Function at 0x140083a00
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x528]
sub rsp, 0x5f0
mov r14, qword [rdx]
mov rbx, rcx
mov r12, r8
mov edi, 0x208
lea rcx, [rbp - 0x4e]
xor esi, esi
movaps xmmword [rax - 0x48], xmm6
mov r8d, edi
xor edx, edx
mov word [rbp - 0x50], si
call fcn.140014d40
lea rcx, [rbp + 0x2d2]
mov r8d, edi
xor edx, edx
mov word [rbp + 0x2d0], si
call fcn.140014d40
mov edi, esi
lea rsi, str.ERROR
mov r13d, 1
mov rcx, qword [rsi]
mov rdx, r14
call fcn.1400158dc
test eax, eax
je 0x140083a93
lea rax, [0x1400ad730]
add rsi, 8
add edi, r13d
cmp rsi, rax
jl 0x140083a71
mov r15, qword [rbp + 0x538]
cmp edi, 0x60
jne 0x140083afe
lea rdx, [0x1400a0d00]
lea rcx, [rbp - 0x70]
call fcn.140001ca0
lea rcx, [rbp - 0x70]
xor ebx, ebx
mov rdx, r15
mov dword [rbp + 0x538], ebx
call fcn.1400047b0
lea r8, [rbp + 0x538]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
xor r9d, r9d
call fcn.14000e830
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140083af0
mov rcx, r12
call fcn.1400078a0
mov r13d, ebx
lea rcx, [rbp - 0x70]
call fcn.1400024f0
jmp 0x1400843eb
cmp edi, 0x5f
ja case.0x140083b1b.87
lea rdx, [0x140000000]
movsxd rax, edi
mov ecx, dword [rdx + rax*4 + 0x844b0]
add rcx, rdx
jmp rcx
lea rdx, [0x1400a0d64]
mov rcx, r12
call fcn.140010e90
jmp case.0x140083b1b.87
lea rdx, reloc.WSOCK32.dll_inet_addr
jmp 0x140083b24
lea rdx, [0x14009c4cc]
jmp 0x140083b24
lea rdx, reloc.WSOCK32.dll_htons
jmp 0x140083b24
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + rbx + 8]
call fcn.14000dff0
mov ebx, dword [rax + 0x1c]
mov rcx, r12
call fcn.1400077f0
mov dword [r12], ebx
jmp 0x1400843e0
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + rbx + 8]
call fcn.14000dff0
mov rcx, r12
lea rdx, [rax + 0x28]
call fcn.1400078a0
jmp case.0x140083b1b.87
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rsp + 0x56]
lea rdx, str._.3d
lea rcx, [rbp - 0x50]
call fcn.140015a2c
lea rdx, [rbp - 0x50]
jmp 0x140083b24
lea rcx, [rsp + 0x30]
call fcn.14004b6e0
lea r8, [0x1400a0d7c]
lea rdx, [rbp + 0x290]
mov rcx, rax
call fcn.14005e860
mov rcx, r12
mov rdx, rax
call fcn.140011010
lea rcx, [rbp + 0x290]
call fcn.1400024f0
jmp case.0x140083b1b.87
lea rcx, [rbp + 0x1e0]
call fcn.14004b6e0
lea r8, [0x1400a0d84]
lea rdx, [rbp + 0x1f0]
mov rcx, rax
call fcn.14005e860
mov rcx, r12
mov rdx, rax
call fcn.140011010
lea rcx, [rbp + 0x1f0]
jmp 0x140083bef
lea rcx, [rbp + 0x1d0]
call fcn.14004b6e0
lea r8, [0x1400a0d8c]
lea rdx, [rbp + 0x230]
mov rcx, rax
call fcn.14005e860
mov rcx, r12
mov rdx, rax
call fcn.140011010
lea rcx, [rbp + 0x230]
jmp 0x140083bef
lea rcx, [rbp + 0x1c0]
call fcn.14004b6e0
lea r8, [0x14009a768]
lea rdx, [rbp + 0x2b0]
mov rcx, rax
call fcn.14005e860
mov rcx, r12
mov rdx, rax
call fcn.140011010
lea rcx, [rbp + 0x2b0]
jmp 0x140083bef
lea rcx, [rbp + 0x1c8]
call fcn.14004b6e0
lea r8, [0x1400a0d94]
lea rdx, [rbp + 0x270]
mov rcx, rax
call fcn.14005e860
mov rcx, r12
mov rdx, rax
call fcn.140011010
lea rcx, [rbp + 0x270]
jmp 0x140083bef
lea rcx, [rbp + 0x1d8]
call fcn.14004b6e0
lea r8, [0x1400a0d9c]
lea rdx, [rbp + 0x210]
mov rcx, rax
call fcn.14005e860
mov rcx, r12
mov rdx, rax
call fcn.140011010
lea rcx, [rbp + 0x210]
jmp 0x140083bef
lea rcx, [rbp + 0x1e8]
call fcn.14004b6e0
mov rcx, rax
call fcn.14005e8e0
lea rdx, [0x14009a768]
mov r8d, eax
jmp 0x140083bab
lea rcx, [rbp - 0x80]
call fcn.14004b6e0
lea r8, [0x1400a0da4]
lea rdx, [rbp + 0x250]
mov rcx, rax
call fcn.14005e860
mov rcx, r12
mov rdx, rax
call fcn.140011010
lea rcx, [rbp + 0x250]
jmp 0x140083bef
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroyData
lea rax, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x140083bb4
mov edx, 0x2b
jmp 0x140083d6e
mov edx, 5
jmp 0x140083d6e
mov edx, SafeArrayDestroyData
jmp 0x140083d6e
mov edx, 0x19
jmp 0x140083d6e
mov edx, 0x2e
jmp 0x140083d6e
mov edx, reloc.OLEAUT32.dll_CreateStdDispatch
jmp 0x140083d6e
mov edx, reloc.WSOCK32.dll_socket
jmp 0x140083d6e
mov edx, SafeArrayUnaccessData
jmp 0x140083d6e
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x140083d6e
mov edx, 0x1a
jmp 0x140083d6e
mov edx, reloc.WSOCK32.dll_recv
jmp 0x140083d6e
mov edx, 6
jmp 0x140083d6e
mov edx, 2
jmp 0x140083d6e
mov edx, reloc.WSOCK32.dll_inet_ntoa
jmp 0x140083d6e
mov edx, 7
jmp 0x140083d6e
lea rdx, [rbp + 0x548]
lea rcx, [rbp - 0x50]
mov dword [rbp + 0x548], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x140083bb4
lea rcx, [rbp - 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je case.0x140083b1b.87
jmp 0x140083bb4
mov rax, qword [0x1400c6da8]
xor ecx, ecx
cmp byte [rax + 0x40], cl
je 0x140083e6e
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x48]
call fcn.140038500
lea rcx, [rbp - 0x50]
mov edx, 0x104
call rax
lea rcx, [rsp + 0x48]
call fcn.140038750
jmp 0x140083bb4
lea rcx, [rbp - 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140083bb4
mov rcx, r12
call fcn.1400077f0
xor ebx, ebx
jmp 0x140083b68
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 6
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 3
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 9
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 5
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 0xa
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 2
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 7
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 8
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 4
jmp 0x1400843e0
cmp byte [0x1400b396a], r13b
mov rcx, r12
je 0x1400843d7
jmp 0x140083e85
cmp byte [0x1400c501d], r13b
jmp 0x140083f55
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 0x40
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 0x41
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 0x42
jmp 0x1400843e0
mov rcx, r12
call fcn.1400077f0
mov dword [r12], 0x43
jmp 0x1400843e0
mov rdx, qword [rbx + 0x170]
jmp 0x140083b24
mov rdx, qword [rbx + 0x150]
jmp 0x140083b24
mov rdx, qword [rbx + 0x190]
jmp 0x140083b24
mov ecx, dword [rbx + 0x1c0]
call fcn.14003c460
mov ebx, eax
jmp 0x140083b60
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x140083bb4
mov rax, qword [0x1400c6da8]
movzx ecx, word [rax + 0x42]
test ecx, ecx
je 0x140084042
cmp ecx, 6
je 0x140084036
cmp ecx, 9
mov rcx, r12
jne 0x140084131
lea rdx, [0x1400a0dc8]
jmp 0x140083b27
lea rdx, str.IA64
jmp 0x140083b24
lea rdx, [0x1400a0db0]
jmp 0x140083b24
mov eax, 0x80000001
xor ecx, ecx
cpuid
bt edx, 0x1d
mov dword [rbp - 0x80], eax
lea rdx, [0x1400a0dc8]
lea rax, [0x1400a0db0]
mov dword [rbp - 0x7c], ebx
mov dword [rbp - 0x78], ecx
cmovae rdx, rax
jmp 0x140083b24
lea rdx, str.WIN32_NT
jmp 0x140083b24
mov rax, qword [0x1400c6da8]
cmp byte [rax + 0x3e], r13b
jne 0x1400840a0
lea rdx, str.WIN_8
jmp 0x140083b24
cmp byte [rax + 0x3c], r13b
jne 0x1400840b2
lea rdx, str.WIN_2008R2
jmp 0x140083b24
cmp byte [rax + 0x3a], r13b
jne 0x1400840c4
lea rdx, str.WIN_7
jmp 0x140083b24
cmp byte [rax + 0x38], r13b
jne 0x1400840d6
lea rdx, str.WIN_2008
jmp 0x140083b24
cmp byte [rax + 0x36], r13b
jne 0x1400840e8
lea rdx, str.WIN_VISTA
jmp 0x140083b24
cmp byte [rax + 0x34], r13b
jne 0x1400840fa
lea rdx, str.WIN_2003
jmp 0x140083b24
cmp byte [rax + 0x32], r13b
jne 0x14008411c
xor ebx, ebx
lea rdx, str.WIN_XPe
lea rcx, str.WIN_XP
cmp byte [rax + 0x44], bl
cmove rdx, rcx
jmp 0x140083b24
mov rcx, r12
cmp byte [rax + 0x30], r13b
jne 0x140084131
lea rdx, str.WIN_2000
jmp 0x140083b27
lea rdx, str.UNKNOWN
jmp 0x140083b27
mov rax, qword [0x1400c6da8]
mov ebx, dword [rax + 8]
jmp 0x140083b60
mov rdx, qword [0x1400c6da8]
mov rcx, r12
add rdx, 0x10
call fcn.140011010
jmp case.0x140083b1b.87
lea rax, [rbp - 0x50]
lea r8, str.InstallLanguage
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.140014370
jmp 0x140083bb4
lea rax, [rbp - 0x50]
lea r8, str.SchemeLangID
lea rdx, str.Control_PanelAppearance
mov r9d, 0x104
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.140014370
movzx edx, word [rbp - 0x50]
mov r8d, 4
mov dword [rbp + 0x548], edx
mov ecx, edx
lea rdx, [rbp - 0x50]
call fcn.14003a6e0
jmp 0x140083bb4
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rbp - 0x70]
jmp 0x140083b24
lea rdx, [0x1400a0f78]
lea rcx, [rbp + 0x2d0]
call fcn.140014d14
xor eax, eax
lea rcx, [rbp + 0x2d0]
mov edi, eax
mov r15d, eax
call fcn.140014cc4
xor ecx, ecx
test eax, eax
jle 0x140084264
lea rbx, [rbp + 0x2d0]
lea r14, [rbp + 0x2d0]
lea esi, [rcx + 0x2e]
movzx eax, word [r14]
cmp ax, 0x20
je 0x14008424a
add edi, r13d
cmp ax, 0x2c
jne 0x140084243
mov word [rbx], si
jmp 0x140084246
mov word [rbx], ax
add rbx, 2
lea rcx, [rbp + 0x2d0]
add r15d, r13d
add r14, 2
call fcn.140014cc4
cmp r15d, eax
jl 0x14008422b
xor ecx, ecx
movsxd rax, edi
lea rdx, [rbp + 0x2d0]
mov word [rbp + rax*2 + 0x2d0], cx
mov rcx, r12
call fcn.140010e90
mov r15, qword [rbp + 0x538]
jmp case.0x140083b1b.87
lea rdx, [rbp - 0x50]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x140083bb4
mov ecx, r13d
lea rdx, [rsp + 0x60]
call fcn.14003aca0
lea rdx, [rsp + 0x60]
jmp 0x140083b24
mov ecx, 2
jmp 0x1400842a4
mov ecx, 3
jmp 0x1400842a4
mov ecx, 4
jmp 0x1400842a4
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x40]
jmp 0x140083b60
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x44]
jmp 0x140083b60
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, r12
mov ebx, eax
call fcn.1400077f0
mov rdx, rdi
mov rcx, rsi
mov dword [r12 + 8], r13d
mov dword [r12], ebx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp case.0x140083b1b.87
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
jmp 0x14008431e
lea rcx, str.COMSPEC
lea rdx, [rbp - 0x50]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x140083bb4
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp - 0x50]
call fcn.140013850
jmp 0x140083bb4
lea rdx, [rbp + 0x548]
lea rcx, [rbp - 0x50]
mov dword [rbp + 0x548], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x140083bb4
mov eax, dword [0x1400c4418]
cmp eax, 3
je case.0x140083b1b.43
cmp eax, 4
jne case.0x140083b1b.30
mov rcx, r12
call fcn.1400077f0
mov dword [r12], r13d
mov dword [r12 + 8], r13d
xor r12d, r12d
mov r13d, r12d
mov rcx, r15
call fcn.1400024f0
lea r11, [rsp + 0x5f0]
mov eax, r13d
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.USERPROFILE
jmp 0x14008436e
lea rcx, str.HOMEDRIVE
jmp 0x14008436e
lea rcx, str.HOMEPATH
jmp 0x14008436e
lea rcx, str.HOMESHARE
jmp 0x14008436e
lea rcx, str.LOGONSERVER
jmp 0x14008436e
lea rcx, str.USERDOMAIN
jmp 0x14008436e
lea rcx, str.USERDNSDOMAIN
jmp 0x14008436e
mov ebx, dword [rbx + 0x23c]
jmp 0x140083b60
mov rdx, qword [rbx + 0x240]
jmp 0x140083b24
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
pxor xmm6, xmm6
mov rcx, r12
mov edx, eax
cvtsi2sd xmm6, rdx
call fcn.1400077f0
movsd qword [r12], xmm6
mov dword [r12 + 8], 3
jmp case.0x140083b1b.87