x2d8]
call fcn.14004e4a0
mov rcx, rax
call fcn.140060d30
lea rdx, [0x14009c920]
mov r8d, eax
jmp 0x1400848c0
lea rcx, [rsp + 0x2d0]
call fcn.14004e4a0
lea r8, [0x1400a2ea4]
lea rdx, [rsp + 0x340]
mov rcx, rax
call fcn.140060cb0
mov rcx, rbp
mov rdx, rax
call fcn.140013120
lea rcx, [rsp + 0x340]
jmp 0x140084911
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroyData
lea rax, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x1400848cd
mov edx, 0x2b
jmp 0x140084aa3
mov edx, 5
jmp 0x140084aa3
mov edx, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
jmp 0x140084aa3
mov edx, 0x19
jmp 0x140084aa3
mov edx, 0x2e
jmp 0x140084aa3
mov edx, SafeArrayAllocDescriptor
jmp 0x140084aa3
mov edx, reloc.WSOCK32.dll_socket
jmp 0x140084aa3
mov edx, SafeArrayUnaccessData
jmp 0x140084aa3
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x140084aa3
mov edx, 0x1a
jmp 0x140084aa3
mov edx, reloc.WSOCK32.dll_recv
jmp 0x140084aa3
mov edx, 6
jmp 0x140084aa3
mov edx, 2
jmp 0x140084aa3
mov edx, reloc.WSOCK32.dll_inet_ntoa
jmp 0x140084aa3
mov edx, 7
jmp 0x140084aa3
lea rdx, [rsp + 0x628]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x628], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x1400848cd
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1400848cd
mov rax, qword [0x1400c88a8]
cmp byte [rax + 0x3e], r14b
je 0x140084baf
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
call fcn.14003dee0
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call rax
lea rcx, [rsp + 0x48]
call fcn.14003df10
jmp 0x1400848cd
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1400848cd
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], r14d
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 6
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 3
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 9
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 5
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 0xa
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 2
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 7
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 8
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 4
jmp 0x140085122
cmp byte [0x1400b549a], r12b
mov rcx, rbp
je 0x140085119
jmp 0x140084bca
cmp byte [0x1400c6b7d], r12b
jmp 0x140084c93
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 0x40
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 0x41
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 0x42
jmp 0x140085122
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], 0x43
jmp 0x140085122
mov rdx, qword [rbx + 0x170]
jmp 0x14008483a
mov rdx, qword [rbx + 0x150]
jmp 0x14008483a
mov rdx, qword [rbx + 0x190]
jmp 0x14008483a
mov edx, dword [rbx + 0x1c0]
lea rcx, [0x1400c7ef0]
call fcn.140042150
mov ebx, eax
jmp 0x140084876
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x1400848cd
mov rax, qword [0x1400c88a8]
movzx ecx, word [rax + 0x40]
cmp ecx, r14d
je 0x140084d88
cmp ecx, 6
je 0x140084d7c
cmp ecx, 9
mov rcx, rbp
jne 0x140084e52
lea rdx, [0x1400a2ec8]
jmp 0x14008483d
lea rdx, str.IA64
jmp 0x14008483a
lea rdx, [0x1400a2eb0]
jmp 0x14008483a
call fcn.1400163f0
lea rdx, [0x1400a2ec8]
lea rcx, [0x1400a2eb0]
cmp al, r14b
cmove rdx, rcx
jmp 0x14008483a
lea rdx, str.WIN32_NT
jmp 0x14008483a
mov rax, qword [0x1400c88a8]
cmp byte [rax + 0x3c], r12b
jne 0x140084dd8
lea rdx, str.WIN_2008R2
jmp 0x14008483a
cmp byte [rax + 0x3a], r12b
jne 0x140084dea
lea rdx, str.WIN_7
jmp 0x14008483a
cmp byte [rax + 0x38], r12b
jne 0x140084dfc
lea rdx, str.WIN_2008
jmp 0x14008483a
cmp byte [rax + 0x36], r12b
jne 0x140084e0e
lea rdx, str.WIN_VISTA
jmp 0x14008483a
cmp byte [rax + 0x34], r12b
jne 0x140084e20
lea rdx, str.WIN_2003
jmp 0x14008483a
cmp byte [rax + 0x32], r12b
jne 0x140084e3d
cmp byte [rax + 0x42], r14b
lea rdx, str.WIN_XPe
lea rcx, str.WIN_XP
jmp 0x140084daa
mov rcx, rbp
cmp byte [rax + 0x30], r12b
jne 0x140084e52
lea rdx, str.WIN_2000
jmp 0x14008483d
lea rdx, str.UNKNOWN
jmp 0x14008483d
mov rax, qword [0x1400c88a8]
mov ebx, dword [rax + 8]
jmp 0x140084876
mov rdx, qword [0x1400c88a8]
mov rcx, rbp
add rdx, 0x10
call fcn.140013120
jmp case.0x140084831.87
lea rax, [rsp + 0xa0]
lea r8, str.InstallLanguage
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.140015de0
jmp 0x1400848cd
lea rax, [rsp + 0xa0]
lea r8, str.SchemeLangID
lea rdx, str.Control_PanelAppearance
mov r9d, 0x104
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.140015de0
movzx ecx, word [rsp + 0xa0]
lea rdx, [rsp + 0xa0]
mov r8d, 4
mov dword [rsp + 0x628], ecx
call fcn.140040110
jmp 0x1400848cd
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rsp + 0x80]
jmp 0x14008483a
lea rdx, str.3__3__6__1
lea rcx, [rsp + 0x3c0]
call fcn.140016e4c
lea rcx, [rsp + 0x3c0]
mov edi, r14d
call fcn.140016a44
test eax, eax
jle 0x140084f9c
lea rbx, [rsp + 0x3c0]
lea r13, [rsp + 0x3c0]
mov esi, 0x2e
movzx eax, word [r13]
cmp ax, 0x20
je 0x140084f83
add edi, r12d
cmp ax, 0x2c
jne 0x140084f7c
mov word [rbx], si
jmp 0x140084f7f
mov word [rbx], ax
add rbx, 2
lea rcx, [rsp + 0x3c0]
add r14d, r12d
add r13, 2
call fcn.140016a44
cmp r14d, eax
jl 0x140084f63
movsxd rax, edi
xor r14d, r14d
lea rdx, [rsp + 0x3c0]
mov word [rsp + rax*2 + 0x3c0], r14w
jmp 0x14008483a
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x1400848cd
mov ecx, r12d
lea rdx, [rsp + 0x60]
call fcn.1400408d0
lea rdx, [rsp + 0x60]
jmp 0x14008483a
mov ecx, 2
jmp 0x140084fd6
mov ecx, 3
jmp 0x140084fd6
mov ecx, 4
jmp 0x140084fd6
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x40]
jmp 0x140084876
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x44]
jmp 0x140084876
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, listen
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, rbp
mov ebx, eax
call fcn.140007a40
mov rdx, rdi
mov rcx, rsi
mov dword [rbp + 8], r12d
mov dword [rbp], ebx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp case.0x140084831.87
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
jmp 0x140085050
lea rcx, str.COMSPEC
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x1400848cd
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0xa0]
call fcn.140015460
jmp 0x1400848cd
lea rdx, [rsp + 0x628]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x628], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x1400848cd
mov eax, dword [0x1400c5f48]
cmp eax, 3
je case.0x140084831.43
cmp eax, 4
jne case.0x140084831.30
mov rcx, rbp
call fcn.140007a40
mov dword [rbp], r12d
mov dword [rbp + 8], r12d
mov r12d, r14d
mov rcx, r15
call fcn.140002610
lea r11, [rsp + 0x5e0]
mov eax, r12d
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.USERPROFILE
jmp 0x14008509e
lea rcx, str.HOMEDRIVE
jmp 0x14008509e
lea rcx, str.HOMEPATH
jmp 0x14008509e
lea rcx, str.HOMESHARE
jmp 0x14008509e
lea rcx, str.LOGONSERVER
jmp 0x14008509e
lea rcx, str.USERDOMAIN
jmp 0x14008509e
lea rcx, str.USERDNSDOMAIN
jmp 0x14008509e
mov ebx, dword [rbx + 0x23c]
jmp 0x140084876
mov rdx, qword [rbx + 0x240]
jmp 0x14008483a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
pxor xmm6, xmm6
mov rcx, rbp
mov r11d, eax
cvtsi2sd xmm6, r11
call fcn.140007a40
movsd qword [rbp], xmm6
mov dword [rbp + 8], 3
jmp case.0x140084831.87