Function at 0x4338d3
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x560
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
mov edi, 0x208
push edi
push eax
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x292]
push eax
call fcn.00456fd0
add esp, 0xc
xor eax, eax
push edi
push eax
mov word [ebp - 0x55c], ax
lea eax, [ebp - 0x55a]
push eax
call fcn.00456fd0
mov ebx, dword [ebp + 0xc]
add esp, 0xc
xor edi, edi
push ebx
push dword [edi*4 + 0x47a770]
call fcn.004571cc
pop ecx
pop ecx
test eax, eax
je 0x433938
inc edi
cmp edi, 0x60
jl 0x43391f
cmp edi, 0x60
jne 0x433999
push 0x474e78
lea esi, [ebp - 0x24]
call fcn.00401983
and dword [ebp - 0x10], 0
lea eax, [ebp + 0xc]
push eax
mov eax, esi
call fcn.0040400a
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x24]
call fcn.00410274
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x43398d
xor esi, esi
inc esi
lea ecx, [ebp - 0x24]
call fcn.00401a04
lea ecx, [ebp + 0xc]
call fcn.00401a04
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
mov ebx, dword [ebp + 8]
call fcn.00413001
xor esi, esi
jmp 0x433974
cmp edi, 0x5f
ja case.0x4339a2.87
jmp dword [edi*4 + 0x434287]
push 0x474ed4
mov edi, dword [ebp + 8]
call fcn.0041345d
jmp case.0x4339a2.87
push 0x46e550
jmp 0x4339ae
push 0x470a6c
jmp 0x4339ae
push 0x474ed8
jmp 0x4339ae
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea eax, [eax + esi + 4]
call fcn.00418aa2
push dword [eax + 0x14]
jmp 0x43419f
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea eax, [eax + esi + 4]
call fcn.00418aa2
mov ebx, dword [ebp + 8]
add eax, 0x20
call fcn.00413001
jmp case.0x4339a2.87
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [ebp - 0x296]
push eax
push 0x474edc
lea eax, [ebp - 0x294]
push eax
call fcn.0045732b
add esp, 0xc
lea eax, [ebp - 0x294]
push eax
jmp 0x4339ae
push 0
call fcn.00458943
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov dword [esp], 0x474ee8
push eax
lea eax, [ebp - 0x314]
mov dword [ebp - 0x10], edx
call fcn.00432f80
mov esi, dword [ebp + 8]
push eax
call fcn.00413493
lea ecx, [ebp - 0x314]
call fcn.00401a04
jmp case.0x4339a2.87
push 0
call fcn.00458943
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
mov dword [esp], 0x474ef0
push eax
lea eax, [ebp - 0x304]
mov dword [ebp - 0x38], edx
call fcn.00432f80
mov esi, dword [ebp + 8]
push eax
call fcn.00413493
lea ecx, [ebp - 0x304]
jmp 0x433a6b
push 0
call fcn.00458943
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
mov dword [esp], 0x474ef8
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x48], edx
call fcn.00432f80
mov esi, dword [ebp + 8]
push eax
call fcn.00413493
lea ecx, [ebp - 0x2d4]
jmp 0x433a6b
push 0
call fcn.00458943
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
mov dword [esp], 0x46ef78
push eax
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x50], edx
call fcn.00432f80
mov esi, dword [ebp + 8]
push eax
call fcn.00413493
lea ecx, [ebp - 0x2f4]
jmp 0x433a6b
push 0
call fcn.00458943
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [esp], 0x474f00
push eax
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x28], edx
call fcn.00432f80
mov esi, dword [ebp + 8]
push eax
call fcn.00413493
lea ecx, [ebp - 0x2e4]
jmp 0x433a6b
push 0
call fcn.00458943
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
mov dword [esp], 0x474f08
push eax
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x40], edx
call fcn.00432f80
mov esi, dword [ebp + 8]
push eax
call fcn.00413493
lea ecx, [ebp - 0x2c4]
jmp 0x433a6b
push 0
call fcn.00458943
mov dword [ebp - 0x34], eax
pop ecx
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x30], edx
call fcn.00432f43
test eax, eax
je 0x433baa
mov eax, dword [eax + 0x18]
inc eax
jmp 0x433bac
xor eax, eax
push eax
push 0x46ef78
jmp 0x433a1e
push 0
call fcn.00458943
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [esp], 0x474f10
push eax
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x18], edx
call fcn.00432f80
mov esi, dword [ebp + 8]
push eax
call fcn.00413493
lea ecx, [ebp - 0x2b4]
jmp 0x433a6b
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x433a2d
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x2b
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 5
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x23
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x19
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x2e
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x1f
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x17
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x16
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x18
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x1a
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x10
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 6
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 2
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0xb
jmp 0x433bfb
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 7
jmp 0x433bfb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
jmp 0x433a2d
push 0x104
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
jmp 0x433a2d
mov eax, dword [0x4924d4]
cmp byte [eax + 0x2a], 0
je 0x433d87
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x433d60
push str.GetSystemWow64DirectoryW
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x433d65
mov eax, 0x416667
push 0x104
lea ecx, [ebp - 0x294]
push ecx
call eax
test esi, esi
je 0x433a2d
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
jmp 0x433a2d
push 0x104
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
jmp 0x433a2d
push 6
jmp 0x43419f
push 3
jmp 0x43419f
push 9
jmp 0x43419f
push 5
jmp 0x43419f
push 0xa
jmp 0x43419f
push 2
jmp 0x43419f
push 7
jmp 0x43419f
push 8
jmp 0x43419f
push 4
jmp 0x43419f
push 1
jmp 0x43419f
xor ecx, ecx
inc ecx
cmp byte [0x4803ca], cl
mov esi, dword [ebp + 8]
jne 0x433df8
push ecx
jmp 0x4341a2
push 0
jmp 0x4341a2
xor ecx, ecx
inc ecx
cmp byte [0x4915f9], cl
jmp 0x433ded
push pe_nt_image_headers32
jmp 0x43419f
push 0x41
jmp 0x43419f
push 0x42
jmp 0x43419f
push 0x43
jmp 0x43419f
push dword [esi + 0xc8]
jmp 0x4339ae
push dword [esi + 0xb8]
jmp 0x4339ae
push dword [esi + 0xd8]
jmp 0x4339ae
mov ecx, dword [esi + 0xf4]
call fcn.0040869a
push eax
jmp 0x43419f
lea eax, [ebp - 0x294]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
jmp 0x433a2d
mov eax, dword [0x4924d4]
movzx eax, word [eax + 0x2c]
test eax, eax
je 0x433ea1
cmp eax, 6
je 0x433e97
mov edi, dword [ebp + 8]
cmp eax, 9
jne 0x433f54
push 0x474f2c
jmp 0x4339b1
push str.IA64
jmp 0x4339ae
push 0x474f18
jmp 0x4339ae
call fcn.00454d50
test al, al
mov eax, 0x474f2c
jne 0x433a33
mov eax, 0x474f18
jmp 0x433a33
push str.WIN32_NT
jmp 0x4339ae
mov eax, dword [0x4924d4]
xor ecx, ecx
inc ecx
cmp byte [eax + 0x28], cl
jne 0x433ee8
push str.WIN_2008R2
jmp 0x4339ae
cmp byte [eax + 0x26], cl
jne 0x433ef7
push str.WIN_7
jmp 0x4339ae
cmp byte [eax + 0x24], cl
jne 0x433f06
push str.WIN_2008
jmp 0x4339ae
cmp byte [eax + 0x22], cl
jne 0x433f15
push str.WIN_VISTA
jmp 0x4339ae
cmp byte [eax + 0x20], cl
jne 0x433f24
push str.WIN_2003
jmp 0x4339ae
cmp byte [eax + 0x1e], cl
jne 0x433f42
cmp byte [eax + 0x2e], 0
mov eax, str.WIN_XPe
jne 0x433a33
mov eax, str.WIN_XP
jmp 0x433a33
mov edi, dword [ebp + 8]
cmp byte [eax + 0x1c], cl
jne 0x433f54
push str.WIN_2000
jmp 0x4339b1
push str.UNKNOWN
jmp 0x4339b1
mov eax, dword [0x4924d4]
push dword [eax + 8]
jmp 0x43419f
mov eax, dword [0x4924d4]
mov esi, dword [ebp + 8]
add eax, 0xc
push eax
call fcn.00413493
jmp case.0x4339a2.87
push 0x104
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x294]
call fcn.0040df0b
add esp, 0x10
jmp 0x433a2d
push 0x104
push str.SchemeLangID
push str.Control_PanelAppearance
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x294]
call fcn.0040df0b
movzx eax, word [ebp - 0x294]
push eax
push 4
pop edx
mov ebx, esi
mov dword [ebp - 8], eax
call fcn.0040fcb8
add esp, 0x14
jmp 0x433a2d
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x328]
jmp 0x433a33
lea eax, [ebp - 0x55c]
push str.3__3__7__2
push eax
call fcn.004555f7
lea eax, [ebp - 0x55c]
push eax
xor esi, esi
xor edi, edi
call fcn.00455251
add esp, 0xc
test eax, eax
jle 0x434054
movzx eax, word [ebp + edi*2 - 0x55c]
cmp eax, 0x20
je 0x434042
cmp eax, 0x2c
jne 0x434039
push 0x2e
pop eax
mov word [ebp + esi*2 - 0x55c], ax
inc esi
lea eax, [ebp - 0x55c]
push eax
inc edi
call fcn.00455251
pop ecx
cmp edi, eax
jl 0x434024
xor eax, eax
mov word [ebp + esi*2 - 0x55c], ax
lea eax, [ebp - 0x55c]
jmp 0x433a33
push 0x104
lea eax, [ebp - 0x294]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
jmp 0x433a2d
lea eax, [ebp - 0x74]
push eax
xor eax, eax
inc eax
call fcn.0040f30a
pop ecx
lea eax, [ebp - 0x74]
jmp 0x433a33
lea eax, [ebp - 0x74]
push eax
push 2
pop eax
jmp 0x434089
lea eax, [ebp - 0x74]
push eax
push 3
jmp 0x43409d
lea eax, [ebp - 0x74]
push eax
push 4
jmp 0x43409d
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x7c]
jmp 0x43419f
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x78]
jmp 0x43419f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 8]
push eax
call fcn.004131a1
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.0x4339a2.87
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x4340f9
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
jmp 0x433a2d
lea eax, [ebp - 0x294]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea esi, [ebp - 0x294]
call fcn.0040e3f2
jmp 0x433a2d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x433a2d
mov eax, dword [0x490e34]
cmp eax, 3
je case.0x4339a2.43
cmp eax, 4
je case.0x4339a2.43
push 0
mov esi, dword [ebp + 8]
call fcn.004131a1
xor esi, esi
jmp 0x43397c
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.USERPROFILE
jmp 0x43413c
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.HOMEDRIVE
jmp 0x43413c
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.HOMEPATH
jmp 0x43413c
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.HOMESHARE
jmp 0x43413c
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.LOGONSERVER
jmp 0x43413c
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.USERDOMAIN
jmp 0x43413c
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.USERDNSDOMAIN
jmp 0x43413c
push dword [esi + 0x148]
jmp 0x43419f
push dword [esi + 0x14c]
jmp 0x4339ae
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
test eax, eax
jns 0x434274
fadd qword [0x475bc0]
mov esi, dword [ebp + 8]
push ecx
push ecx
fstp qword [esp]
call fcn.00413441
jmp case.0x4339a2.87