Function at 0x1400800f0
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d0
mov rbx, rcx
mov rbp, r8
mov r15, rdx
mov edi, 0x208
lea rcx, [rax - 0x466]
xor esi, esi
movaps xmmword [rax - 0x48], xmm6
mov r8, rdi
xor edx, edx
mov word [rax - 0x468], si
call fcn.140018a60
lea rcx, [rsp + 0x2b2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x2b0], si
call fcn.140018a60
lea rcx, [rsp + 0x78]
call fcn.14001b53c
lea rcx, [rsp + 0x78]
call fcn.14001e13c
mov r14, qword [r15]
lea r13, str.ERROR
mov rdi, rax
lea r12d, [rsi + 1]
mov rcx, qword [r13]
mov rdx, r14
call fcn.140018cec
test eax, eax
je 0x140080197
lea rax, [0x1400a8788]
add r13, 8
add esi, r12d
cmp r13, rax
jl 0x140080174
cmp esi, 0x5f
jne 0x140080215
lea rdx, [0x14009c848]
lea rcx, [rsp + 0x80]
call fcn.140001ec0
lea rcx, [rsp + 0x80]
xor ebx, ebx
mov rdx, r15
mov dword [rsp + 0x528], ebx
call fcn.140063540
lea r9, [rsp + 0x528]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x80]
lea rcx, [0x1400bdb08]
mov dword [rsp + 0x20], ebx
call fcn.140012fd0
mov rdx, qword [rsp + 0x30]
cmp rdx, rbx
je 0x140080203
mov rcx, rbp
call fcn.140003d50
mov r12d, ebx
lea rcx, [rsp + 0x80]
call fcn.1400032d0
jmp 0x140080a67
cmp esi, 0x5e
ja case.default.0x140080232
lea rdx, [0x140000000]
movsxd rax, esi
mov ecx, dword [rdx + rax*4 + 0x80b40]
add rcx, rdx
jmp rcx
lea rdx, [0x14009c8a4]
mov rcx, rbp
call fcn.140014770
jmp case.default.0x140080232
lea rdx, reloc.WSOCK32.dll_inet_addr
jmp 0x14008023b
lea rdx, [0x140097f34]
jmp 0x14008023b
lea rdx, reloc.WSOCK32.dll_htons
jmp 0x14008023b
lea rcx, [rbx + 0x230]
call fcn.140003920
mov ebx, dword [rax + 0x1c]
mov rcx, rbp
call fcn.140003840
mov dword [rbp], ebx
jmp 0x140080a5e
lea rcx, [rbx + 0x230]
call fcn.140003920
mov ebx, dword [rax + 0x24]
jmp 0x140080272
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rsp + 0x3e]
lea rdx, str._.2d
lea rcx, [rsp + 0xa0]
call fcn.140018e38
lea rdx, [rsp + 0xa0]
jmp 0x14008023b
mov r8d, dword [rdi]
jmp 0x1400802a4
mov r8d, dword [rdi + 4]
jmp 0x1400802a4
mov r8d, dword [rdi + 8]
jmp 0x1400802a4
mov r8d, dword [rdi + 0xc]
jmp 0x1400802a4
mov r8d, dword [rdi + 0x10]
add r8d, r12d
jmp 0x1400802a4
mov ebx, dword [rdi + 0x14]
add ebx, 0x76c
jmp 0x140080272
mov ebx, dword [rdi + 0x18]
add ebx, r12d
jmp 0x140080272
mov r8d, dword [rdi + 0x1c]
lea rdx, str._.3d
add r8d, r12d
jmp 0x1400802ab
lea r8, str.ProgramFilesDir
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0xa0]
mov r9d, 0x104
mov qword [rsp + 0x20], rax
call fcn.1400150a0
jmp 0x1400802b8
lea r8, str.CommonFilesDir
jmp 0x140080312
lea rax, [rsp + 0xa0]
lea r8, str.Personal
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.1400150a0
lea rcx, [rsp + 0xa0]
call fcn.140015c90
jmp 0x1400802b8
lea r8, str.Common_AppData
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x140080319
lea rax, [rsp + 0xa0]
lea r8, str.Common_Desktop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400150a0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400802b8
lea r8, str.Desktop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
jmp 0x140080320
lea r8, str.Common_Documents
jmp 0x14008038c
lea rax, [rsp + 0xa0]
lea r8, str.Common_Favorites
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400150a0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400802b8
lea r8, str.Favorites
jmp 0x1400803d9
lea rax, [rsp + 0xa0]
lea r8, str.Common_Programs
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400150a0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400802b8
lea r8, str.Programs
jmp 0x1400803d9
lea rax, [rsp + 0xa0]
lea r8, str.Common_Start_Menu
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400150a0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400802b8
lea r8, str.Start_Menu
jmp 0x1400803d9
lea rax, [rsp + 0xa0]
lea r8, str.Common_Startup
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400150a0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400802b8
lea r8, str.Startup
jmp 0x1400803d9
lea r8, str.AppData
jmp 0x1400803d9
lea rdx, [rsp + 0x518]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x518], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x1400802b8
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1400802b8
xor eax, eax
cmp byte [0x1400bbe7a], al
je 0x14008059c
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
call fcn.14003f1f0
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call rax
lea rcx, [rsp + 0x30]
call fcn.14003f390
jmp 0x1400802b8
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1400802b8
mov rcx, rbp
call fcn.140003840
xor eax, eax
mov dword [rbp], eax
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 6
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 3
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 9
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 5
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 0xa
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 2
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 7
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 8
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 4
jmp 0x140080a5e
cmp byte [0x1400ab246], r12b
mov rcx, rbp
je 0x140080a55
jmp 0x1400805b7
cmp byte [0x1400bc7ad], r12b
jmp 0x140080681
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 0x40
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 0x41
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 0x42
jmp 0x140080a5e
mov rcx, rbp
call fcn.140003840
mov dword [rbp], 0x43
jmp 0x140080a5e
mov rdx, qword [rbx + 0xa8]
jmp 0x14008023b
mov rdx, qword [rbx + 0x88]
jmp 0x14008023b
mov rdx, qword [rbx + 0xc8]
jmp 0x14008023b
mov edx, dword [rbx + 0xf8]
lea rcx, [0x1400bdb30]
call fcn.140043960
mov ebx, eax
jmp 0x140080272
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x1400802b8
movzx eax, word [0x1400bbe7c]
xor ecx, ecx
cmp eax, ecx
je 0x140080773
cmp eax, 6
je 0x140080767
mov rcx, rbp
cmp eax, 9
jne 0x140080819
lea rdx, [0x14009cb90]
jmp 0x14008023e
lea rdx, str.IA64
jmp 0x14008023b
lea rdx, [0x14009cb78]
jmp 0x14008023b
call fcn.140017ab0
xor r8d, r8d
lea rdx, [0x14009cb90]
lea rcx, [0x14009cb78]
cmp al, r8b
cmove rdx, rcx
jmp 0x14008023b
lea rdx, str.WIN32_NT
jmp 0x14008023b
cmp byte [0x1400bbe72], r12b
jne 0x1400807c2
lea rdx, str.WIN_2008
jmp 0x14008023b
cmp byte [0x1400bbe78], r12b
jne 0x1400807d7
lea rdx, str.WIN_VISTA
jmp 0x14008023b
cmp byte [0x1400bbe76], r12b
jne 0x1400807ec
lea rdx, str.WIN_2003
jmp 0x14008023b
cmp byte [0x1400bbe70], r12b
jne 0x140080801
lea rdx, str.WIN_XP
jmp 0x14008023b
mov rcx, rbp
cmp byte [0x1400bbe74], r12b
jne 0x140080819
lea rdx, str.WIN_2000
jmp 0x14008023e
lea rdx, str.UNKNOWN
jmp 0x14008023e
mov ebx, dword [0x1400bbe48]
jmp 0x140080272
lea rdx, [0x1400bbe50]
mov rcx, rbp
call fcn.1400144b0
jmp case.default.0x140080232
lea r8, str.InstallLanguage
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
jmp 0x140080319
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rsp + 0x80]
jmp 0x14008023b
lea rdx, [0x14009cca0]
lea rcx, [rsp + 0x2b0]
call fcn.140018140
xor eax, eax
lea rcx, [rsp + 0x2b0]
mov edi, eax
mov r13d, eax
call fcn.140018b4c
xor ecx, ecx
cmp eax, ecx
jle 0x1400808e9
lea rbx, [rsp + 0x2b0]
lea rsi, [rsp + 0x2b0]
movzx eax, word [rsi]
cmp ax, 0x20
je 0x1400808ce
add edi, r12d
cmp ax, 0x2c
jne 0x1400808c7
mov eax, 0x2e
mov word [rbx], ax
add rbx, 2
lea rcx, [rsp + 0x2b0]
add r13d, r12d
add rsi, 2
call fcn.140018b4c
cmp r13d, eax
jl 0x1400808b0
xor ecx, ecx
movsxd rax, edi
lea rdx, [rsp + 0x2b0]
mov word [rsp + rax*2 + 0x2b0], cx
jmp 0x14008023b
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x1400802b8
mov ecx, r12d
lea rdx, [rsp + 0x58]
call fcn.140041aa0
lea rdx, [rsp + 0x58]
jmp 0x14008023b
mov ecx, 2
jmp 0x14008091f
mov ecx, 3
jmp 0x14008091f
mov ecx, 4
jmp 0x14008091f
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x50]
jmp 0x140080272
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x54]
jmp 0x140080272
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, listen
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, rbp
mov ebx, eax
call fcn.140003840
mov rdx, rdi
mov rcx, rsi
mov dword [rbp + 8], r12d
mov dword [rbp], ebx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x140080232
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
jmp 0x140080999
lea rcx, str.COMSPEC
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x1400802b8
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x140080373
lea rdx, [rsp + 0x518]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x518], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x1400802b8
mov eax, dword [0x1400bbec8]
cmp eax, 2
je case.0x140080232.43
cmp eax, 3
jne case.0x140080232.30
mov rcx, rbp
call fcn.140003840
mov dword [rbp], r12d
mov dword [rbp + 8], r12d
xor ebp, ebp
mov r12d, ebp
mov rcx, r15
call fcn.1400032d0
lea r11, [rsp + 0x4d0]
mov eax, r12d
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.USERPROFILE
jmp 0x1400809e7
lea rcx, str.HOMEDRIVE
jmp 0x1400809e7
lea rcx, str.HOMEPATH
jmp 0x1400809e7
lea rcx, str.HOMESHARE
jmp 0x1400809e7
lea rcx, str.LOGONSERVER
jmp 0x1400809e7
lea rcx, str.USERDOMAIN
jmp 0x1400809e7
lea rcx, str.USERDNSDOMAIN
jmp 0x1400809e7
mov ebx, dword [rbx + 0x21c]
jmp 0x140080272
movzx ebx, byte [rbx + 0x218]
jmp 0x140080272
mov ebx, dword [rbx + 0x26c]
jmp 0x140080272
mov rdx, qword [rbx + 0x270]
jmp 0x14008023b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
pxor xmm6, xmm6
mov rcx, rbp
mov r11d, eax
cvtsi2sd xmm6, r11
call fcn.140003840
movsd qword [rbp], xmm6
mov dword [rbp + 8], 3
jmp case.default.0x140080232