Function at 0x420619
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
mov eax, 0x44ef6b
call fcn.0044061c
sub esp, 0x258
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.0040101d
mov dl, byte [0x45bba0]
push 0x41
pop ecx
xor eax, eax
and dword [ebp - 0x10], eax
lea edi, [ebp - 0x13b]
mov byte [ebp - 0x13c], dl
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
push 0x41
lea edi, [ebp - 0x263]
pop ecx
mov byte [ebp - 0x264], dl
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
call fcn.00440f84
lea eax, [ebp - 0x34]
push eax
call fcn.00442372
pop ecx
mov edi, eax
pop ecx
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_CharUpperBuffA]
mov ebx, dword [ebp - 0x20]
mov dword [ebp + 8], 0x456708
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call fcn.00440b60
pop ecx
test eax, eax
pop ecx
je 0x4206b7
inc dword [ebp - 0x10]
add dword [ebp + 8], 4
cmp dword [ebp + 8], 0x456868
jl 0x420696
mov eax, dword [ebp - 0x10]
cmp eax, 0x58
jne 0x42074e
push 0x456ea0
lea ecx, [ebp - 0x148]
call fcn.0040101d
lea eax, [ebp - 0x20]
xor esi, esi
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], esi
call fcn.004011b8
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x148]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14c], esp
push eax
call fcn.00401079
mov ecx, 0x45f2e0
call fcn.0043e135
cmp dword [ebp + 8], esi
jne 0x42071f
push 1
pop esi
jmp 0x42072a
push dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.004035d9
push dword [ebp - 0x148]
and byte [ebp - 4], 0
call fcn.0044023b
push dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
call fcn.0044023b
pop ecx
mov eax, esi
pop ecx
jmp 0x420f59
cmp eax, 0x57
ja case.default.0x420757
jmp dword [eax*4 + 0x420f6a]
push 0x457154
jmp 0x420c98
push 0x4559e0
jmp 0x420c98
push 0x455afc
jmp 0x420c98
push 0x457150
jmp 0x420c98
push dword [esi + 0x164]
jmp 0x420f42
push dword [esi + 0x168]
jmp 0x420f42
push dword [edi]
push str._.2d
lea eax, [ebp - 0x13c]
push eax
call fcn.00440db3
add esp, 0xc
jmp 0x420c91
push dword [edi + 4]
jmp 0x42079e
push dword [edi + 8]
jmp 0x42079e
push dword [edi + 0xc]
jmp 0x42079e
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x42079e
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x420f41
mov eax, dword [edi + 0x18]
inc eax
jmp 0x420f41
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x4207a3
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x420c84
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.CommonFilesDir
jmp 0x420800
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
call fcn.0043c2a8
lea eax, [ebp - 0x13c]
push eax
call fcn.0043c7ed
add esp, 0x18
jmp 0x420c91
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Common_AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x420c84
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Desktop
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043c2a8
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x420c91
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Desktop
push esi
push reloc.WSOCK32.dll_accept
jmp 0x420c89
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Common_Documents
jmp 0x420862
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Favorites
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043c2a8
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x420c91
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Favorites
jmp 0x4208ab
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Programs
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043c2a8
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x420c91
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Programs
jmp 0x4208ab
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Start_Menu
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043c2a8
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x420c91
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Start_Menu
jmp 0x4208ab
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Startup
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043c2a8
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x420c91
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Startup
jmp 0x4208ab
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.AppData
jmp 0x420a46
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Desktop
jmp 0x420a46
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Favorites
jmp 0x420a46
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Programs
jmp 0x420a46
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Start_Menu
jmp 0x420a46
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x4208ac
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x420c91
lea eax, [ebp - 0x13c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x420c91
lea eax, [ebp - 0x13c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x420c91
push 6
jmp 0x420f42
push 9
jmp 0x420f42
push 5
jmp 0x420f42
push 0xa
jmp 0x420f42
push 3
jmp 0x420f42
push 2
jmp 0x420f42
push 7
jmp 0x420f42
push 8
jmp 0x420f42
push 4
jmp 0x420f42
cmp byte [0x45f0ba], 1
jmp 0x420aea
cmp byte [0x45f418], 1
je case.0x420757.42
push 0
jmp 0x420f42
push 0x40
jmp 0x420f42
push 0x41
jmp 0x420f42
push 0x42
jmp 0x420f42
push 0x43
jmp 0x420f42
push dword [esi + 0x70]
jmp 0x420c98
push dword [esi + 0x64]
jmp 0x420c98
push dword [esi + 0x7c]
jmp 0x420c98
push dword [esi + 0x90]
mov ecx, 0x45f0c0
call fcn.00438806
jmp 0x420f41
lea eax, [ebp - 0x13c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x420c91
mov eax, dword [0x463b04]
mov ecx, eax
dec ecx
je 0x420b88
dec ecx
je 0x420b7e
dec ecx
je 0x420b74
neg eax
push eax
push str.UNKN_d
jmp 0x4207a3
push 0x456fe0
jmp 0x420c98
push str.IA64
jmp 0x420c98
push 0x456fd4
jmp 0x420c98
cmp byte [0x463aec], 1
jne 0x420ba5
push str.WIN32_NT
jmp 0x420c98
push str.WIN32_WINDOWS
jmp 0x420c98
mov al, byte [0x463aec]
cmp al, 1
jne 0x420c1d
cmp byte [0x463af2], al
jne 0x420bca
push str.WIN_6.1
jmp 0x420c98
cmp byte [0x463af8], 1
jne 0x420bdd
push str.WIN_6.0
jmp 0x420c98
cmp byte [0x463af6], 1
jne 0x420bf0
push str.WIN_2003
jmp 0x420c98
cmp byte [0x463af0], 1
jne 0x420c03
push str.WIN_XP
jmp 0x420c98
cmp byte [0x463af4], 1
jne 0x420c16
push str.WIN_2000
jmp 0x420c98
push str.WIN_NT4
jmp 0x420c98
cmp byte [0x463afc], 1
jne 0x420c2d
push str.WIN_95
jmp 0x420c98
cmp byte [0x463afa], 1
jne 0x420c3d
push str.WIN_98
jmp 0x420c98
push str.WIN_ME
jmp 0x420c98
push dword [0x4639e8]
jmp 0x420f42
push 0x4639ec
jmp 0x420c98
mov al, byte [0x463aec]
cmp al, 1
jne 0x420ca5
cmp byte [0x463af5], al
lea eax, [ebp - 0x13c]
push eax
push 0x104
jne 0x420c7a
push str.InstallLanguage
jmp 0x420c7f
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043c2a8
add esp, 0x14
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00403877
jmp case.default.0x420757
lea eax, [ebp - 0x13c]
push eax
push 0x104
push 0x45bba0
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.0043c2a8
add esp, 0x14
lea eax, [ebp - 0x138]
jmp 0x420c97
lea eax, [ebp - 0x13c]
push 0x105
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.0043c876
pop ecx
lea eax, [ebp - 0x264]
pop ecx
jmp 0x420c97
lea eax, [ebp - 0x13c]
push 0x105
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x420c91
lea eax, [ebp - 0x30]
push eax
push 1
call fcn.0043d454
pop ecx
lea eax, [ebp - 0x30]
pop ecx
jmp 0x420c97
lea eax, [ebp - 0x30]
push eax
push 2
jmp 0x420d20
lea eax, [ebp - 0x30]
push eax
push 3
jmp 0x420d20
lea eax, [ebp - 0x30]
push eax
push 4
jmp 0x420d20
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x154]
jmp 0x420f42
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x150]
jmp 0x420f42
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0xc
jmp 0x420dad
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x74
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00403751
push edi
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x420757
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x420c91
lea eax, [ebp - 0x13c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x13c]
push eax
call fcn.0043c7ed
pop ecx
jmp 0x420c91
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x420c91
push 1
jmp 0x420f42
cmp byte [0x463aec], 0
je 0x420e4a
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.USERPROFILE
jmp 0x420ddb
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
call fcn.0043c2a8
lea eax, [ebp - 0x13c]
push eax
call fcn.004401c0
add esp, 0x18
dec eax
js 0x420e86
cmp byte [ebp + eax - 0x13c], 0x5c
jne 0x420e79
and byte [ebp + eax - 0x13c], 0
jmp 0x420c91
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.HOMEDRIVE
jmp 0x420ddb
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.HOMEPATH
jmp 0x420ddb
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.HOMESHARE
jmp 0x420ddb
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.LOGONSERVER
jmp 0x420ddb
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.USERDOMAIN
jmp 0x420ddb
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.USERDNSDOMAIN
jmp 0x420ddb
push dword [esi + 0x11c]
jmp 0x420f42
movzx eax, byte [esi + 0x118]
jmp 0x420f41
push dword [esi + 0x16c]
jmp 0x420f42
push dword [esi + 0x170]
jmp 0x420c98
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00403751
push dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
call fcn.0044023b
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8