Function at 0x433916
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
mov eax, 0x4555c4
call fcn.00454198
sub esp, 0x260
push ebx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 0x1c]
mov ebx, ecx
call fcn.00413004
and dword [ebp - 4], 0
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x13c], 0
lea edi, [ebp - 0x13b]
rep stosd dword es:[edi], eax
push 0x41
mov byte [ebp - 0x26c], al
pop ecx
lea edi, [ebp - 0x26b]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
xor esi, esi
call fcn.00448972
lea eax, [ebp - 0x20]
push eax
call fcn.004489ab
pop ecx
pop ecx
push dword [ebp - 0x18]
mov edi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push dword [ebp - 0x1c]
push dword [esi*4 + 0x462f10]
call fcn.004464e0
test eax, eax
pop ecx
pop ecx
je 0x43399e
inc esi
cmp esi, 0x59
jl 0x433983
cmp esi, 0x59
jne 0x433a28
push 0x45c190
lea esi, [ebp - 0x148]
call fcn.00413004
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00413157
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
sub esp, 0xc
lea edi, [ebp - 0x148]
mov esi, esp
mov dword [ebp - 0x24], esp
call fcn.00413054
mov ebx, 0x46fd54
call fcn.00412db7
cmp dword [ebp - 0x10], 0
jne 0x4339f8
xor esi, esi
inc esi
jmp 0x433a05
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
call fcn.00414ebd
xor esi, esi
mov byte [ebp - 4], 0
push dword [ebp - 0x148]
call fcn.0044627e
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.0044627e
pop ecx
mov eax, esi
jmp 0x43421b
cmp esi, 0x58
ja case.default.0x433a31
jmp dword [esi*4 + 0x43422e]
push 0x45c160
jmp 0x433f15
push 0x459e50
jmp 0x433f15
push 0x459584
jmp 0x433f15
push 0x45c15c
jmp 0x433f15
push dword [ebx + 0x124]
jmp 0x434205
push dword [ebx + 0x128]
jmp 0x434205
push dword [edi]
push str._.2d
lea eax, [ebp - 0x13c]
push eax
call fcn.00447369
add esp, 0xc
jmp 0x433f0e
push dword [edi + 4]
jmp 0x433a78
push dword [edi + 8]
jmp 0x433a78
push dword [edi + 0xc]
jmp 0x433a78
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x433a78
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x434204
mov eax, dword [edi + 0x18]
inc eax
jmp 0x434204
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x433a7d
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x433b7e
push 0x104
push str.CommonFilesDir
jmp 0x433ad3
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x13c]
call fcn.00410bc8
add esp, 0x10
lea esi, [ebp - 0x13c]
call fcn.00411273
jmp 0x433f0e
push 0x104
push str.Common_AppData
jmp 0x433b79
mov ebx, 0x104
push ebx
push str.Common_Desktop
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x13c]
call fcn.00410bc8
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433f0e
push ebx
push str.Desktop
push edi
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x13c]
jmp 0x433f06
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x13c]
jmp 0x433f01
mov ebx, 0x104
push ebx
push str.Common_Favorites
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x13c]
call fcn.00410bc8
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433f0e
push ebx
push str.Favorites
jmp 0x433b5e
mov ebx, 0x104
push ebx
push str.Common_Programs
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x13c]
call fcn.00410bc8
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433f0e
push ebx
push str.Programs
jmp 0x433b5e
mov ebx, 0x104
push ebx
push str.Common_Start_Menu
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x13c]
call fcn.00410bc8
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433f0e
push ebx
push str.Start_Menu
jmp 0x433b5e
mov ebx, 0x104
push ebx
push str.Common_Startup
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x13c]
call fcn.00410bc8
add esp, 0x10
cmp byte [ebp - 0x13c], 0
jne 0x433f0e
push ebx
push str.Startup
jmp 0x433b5e
push 0x104
push str.AppData
jmp 0x433cbc
push 0x104
push str.Desktop
jmp 0x433cbc
push 0x104
push str.Favorites
jmp 0x433cbc
push 0x104
push str.Programs
jmp 0x433cbc
push 0x104
push str.Start_Menu
jmp 0x433cbc
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x433b5f
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
jmp 0x433f0e
push 0x104
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x433f0e
push 0x104
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x433f0e
push 6
jmp 0x434205
push 9
jmp 0x434205
push 5
jmp 0x434205
push 0xa
jmp 0x434205
push 3
jmp 0x434205
push 2
jmp 0x434205
push 7
jmp 0x434205
push 8
jmp 0x434205
push 4
jmp 0x434205
cmp byte [0x463aef], 1
jmp 0x433d60
cmp byte [0x46eaa9], 1
mov esi, dword [ebp + 0xc]
jne 0x433d6c
push 1
jmp 0x434208
push 0
jmp 0x434208
push 0x40
jmp 0x434205
push 0x41
jmp 0x434205
push 0x42
jmp 0x434205
push 0x43
jmp 0x434205
push dword [ebx + 0x34]
jmp 0x433f15
push dword [ebx + 0x28]
jmp 0x433f15
push dword [ebx + 0x40]
jmp 0x433f15
mov eax, dword [ebx + 0x54]
mov ecx, 0x46fd68
call fcn.0040d154
jmp 0x434204
lea eax, [ebp - 0x13c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x433f0e
mov eax, dword [0x46dfec]
mov ecx, eax
dec ecx
je 0x433e01
dec ecx
je 0x433df7
dec ecx
je 0x433ded
neg eax
push eax
push str.UNKN_d
jmp 0x433a7d
push 0x45bfe8
jmp 0x433f15
push str.IA64
jmp 0x433f15
push 0x45bff4
jmp 0x433f15
cmp byte [0x46dfd4], 1
mov esi, dword [ebp + 0xc]
jne 0x433e21
push str.WIN32_NT
jmp 0x433f18
push str.WIN32_WINDOWS
jmp 0x433f18
mov al, 1
cmp byte [0x46dfd4], al
jne 0x433e99
cmp byte [0x46dfda], al
jne 0x433e47
push str.WIN_LONGHORN
jmp 0x433f15
cmp byte [0x46dfe0], al
jne 0x433e59
push str.WIN_VISTA
jmp 0x433f15
cmp byte [0x46dfde], al
jne 0x433e6b
push str.WIN_2003
jmp 0x433f15
cmp byte [0x46dfd8], al
jne 0x433e7d
push str.WIN_XP
jmp 0x433f15
cmp byte [0x46dfdc], al
mov esi, dword [ebp + 0xc]
jne 0x433e92
push str.WIN_2000
jmp 0x433f18
push str.WIN_NT4
jmp 0x433f18
cmp byte [0x46dfe4], al
jne 0x433ea8
push str.WIN_95
jmp 0x433f15
cmp byte [0x46dfe2], al
mov esi, dword [ebp + 0xc]
jne 0x433eba
push str.WIN_98
jmp 0x433f18
push str.WIN_ME
jmp 0x433f18
push dword [0x46ded0]
jmp 0x434205
push 0x46ded4
jmp 0x433f15
cmp byte [0x46dfd4], 1
push 0x104
lea esi, [ebp - 0x13c]
jne 0x433f22
cmp byte [0x46dfdd], 1
jne 0x433ef7
push str.InstallLanguage
jmp 0x433efc
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00410bc8
add esp, 0x10
lea eax, [ebp - 0x13c]
push eax
mov esi, dword [ebp + 0xc]
call fcn.0041512a
jmp case.default.0x433a31
push 0x459596
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.00410bc8
add esp, 0x10
lea eax, [ebp - 0x138]
jmp 0x433f14
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x164]
jmp 0x433f14
lea eax, [ebp - 0x26c]
push str.3__2__1__14
push eax
call fcn.00446290
lea eax, [ebp - 0x26c]
push eax
xor esi, esi
xor edi, edi
call fcn.00446710
add esp, 0xc
test eax, eax
jle 0x433fb1
mov al, byte [ebp + edi - 0x26c]
cmp al, 0x20
je 0x433f9f
cmp al, 0x2c
jne 0x433f97
mov byte [ebp + esi - 0x26c], 0x2e
jmp 0x433f9e
mov byte [ebp + esi - 0x26c], al
inc esi
lea eax, [ebp - 0x26c]
push eax
inc edi
call fcn.00446710
cmp edi, eax
pop ecx
jl 0x433f7e
mov byte [ebp + esi - 0x26c], 0
lea eax, [ebp - 0x26c]
jmp 0x433f14
push 0x105
lea eax, [ebp - 0x13c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
jmp 0x433f0e
lea eax, [ebp - 0x34]
xor esi, esi
push eax
inc esi
call fcn.00411fa4
pop ecx
lea eax, [ebp - 0x34]
jmp 0x433f14
lea eax, [ebp - 0x34]
push eax
push 2
jmp 0x434008
lea eax, [ebp - 0x34]
push eax
push 3
jmp 0x434008
lea eax, [ebp - 0x34]
push eax
push 4
pop esi
jmp 0x433fe4
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x150]
jmp 0x434205
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x14c]
jmp 0x434205
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
jmp 0x43406d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0xc]
push eax
call fcn.00415029
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x433a31
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
jmp 0x433f0e
lea eax, [ebp - 0x13c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x433b0b
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x433f0e
mov eax, dword [0x46e0a0]
cmp eax, 2
je case.0x433a31.42
cmp eax, 3
je case.0x433a31.42
push 0
jmp 0x434205
push 1
jmp 0x434205
cmp byte [0x46dfd4], 0
push 0x104
je 0x434115
lea eax, [ebp - 0x13c]
push eax
push str.USERPROFILE
jmp 0x43409d
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x13c]
call fcn.00410bc8
mov eax, esi
push eax
call fcn.00446710
add esp, 0x14
jmp 0x434146
cmp byte [ebp + eax - 0x13c], 0x5c
je 0x434149
dec eax
jns 0x43413c
mov byte [ebp + eax - 0x13c], 0
jmp 0x433f0e
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.HOMEDRIVE
jmp 0x43409d
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.HOMEPATH
jmp 0x43409d
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.HOMESHARE
jmp 0x43409d
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.LOGONSERVER
jmp 0x43409d
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.USERDOMAIN
jmp 0x43409d
push 0x104
lea eax, [ebp - 0x13c]
push eax
push str.USERDNSDOMAIN
jmp 0x43409d
push dword [ebx + 0xe4]
jmp 0x434205
movzx eax, byte [ebx + 0xe0]
jmp 0x434204
push dword [ebx + 0x12c]
jmp 0x434205
push dword [ebx + 0x130]
jmp 0x433f15
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
mov esi, dword [ebp + 0xc]
call fcn.00415029
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.0044627e
xor eax, eax
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8