Function at 0x42e726
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov esi, 0x104
xor ebx, ebx
push esi
mov edi, eax
lea eax, [ebp - 0x12f]
push ebx
push eax
mov byte [ebp - 0x130], bl
call fcn.00450c80
add esp, 0xc
push esi
lea eax, [ebp - 0x24f]
push ebx
push eax
mov byte [ebp - 0x250], bl
call fcn.00450c80
lea eax, [ebp - 0x148]
add esp, 0xc
push eax
mov dword [ebp - 4], ebx
call fcn.00452617
pop ecx
lea eax, [ebp - 0x148]
push eax
call fcn.00452f87
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x472a20]
call fcn.0044e470
test eax, eax
pop ecx
pop ecx
je 0x42e7aa
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5b
jl 0x42e789
mov eax, dword [ebp - 4]
cmp eax, 0x5b
jne 0x42e80c
push 0x46cf44
lea esi, [ebp - 0x18]
call fcn.0040e09c
lea eax, [ebp + 8]
mov edi, esi
mov dword [ebp - 8], ebx
call fcn.0040e203
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea esi, [ebp - 8]
call fcn.0040de58
cmp dword [ebp - 4], ebx
jne 0x42e7fd
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
call fcn.0044dfb0
pop ecx
push dword [ebp + 8]
call fcn.0044dfb0
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
call fcn.0040fca9
xor ebx, ebx
jmp 0x42e7e2
cmp eax, 0x5a
ja case.default.0x42e811
jmp dword [eax*4 + 0x42f35a]
push 0x46cf74
mov edi, dword [ebp + 0x14]
call fcn.0040ff22
jmp case.default.0x42e811
push 0x46a198
jmp 0x42e81d
push 0x46a938
jmp 0x42e81d
push 0x46cf78
jmp 0x42e81d
push dword [edi + 0x254]
jmp 0x42f1fb
push dword [edi + 0x258]
jmp 0x42f1fb
mov eax, dword [ebp - 8]
push dword [eax]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.0044e66b
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
jmp 0x42e81d
mov eax, dword [ebp - 8]
push dword [eax + 4]
jmp 0x42e857
mov eax, dword [ebp - 8]
push dword [eax + 8]
jmp 0x42e857
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
jmp 0x42e857
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
inc eax
push eax
jmp 0x42e857
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
jmp 0x42f1fb
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
inc eax
jmp 0x42e8a1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x42e85c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42e86b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.CommonFilesDir
jmp 0x42e8f5
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e990
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Personal
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x130]
call fcn.0040c058
jmp 0x42e86b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_AppData
jmp 0x42e8f5
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ea28
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e86b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
jmp 0x42e8f5
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Documents
jmp 0x42e8f5
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eaf7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e86b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Favorites
jmp 0x42e8f5
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eb87
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Programs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e86b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Programs
jmp 0x42e8f5
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ec17
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Start_Menu
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e86b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Start_Menu
jmp 0x42e8f5
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eca7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Startup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e86b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Startup
jmp 0x42e8f5
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.AppData
jmp 0x42e8f5
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42ea3c
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42eb0b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42eb9b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42ec2b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42ecbb
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x42e86b
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x42e86b
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x42e86b
push 6
jmp 0x42f1fb
push 3
jmp 0x42f1fb
push 9
jmp 0x42f1fb
push 5
jmp 0x42f1fb
push 0xa
jmp 0x42f1fb
push 2
jmp 0x42f1fb
push 7
jmp 0x42f1fb
push 8
jmp 0x42f1fb
push 4
jmp 0x42f1fb
push 1
jmp 0x42f1fb
cmp byte [0x4744ae], 1
mov esi, dword [ebp + 0x14]
jne 0x42ee1a
push 1
jmp 0x42f1fe
push ebx
jmp 0x42f1fe
cmp byte [0x47ee39], 1
jmp 0x42ee0e
push 0x40
jmp 0x42f1fb
push 0x41
jmp 0x42f1fb
push 0x42
jmp 0x42f1fb
push 0x43
jmp 0x42f1fb
push dword [edi + 0x16c]
jmp 0x42e81d
push dword [edi + 0x160]
jmp 0x42e81d
push dword [edi + 0x178]
jmp 0x42e81d
mov ecx, dword [edi + 0x190]
call fcn.004066b9
jmp 0x42e8a1
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x42e86b
mov eax, dword [0x47e5b4]
mov ecx, eax
dec ecx
je 0x42eeba
dec ecx
je 0x42eeb0
dec ecx
je 0x42eea6
neg eax
push eax
push str.UNKN_d
jmp 0x42e85c
push 0x46d0f0
jmp 0x42e81d
push str.IA64
jmp 0x42e81d
push 0x46d0e4
jmp 0x42e81d
cmp byte [0x47e59c], 1
mov edi, dword [ebp + 0x14]
jne 0x42eeda
push str.WIN32_NT
jmp 0x42e820
push str.WIN32_WINDOWS
jmp 0x42e820
cmp byte [0x47e59c], 1
jne 0x42ef59
cmp byte [0x47e5a2], 1
jne 0x42ef00
push str.WIN_LONGHORN
jmp 0x42e81d
cmp byte [0x47e5a8], 1
jne 0x42ef13
push str.WIN_VISTA
jmp 0x42e81d
cmp byte [0x47e5a6], 1
jne 0x42ef26
push str.WIN_2003
jmp 0x42e81d
cmp byte [0x47e5a0], 1
jne 0x42ef39
push str.WIN_XP
jmp 0x42e81d
cmp byte [0x47e5a4], 1
mov edi, dword [ebp + 0x14]
jne 0x42ef4f
push str.WIN_2000
jmp 0x42e820
push str.WIN_NT4
jmp 0x42e820
cmp byte [0x47e5ac], 1
jne 0x42ef6c
push str.WIN_95
jmp 0x42e81d
cmp byte [0x47e5aa], 1
mov edi, dword [ebp + 0x14]
jne 0x42ef82
push str.WIN_98
jmp 0x42e820
push str.WIN_ME
jmp 0x42e820
push dword [0x47e498]
jmp 0x42f1fb
push 0x47e49c
jmp 0x42e81d
cmp byte [0x47e59c], 1
lea eax, [ebp - 4]
push eax
push 1
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
push ebx
jne 0x42f017
cmp byte [0x47e5a5], 1
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
jne 0x42eff2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.InstallLanguage
jmp 0x42e8f5
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Default
jmp 0x42e8f5
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f04f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push 0x469cee
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x12c]
jmp 0x42e871
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x18]
jmp 0x42e871
lea eax, [ebp - 0x250]
push 0x46d1e4
push eax
call fcn.0044ddf0
lea eax, [ebp - 0x250]
push eax
xor esi, esi
xor edi, edi
call fcn.0044e5e0
add esp, 0xc
test eax, eax
jle 0x42f0c7
mov al, byte [ebp + edi - 0x250]
cmp al, 0x20
je 0x42f0b5
cmp al, 0x2c
jne 0x42f0ad
mov byte [ebp + esi - 0x250], 0x2e
jmp 0x42f0b4
mov byte [ebp + esi - 0x250], al
inc esi
lea eax, [ebp - 0x250]
push eax
inc edi
call fcn.0044e5e0
cmp edi, eax
pop ecx
jl 0x42f094
mov byte [ebp + esi - 0x250], bl
lea eax, [ebp - 0x250]
jmp 0x42e871
push esi
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x42e86b
lea eax, [ebp - 0x28]
xor esi, esi
push eax
inc esi
call fcn.0040ce60
pop ecx
lea eax, [ebp - 0x28]
jmp 0x42e871
lea eax, [ebp - 0x28]
push eax
push 2
pop esi
jmp 0x42f0f4
lea eax, [ebp - 0x28]
push eax
push 3
jmp 0x42f108
lea eax, [ebp - 0x28]
push eax
push 4
jmp 0x42f108
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x42f1fb
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x134]
jmp 0x42f1fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.0040fe5d
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x42e811
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x42f16a
push esi
lea eax, [ebp - 0x130]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x42e86b
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x42e990
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x42e86b
mov eax, dword [0x47e5d0]
cmp eax, 2
je case.0x42e811.42
cmp eax, 3
je case.0x42e811.42
push ebx
mov esi, dword [ebp + 0x14]
call fcn.0040fe5d
jmp case.default.0x42e811
cmp byte [0x47e59c], bl
je 0x42f21f
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERPROFILE
jmp 0x42f1ac
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f267
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130]
push eax
call fcn.0044e5e0
pop ecx
jmp 0x42f280
cmp byte [ebp + eax - 0x130], 0x5c
je 0x42f283
dec eax
jns 0x42f276
mov byte [ebp + eax - 0x130], bl
jmp 0x42e86b
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEDRIVE
jmp 0x42f1ac
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEPATH
jmp 0x42f1ac
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMESHARE
jmp 0x42f1ac
push esi
lea eax, [ebp - 0x130]
push eax
push str.LOGONSERVER
jmp 0x42f1ac
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDOMAIN
jmp 0x42f1ac
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDNSDOMAIN
jmp 0x42f1ac
push dword [edi + 0x220]
jmp 0x42f1fb
movzx eax, byte [edi + 0x21c]
jmp 0x42e8a1
push dword [edi + 0x25c]
jmp 0x42f1fb
push dword [edi + 0x260]
jmp 0x42e81d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x42f33e
fadd qword [0x46d7e8]
mov esi, dword [ebp + 0x14]
push ecx
push ecx
fstp qword [esp]
call fcn.0040ff09
jmp case.default.0x42e811
push 0x5780000
jmp 0x42f1fb