Function at 0x140042fd8
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Initialize winsock library
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6a0]
sub rsp, 0x7a0
mov r14, qword [rdx]
mov rdi, rcx
mov rsi, r8
mov ebx, 0x208
lea rcx, [rbp - 0x3e]
xor r12d, r12d
mov r8d, ebx
xor edx, edx
mov word [rbp - 0x40], r12w
call fcn.14006fdf0
lea rcx, [rbp + 0x2f2]
mov r8d, ebx
xor edx, edx
mov word [rbp + 0x2f0], r12w
call fcn.14006fdf0
lea r13, str.ERROR
lea ebx, [r12 + 1]
mov rcx, qword [r13]
mov rdx, r14
call fcn.140070060
test eax, eax
je 0x140043068
lea rax, [0x14009d740]
add r13, 8
add r12d, ebx
cmp r13, rax
jl 0x140043045
mov r15, qword [rbp + 0x6e8]
cmp r12d, 0x60
jne 0x1400430d3
lea rdx, [0x1400927d0]
lea rcx, [rbp - 0x60]
call fcn.140001c28
lea rcx, [rbp - 0x60]
xor edi, edi
mov rdx, r15
mov dword [rbp + 0x6e8], edi
call fcn.140004f30
lea r8, [rbp + 0x6e8]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
xor r9d, r9d
call fcn.140013db8
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1400430c5
mov rcx, rsi
call fcn.140017e58
mov ebx, edi
lea rcx, [rbp - 0x60]
call fcn.140001d20
jmp 0x1400439c9
cmp r12d, 0x5f
ja case.0x1400430f1.87
lea rdx, [0x140000000]
movsxd rax, r12d
mov ecx, dword [rdx + rax*4 + 0x43a78]
add rcx, rdx
jmp rcx
lea rdx, [0x140092834]
mov rcx, rsi
call fcn.1400182d0
jmp case.0x1400430f1.87
lea rdx, reloc.WSOCK32.dll_inet_addr
jmp 0x1400430fa
lea rdx, [0x14008de4c]
jmp 0x1400430fa
lea rdx, reloc.WSOCK32.dll_htons
jmp 0x1400430fa
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
xor eax, eax
cmp byte [rcx + rdi + 0x19], al
je 0x14004313c
mov rax, qword [rcx + rdi + 0x10]
mov rcx, qword [rax + 0x48]
jmp 0x140043141
mov rcx, qword [rcx + rdi + 0x10]
mov edx, dword [rcx + 0x1c]
jmp 0x1400439bd
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
xor eax, eax
cmp byte [rcx + rdi + 0x19], al
je 0x140043163
mov rax, qword [rcx + rdi + 0x10]
mov rdx, qword [rax + 0x48]
jmp 0x140043168
mov rdx, qword [rcx + rdi + 0x10]
add rdx, 0x28
mov rcx, rsi
call fcn.140017e58
jmp case.0x1400430f1.87
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rbp + 0x1de]
lea rdx, str._.3d
lea rcx, [rbp - 0x40]
call fcn.1400701b0
lea rdx, [rbp - 0x40]
jmp 0x1400430fa
xor ecx, ecx
call fcn.140071b64
lea r8, [0x14009284c]
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14004241c
mov rcx, rsi
mov rdx, rax
call fcn.14001831c
lea rcx, [rbp + 0x1e0]
call fcn.140001d20
jmp case.0x1400430f1.87
xor ecx, ecx
call fcn.140071b64
lea r8, [0x140092854]
lea rdx, [rbp + 0x280]
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
call fcn.14004241c
mov rcx, rsi
mov rdx, rax
call fcn.14001831c
lea rcx, [rbp + 0x280]
jmp 0x1400431dd
xor ecx, ecx
call fcn.140071b64
lea r8, [0x14009285c]
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x78], rax
call fcn.14004241c
mov rcx, rsi
mov rdx, rax
call fcn.14001831c
lea rcx, [rbp + 0x220]
jmp 0x1400431dd
xor ecx, ecx
call fcn.140071b64
lea r8, [0x14008c300]
lea rdx, [rbp + 0x260]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], rax
call fcn.14004241c
mov rcx, rsi
mov rdx, rax
call fcn.14001831c
lea rcx, [rbp + 0x260]
jmp 0x1400431dd
xor ecx, ecx
call fcn.140071b64
lea r8, [0x140092864]
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
call fcn.14004241c
mov rcx, rsi
mov rdx, rax
call fcn.14001831c
lea rcx, [rbp + 0x2a0]
jmp 0x1400431dd
xor ecx, ecx
call fcn.140071b64
lea r8, [0x14009286c]
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x68], rax
call fcn.14004241c
mov rcx, rsi
mov rdx, rax
call fcn.14001831c
lea rcx, [rbp + 0x240]
jmp 0x1400431dd
xor ecx, ecx
call fcn.140071b64
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x2c0]
mov qword [rsp + 0x60], rax
call fcn.140073d54
xor ecx, ecx
test eax, eax
jne 0x140043331
mov r8d, dword [rbp + 0x2d8]
inc r8d
jmp 0x140043334
mov r8d, ecx
lea rdx, [0x14008c300]
jmp 0x140043195
xor ecx, ecx
call fcn.140071b64
lea r8, [0x140092874]
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.14004241c
mov rcx, rsi
mov rdx, rax
call fcn.14001831c
lea rcx, [rbp + 0x200]
jmp 0x1400431dd
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroyData
lea rax, [rbp - 0x40]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x14004319e
mov edx, 0x2b
jmp 0x140043380
mov edx, 5
jmp 0x140043380
mov edx, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
jmp 0x140043380
mov edx, 0x19
jmp 0x140043380
mov edx, 0x2e
jmp 0x140043380
mov edx, SafeArrayAllocDescriptor
jmp 0x140043380
mov edx, reloc.WSOCK32.dll_socket
jmp 0x140043380
mov edx, SafeArrayUnaccessData
jmp 0x140043380
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x140043380
mov edx, 0x1a
jmp 0x140043380
mov edx, reloc.WSOCK32.dll_recv
jmp 0x140043380
mov edx, 6
jmp 0x140043380
mov edx, 2
jmp 0x140043380
mov edx, reloc.WSOCK32.dll_inet_ntoa
jmp 0x140043380
mov edx, 7
jmp 0x140043380
lea rdx, [rbp + 0x6f8]
lea rcx, [rbp - 0x40]
mov dword [rbp + 0x6f8], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x14004319e
lea rcx, [rbp - 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je case.0x1400430f1.87
jmp 0x14004319e
mov rax, qword [0x1400b6b88]
xor edi, edi
cmp byte [rax + 0x3e], dil
je 0x1400434a6
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14004347d
lea rdx, str.GetSystemWow64DirectoryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140043484
lea rax, [fcn.1400075d8]
lea rcx, [rbp - 0x40]
mov edx, 0x104
call rax
test rbx, rbx
je 0x14004319e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14004319e
lea rcx, [rbp - 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x14004319e
xor edx, edx
jmp 0x1400439bd
mov edx, 6
jmp 0x1400439bd
mov edx, 3
jmp 0x1400439bd
mov edx, 9
jmp 0x1400439bd
mov edx, 5
jmp 0x1400439bd
mov edx, 0xa
jmp 0x1400439bd
mov edx, 2
jmp 0x1400439bd
mov edx, 7
jmp 0x1400439bd
mov edx, 8
jmp 0x1400439bd
mov edx, 4
jmp 0x1400439bd
cmp byte [0x1400a4c4a], bl
mov rcx, rsi
jne 0x14004352d
mov edx, ebx
jmp 0x1400439c0
xor edx, edx
jmp 0x1400439c0
cmp byte [0x14009f47d], bl
jmp 0x140043521
mov edx, 0x40
jmp 0x1400439bd
mov edx, 0x41
jmp 0x1400439bd
mov edx, 0x42
jmp 0x1400439bd
mov edx, 0x43
jmp 0x1400439bd
mov rdx, qword [rdi + 0x170]
jmp 0x1400430fa
mov rdx, qword [rdi + 0x150]
jmp 0x1400430fa
mov rdx, qword [rdi + 0x190]
jmp 0x1400430fa
mov ecx, dword [rdi + 0x1c0]
call fcn.14000a9b0
mov edx, eax
jmp 0x1400439bd
lea rdx, [rbp - 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x14004319e
mov rax, qword [0x1400b6b88]
movzx ecx, word [rax + 0x40]
test ecx, ecx
je 0x1400435e6
cmp ecx, 6
je 0x1400435da
cmp ecx, 9
mov rcx, rsi
jne 0x1400436a8
lea rdx, [0x140092898]
jmp 0x1400430fd
lea rdx, str.IA64
jmp 0x1400430fa
lea rdx, [0x140092880]
jmp 0x1400430fa
call fcn.14006ede0
lea rcx, [0x140092898]
lea rdx, [0x140092880]
test al, al
cmovne rdx, rcx
jmp 0x1400430fa
lea rdx, str.WIN32_NT
jmp 0x1400430fa
mov rax, qword [0x1400b6b88]
cmp byte [rax + 0x3c], bl
jne 0x140043634
lea rdx, str.WIN_2008R2
jmp 0x1400430fa
cmp byte [rax + 0x3a], bl
jne 0x140043645
lea rdx, str.WIN_7
jmp 0x1400430fa
cmp byte [rax + 0x38], bl
jne 0x140043656
lea rdx, str.WIN_2008
jmp 0x1400430fa
cmp byte [rax + 0x36], bl
jne 0x140043667
lea rdx, str.WIN_VISTA
jmp 0x1400430fa
cmp byte [rax + 0x34], bl
jne 0x140043678
lea rdx, str.WIN_2003
jmp 0x1400430fa
cmp byte [rax + 0x32], bl
jne 0x140043694
cmp byte [rax + 0x42], 0
lea rcx, str.WIN_XPe
lea rdx, str.WIN_XP
jmp 0x140043607
mov rcx, rsi
cmp byte [rax + 0x30], bl
jne 0x1400436a8
lea rdx, str.WIN_2000
jmp 0x1400430fd
lea rdx, str.UNKNOWN
jmp 0x1400430fd
mov rax, qword [0x1400b6b88]
mov edx, dword [rax + 8]
jmp 0x1400439bd
mov rdx, qword [0x1400b6b88]
mov rcx, rsi
add rdx, 0x10
call fcn.14001831c
jmp case.0x1400430f1.87
lea rax, [rbp - 0x40]
lea r8, str.InstallLanguage
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400114c4
jmp 0x14004319e
lea rax, [rbp - 0x40]
lea r8, str.SchemeLangID
lea rdx, str.Control_PanelAppearance
mov r9d, 0x104
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.1400114c4
movzx ecx, word [rbp - 0x40]
lea rdx, [rbp - 0x40]
mov r8d, 4
mov dword [rbp + 0x6f8], ecx
call fcn.1400137ac
jmp 0x14004319e
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rbp - 0x60]
jmp 0x1400430fa
lea rdx, [0x140092a38]
lea rcx, [rbp + 0x2f0]
call fcn.14006f74c
xor eax, eax
lea rcx, [rbp + 0x2f0]
mov r12d, eax
mov r15d, eax
call fcn.14006f364
xor ecx, ecx
test eax, eax
jle 0x1400437dc
lea rdi, [rbp + 0x2f0]
lea r14, [rbp + 0x2f0]
lea r13d, [rcx + 0x2e]
movzx eax, word [r14]
cmp ax, 0x20
je 0x1400437c2
add r12d, ebx
cmp ax, 0x2c
jne 0x1400437bb
mov word [rdi], r13w
jmp 0x1400437be
mov word [rdi], ax
add rdi, 2
lea rcx, [rbp + 0x2f0]
add r15d, ebx
add r14, 2
call fcn.14006f364
cmp r15d, eax
jl 0x1400437a2
xor ecx, ecx
movsxd rax, r12d
lea rdx, [rbp + 0x2f0]
mov word [rbp + rax*2 + 0x2f0], cx
mov rcx, rsi
call fcn.1400182d0
mov r15, qword [rbp + 0x6e8]
jmp case.0x1400430f1.87
lea rdx, [rbp - 0x40]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x14004319e
lea rdx, [rbp + 0x500]
mov ecx, 0x101
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x14004383d
mov ecx, ebx
lea rdx, [rsp + 0x38]
call fcn.140012b7c
jmp 0x14004384e
lea rdx, [0x14008b090]
lea rcx, [rsp + 0x38]
call fcn.14006f74c
lea rdx, [rsp + 0x38]
jmp 0x1400430fa
lea rdx, [rbp + 0x500]
mov ecx, 0x101
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x14004383d
lea ecx, [rax + 2]
jmp 0x140043831
lea rdx, [rbp + 0x500]
mov ecx, 0x101
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x14004383d
lea ecx, [rax + 3]
jmp 0x140043831
lea rdx, [rbp + 0x500]
mov ecx, 0x101
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x14004383d
lea ecx, [rax + 4]
jmp 0x140043831
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rbp - 0x80]
jmp 0x1400439bd
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rbp - 0x7c]
jmp 0x1400439bd
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, listen
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, rsi
mov edx, eax
call fcn.1400180b8
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp case.0x1400430f1.87
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
jmp 0x1400438f8
lea rcx, str.COMSPEC
lea rdx, [rbp - 0x40]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x14004319e
lea rdx, [rbp - 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp - 0x40]
call fcn.14006f364
sub rax, rbx
cmp word [rbp + rax*2 - 0x40], 0x5c
jne 0x14004319e
xor ecx, ecx
mov word [rbp + rax*2 - 0x40], cx
jmp 0x14004319e
lea rdx, [rbp + 0x6f8]
lea rcx, [rbp - 0x40]
mov dword [rbp + 0x6f8], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x14004319e
mov eax, dword [0x1400b56f8]
cmp eax, 3
je case.0x1400430f1.43
cmp eax, 4
jne case.0x1400430f1.30
mov edx, ebx
mov rcx, rsi
call fcn.1400180b8
xor eax, eax
mov ebx, eax
mov rcx, r15
call fcn.140001d20
mov eax, ebx
mov rbx, qword [rsp + 0x7e0]
add rsp, 0x7a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.USERPROFILE
jmp 0x14004393f
lea rcx, str.HOMEDRIVE
jmp 0x14004393f
lea rcx, str.HOMEPATH
jmp 0x14004393f
lea rcx, str.HOMESHARE
jmp 0x14004393f
lea rcx, str.LOGONSERVER
jmp 0x14004393f
lea rcx, str.USERDOMAIN
jmp 0x14004393f
lea rcx, str.USERDNSDOMAIN
jmp 0x14004393f
mov edx, dword [rdi + 0x23c]
jmp 0x1400439bd
mov rdx, qword [rdi + 0x240]
jmp 0x1400430fa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rsi
mov r11d, eax
pxor xmm1, xmm1
cvtsi2sd xmm1, r11
call fcn.1400182a0
jmp case.0x1400430f1.87