Function at 0x46f9e3
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get program files directory
Get session user name
Get startup folder
Query environment variable

Disassembly:
sub esp, 0x53c
push ebx
push ebp
mov ebp, dword [esp + 0x54c]
push esi
mov esi, dword [esp + 0x54c]
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x72]
push ecx
mov word [esp + 0x74], ax
call fcn.00412fa0
add esp, 0xc
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x342]
push eax
mov word [esp + 0x344], dx
call fcn.00412fa0
mov ecx, dword [esp + 0x564]
add esp, 0xc
xor edi, edi
mov dword [esp + 0x10], ecx
lea ebx, [edi + 1]
mov edx, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x490950]
push edx
push eax
call fcn.00413194
add esp, 8
test eax, eax
je 0x46fa65
add edi, ebx
cmp edi, 0x60
jl 0x46fa45
cmp edi, 0x60
jne 0x46fae0
mov edi, 0x48a7f0
lea esi, [esp + 0x28]
call fcn.00401b60
lea ecx, [esp + 0x558]
push ecx
mov eax, esi
mov dword [esp + 0x14], 0
call fcn.0040bfb0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
xor ecx, ecx
call fcn.0040c220
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x46faca
mov ecx, esi
call fcn.00402610
lea ecx, [esp + 0x558]
call fcn.00402610
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x53c
ret 0x18
push eax
mov ebx, ebp
call fcn.004091d0
lea ecx, [esp + 0x28]
call fcn.00402610
jmp case.0x46fae9.87
cmp edi, 0x5f
ja case.0x46fae9.87
jmp dword [edi*4 + 0x4707c7]
mov edi, 0x48a84c
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov edi, 0x483eb0
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov edi, 0x4863e8
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov edi, 0x48a850
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
lea eax, [edx + esi + 4]
call fcn.00404100
mov edi, dword [eax + 0x14]
mov esi, ebp
call fcn.00409280
mov dword [ebp], edi
jmp 0x4707a8
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx + esi + 4]
call fcn.00404100
mov edi, dword [eax + 0x1c]
mov esi, ebp
call fcn.00409280
mov dword [ebp], edi
jmp 0x4707a8
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x26]
push eax
push 0x48a854
lea ecx, [esp + 0x70]
push ecx
call fcn.004132ea
add esp, 0xc
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
push 0x48a860
lea edx, [esp + 0x2d0]
push edx
lea eax, [esp + 0x2bc]
push eax
call fcn.0044204a
push eax
call fcn.00451fb2
mov edi, eax
mov esi, ebp
call fcn.0040e370
lea ecx, [esp + 0x2cc]
call fcn.00402610
jmp case.0x46fae9.87
push 0x48a868
lea ecx, [esp + 0x280]
push ecx
lea edx, [esp + 0x314]
push edx
call fcn.0044204a
push eax
call fcn.00451fb2
mov edi, eax
mov esi, ebp
call fcn.0040e370
lea ecx, [esp + 0x27c]
call fcn.00402610
jmp case.0x46fae9.87
push 0x48a870
lea eax, [esp + 0x2f0]
push eax
lea ecx, [esp + 0x31c]
push ecx
call fcn.0044204a
push eax
call fcn.00451fb2
mov edi, eax
mov esi, ebp
call fcn.0040e370
lea ecx, [esp + 0x2ec]
call fcn.00402610
jmp case.0x46fae9.87
push 0x4848f0
lea edx, [esp + 0x290]
push edx
lea eax, [esp + 0x324]
push eax
call fcn.0044204a
push eax
call fcn.00451fb2
mov edi, eax
mov esi, ebp
call fcn.0040e370
lea ecx, [esp + 0x28c]
call fcn.00402610
jmp case.0x46fae9.87
push 0x48a878
lea ecx, [esp + 0x2a8]
push ecx
lea edx, [esp + 0x30c]
push edx
call fcn.0044204a
push eax
call fcn.00451fb2
mov edi, eax
mov esi, ebp
call fcn.0040e370
lea ecx, [esp + 0x2a4]
call fcn.00402610
jmp case.0x46fae9.87
push 0x48a880
lea eax, [esp + 0x2c0]
push eax
lea ecx, [esp + 0x2a4]
push ecx
call fcn.0044204a
push eax
call fcn.00451fb2
mov edi, eax
mov esi, ebp
call fcn.0040e370
lea ecx, [esp + 0x2bc]
call fcn.00402610
jmp case.0x46fae9.87
lea edx, [esp + 0x2fc]
push edx
call fcn.0044204a
push eax
call fcn.0045202e
push eax
push 0x4848f0
lea eax, [esp + 0x70]
push eax
jmp 0x46fb8f
push 0x48a888
lea ecx, [esp + 0x2e0]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.0044204a
push eax
call fcn.00451fb2
mov edi, eax
mov esi, ebp
call fcn.0040e370
lea ecx, [esp + 0x2dc]
call fcn.00402610
jmp case.0x46fae9.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x1f
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0x16
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x18
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0xb
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x6c]
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
push 0x104
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov ecx, dword [0x4a839c]
cmp byte [ecx + 0x2a], 0
push 0x104
lea edx, [esp + 0x6c]
push edx
je 0x47001b
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
call fcn.00433ac1
call eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00433cbc
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov esi, ebp
call fcn.00409280
mov dword [ebp], 6
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 3
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 9
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 5
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 0xa
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 2
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 7
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 8
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 4
jmp 0x4707a8
mov esi, ebp
cmp byte [0x496292], bl
jne 0x47079c
call fcn.00409280
mov dword [ebp], ebx
jmp 0x4707a8
mov esi, ebp
cmp byte [0x4a74c1], bl
jne 0x47079c
call fcn.00409280
mov dword [ebp], ebx
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 0x40
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 0x41
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 0x42
jmp 0x4707a8
mov esi, ebp
call fcn.00409280
mov dword [ebp], 0x43
jmp 0x4707a8
mov edi, dword [esi + 0xc0]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov edi, dword [esi + 0xb0]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov edi, dword [esi + 0xd0]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov eax, dword [esi + 0xec]
push eax
call fcn.00437541
mov esi, ebp
mov edi, eax
call fcn.00409280
mov dword [ebp], edi
jmp 0x4707a8
lea ecx, [esp + 0x68]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov edx, dword [0x4a839c]
movzx eax, word [edx + 0x2c]
test eax, eax
je 0x470221
cmp eax, 6
je 0x4701fe
mov ebx, ebp
cmp eax, 9
jne 0x4702f1
mov edi, 0x48a8a4
call fcn.0040e420
jmp case.0x46fae9.87
mov edi, str.IA64
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
call fcn.00410ac0
mov edi, 0x48a8a4
test al, al
jne 0x46fb9b
mov edi, 0x48a890
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov edi, str.WIN32_NT
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov eax, dword [0x4a839c]
cmp byte [eax + 0x28], bl
jne 0x47025e
mov edi, str.WIN_2008R2
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
cmp byte [eax + 0x26], bl
jne 0x470274
mov edi, str.WIN_7
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
cmp byte [eax + 0x24], bl
jne 0x47028a
mov edi, str.WIN_2008
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
cmp byte [eax + 0x22], bl
jne 0x4702a0
mov edi, str.WIN_VISTA
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
cmp byte [eax + 0x20], bl
jne 0x4702b6
mov edi, str.WIN_2003
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
cmp byte [eax + 0x1e], bl
jne 0x4702db
cmp byte [eax + 0x2e], 0
mov edi, str.WIN_XPe
jne 0x46fb9b
mov edi, str.WIN_XP
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
cmp byte [eax + 0x1c], bl
mov ebx, ebp
jne 0x4702f1
mov edi, str.WIN_2000
call fcn.0040e420
jmp case.0x46fae9.87
mov edi, str.UNKNOWN
call fcn.0040e420
jmp case.0x46fae9.87
mov eax, dword [0x4a839c]
mov edi, dword [eax + 8]
mov esi, ebp
call fcn.00409280
mov dword [ebp], edi
jmp 0x4707a8
mov edi, dword [0x4a839c]
add edi, 0xc
mov esi, ebp
call fcn.0040e370
jmp case.0x46fae9.87
push 0x104
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
lea esi, [esp + 0x78]
call fcn.0040ee60
add esp, 0x10
mov edi, esi
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
push 0x104
push str.SchemeLangID
push str.Control_PanelAppearance
push reloc.WSOCK32.dll_accept
lea esi, [esp + 0x78]
call fcn.0040ee60
movzx eax, word [esp + 0x78]
push 4
push esi
push eax
mov dword [esp + 0x30], eax
call fcn.0043578c
add esp, 0x1c
mov edi, esi
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea edx, [esp + 0x324]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea edi, [esp + 0x324]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea eax, [esp + 0x338]
push str.3__3__5__1
push eax
call fcn.00411441
lea ecx, [esp + 0x340]
push ecx
xor esi, esi
xor edi, edi
call fcn.00411085
add esp, 0xc
test eax, eax
jle 0x470428
movzx eax, word [esp + edi*2 + 0x338]
cmp ax, 0x20
je 0x470412
cmp ax, 0x2c
jne 0x470408
mov edx, 0x2e
mov word [esp + esi*2 + 0x338], dx
jmp 0x470410
mov word [esp + esi*2 + 0x338], ax
add esi, ebx
lea eax, [esp + 0x338]
push eax
add edi, ebx
call fcn.00411085
add esp, 4
cmp edi, eax
jl 0x4703e5
xor ecx, ecx
lea edi, [esp + 0x338]
mov ebx, ebp
mov word [esp + esi*2 + 0x338], cx
call fcn.0040e420
jmp case.0x46fae9.87
push 0x104
lea edx, [esp + 0x6c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.00435e21
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea ecx, [esp + 0x48]
push ecx
push 2
call fcn.00435e21
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea edx, [esp + 0x48]
push edx
push 3
call fcn.00435e21
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea eax, [esp + 0x48]
push eax
push 4
call fcn.00435e21
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x40]
mov esi, ebp
call fcn.00409280
mov dword [ebp], edi
jmp 0x4707a8
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x44]
mov esi, ebp
call fcn.00409280
mov dword [ebp], edi
jmp 0x4707a8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x18], eax
call fcn.00409280
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push ecx
push edi
mov dword [ebp + 8], ebx
mov dword [ebp], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.0x46fae9.87
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x18], eax
call fcn.00409280
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push eax
push edi
mov dword [ebp + 8], ebx
mov dword [ebp], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.0x46fae9.87
push 0x104
lea ecx, [esp + 0x6c]
push ecx
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea edx, [esp + 0x68]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea esi, [esp + 0x68]
call fcn.0040fe80
mov edi, esi
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x6c]
push ecx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov eax, dword [0x4a6cfc]
cmp eax, 3
je case.0x46fae9.43
cmp eax, 4
jne case.0x46fae9.30
mov esi, ebp
call fcn.00409280
mov dword [ebp], ebx
jmp 0x4707a8
push 0x104
lea edx, [esp + 0x6c]
push edx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
push 0x104
lea eax, [esp + 0x6c]
push eax
push str.HOMEDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
push 0x104
lea ecx, [esp + 0x6c]
push ecx
push str.HOMEPATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
push 0x104
lea edx, [esp + 0x6c]
push edx
push str.HOMESHARE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
push 0x104
lea eax, [esp + 0x6c]
push eax
push str.LOGONSERVER
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
push 0x104
lea ecx, [esp + 0x6c]
push ecx
push str.USERDOMAIN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
push 0x104
lea edx, [esp + 0x6c]
push edx
push str.USERDNSDOMAIN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
mov edi, dword [esi + 0x140]
mov esi, ebp
call fcn.00409280
mov dword [ebp], edi
jmp 0x4707a8
mov edi, dword [esi + 0x144]
mov ebx, ebp
call fcn.0040e420
jmp case.0x46fae9.87
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
test eax, eax
jge 0x47077f
fadd qword [0x48b508]
mov esi, ebp
fstp qword [esp + 0x18]
call fcn.00409280
fld qword [esp + 0x18]
fstp qword [ebp]
mov dword [ebp + 8], 3
jmp case.0x46fae9.87
mov esi, ebp
call fcn.00409280
mov dword [ebp], 0
mov dword [ebp + 8], ebx
lea ecx, [esp + 0x558]
call fcn.00402610
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x53c
ret 0x18