Function at 0x43674f
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
mov edx, 0x82
mov esi, eax
xor eax, eax
xor ebx, ebx
mov ecx, edx
mov word [ebp - 0x260], bx
lea edi, [ebp - 0x25e]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 0x46c], bx
lea edi, [ebp - 0x46a]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0044b202
lea eax, [ebp - 0xc]
push eax
call fcn.0044b23b
pop ecx
pop ecx
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push dword [ebp + 8]
push dword [ebx*4 + 0x465e10]
call fcn.00448ab3
test eax, eax
pop ecx
pop ecx
je 0x4367c5
inc ebx
cmp ebx, 0x5a
jl 0x4367aa
cmp ebx, 0x5a
jne 0x436832
push 0x460734
lea esi, [ebp - 0x1c]
call fcn.00416a3c
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.00416b79
push 0
lea eax, [ebp - 8]
push eax
sub esp, 0xc
lea edi, [ebp - 0x1c]
mov esi, esp
call fcn.00416a8a
lea ebx, [ebp - 0x44]
mov edi, 0x47ad20
call fcn.00416811
cmp dword [ebp - 8], 0
jne 0x43680d
xor esi, esi
inc esi
jmp 0x43681a
push dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
call fcn.004185a1
xor esi, esi
push dword [ebp - 0x1c]
call fcn.004488cc
push dword [ebp + 8]
call fcn.004488cc
pop ecx
mov eax, esi
jmp 0x43703a
cmp ebx, 0x59
ja case.default.0x43683b
jmp dword [ebx*4 + 0x437043]
push 0x4606d8
jmp 0x436d38
push 0x45c7e8
jmp 0x436d38
push 0x45bb2c
jmp 0x436d38
push 0x4606d4
jmp 0x436d38
push dword [esi + 0x34c]
jmp 0x437028
push dword [esi + 0x350]
jmp 0x437028
push dword [edi]
push str._.2d
lea eax, [ebp - 0x260]
push eax
call fcn.00448c22
add esp, 0xc
jmp 0x436d31
push dword [edi + 4]
jmp 0x436882
push dword [edi + 8]
jmp 0x436882
push dword [edi + 0xc]
jmp 0x436882
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x436882
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x437020
mov eax, dword [edi + 0x18]
inc eax
jmp 0x437020
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x436887
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x436989
push 0x104
push str.CommonFilesDir
jmp 0x4368dd
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
call fcn.00414343
add esp, 0x10
lea esi, [ebp - 0x260]
call fcn.004149ec
jmp 0x436d31
push 0x104
push str.Common_AppData
jmp 0x436984
mov ebx, 0x104
push ebx
push str.Common_Desktop
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414343
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436d31
push ebx
push str.Desktop
push edi
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
jmp 0x436d29
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x260]
jmp 0x436d24
mov ebx, 0x104
push ebx
push str.Common_Favorites
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414343
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436d31
push ebx
push str.Favorites
jmp 0x436969
mov ebx, 0x104
push ebx
push str.Common_Programs
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414343
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436d31
push ebx
push str.Programs
jmp 0x436969
mov ebx, 0x104
push ebx
push str.Common_Start_Menu
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414343
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436d31
push ebx
push str.Start_Menu
jmp 0x436969
mov ebx, 0x104
push ebx
push str.Common_Startup
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414343
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x436d31
push ebx
push str.Startup
jmp 0x436969
push 0x104
push str.AppData
jmp 0x436acb
push 0x104
push str.Desktop
jmp 0x436acb
push 0x104
push str.Favorites
jmp 0x436acb
push 0x104
push str.Programs
jmp 0x436acb
push 0x104
push str.Start_Menu
jmp 0x436acb
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x43696a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x436d31
push 0x104
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x436d31
push 0x104
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x436d31
push 6
jmp 0x437028
push 9
jmp 0x437028
push 5
jmp 0x437028
push 0xa
jmp 0x437028
push 3
jmp 0x437028
push 2
jmp 0x437028
push 7
jmp 0x437028
push 8
jmp 0x437028
push 4
jmp 0x437028
xor eax, eax
inc eax
cmp byte [0x4669c6], al
jmp 0x436b73
xor eax, eax
inc eax
cmp byte [0x4796b1], al
mov esi, dword [ebp + 0x14]
jne 0x436b7e
push eax
jmp 0x43702b
push 0
jmp 0x43702b
push 0x40
jmp 0x437028
push 0x41
jmp 0x437028
push 0x42
jmp 0x437028
push 0x43
jmp 0x437028
push dword [esi + 0x264]
jmp 0x436d38
push dword [esi + 0x258]
jmp 0x436d38
push dword [esi + 0x270]
jmp 0x436d38
mov eax, dword [esi + 0x288]
mov ecx, 0x47ad30
call fcn.0040fc4b
jmp 0x437020
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x436d31
mov eax, dword [0x478bcc]
mov ecx, eax
dec ecx
je 0x436c1f
dec ecx
je 0x436c15
dec ecx
je 0x436c0b
neg eax
push eax
push str.UNKN_d
jmp 0x436887
push 0x460414
jmp 0x436d38
push str.IA64
jmp 0x436d38
push 0x460428
jmp 0x436d38
cmp byte [0x478bb4], 1
mov edi, dword [ebp + 0x14]
jne 0x436c3f
push str.WIN32_NT
jmp 0x436d3b
push str.WIN32_WINDOWS
jmp 0x436d3b
xor eax, eax
inc eax
cmp byte [0x478bb4], al
jne 0x436cbb
cmp byte [0x478bba], al
jne 0x436c66
push str.WIN_LONGHORN
jmp 0x436d38
cmp byte [0x478bc0], al
jne 0x436c78
push str.WIN_VISTA
jmp 0x436d38
cmp byte [0x478bbe], al
jne 0x436c8a
push str.WIN_2003
jmp 0x436d38
cmp byte [0x478bb8], al
jne 0x436c9c
push str.WIN_XP
jmp 0x436d38
cmp byte [0x478bbc], al
mov edi, dword [ebp + 0x14]
jne 0x436cb1
push str.WIN_2000
jmp 0x436d3b
push str.WIN_NT4
jmp 0x436d3b
cmp byte [0x478bc4], al
jne 0x436cca
push str.WIN_95
jmp 0x436d38
cmp byte [0x478bc2], al
mov edi, dword [ebp + 0x14]
jne 0x436cdc
push str.WIN_98
jmp 0x436d3b
push str.WIN_ME
jmp 0x436d3b
push dword [0x4789b0]
jmp 0x437028
push 0x4789b4
jmp 0x436d38
xor eax, eax
inc eax
cmp byte [0x478bb4], al
push 0x104
lea esi, [ebp - 0x260]
jne 0x436d45
cmp byte [0x478bbd], al
jne 0x436d1a
push str.InstallLanguage
jmp 0x436d1f
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
call fcn.00414343
add esp, 0x10
lea eax, [ebp - 0x260]
push eax
mov edi, dword [ebp + 0x14]
call fcn.00418806
jmp case.default.0x43683b
push 0x45b6d0
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.00414343
add esp, 0x10
lea eax, [ebp - 0x258]
jmp 0x436d37
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x20]
jmp 0x436d37
lea eax, [ebp - 0x46c]
push 0x460234
push eax
call fcn.004489a8
lea eax, [ebp - 0x46c]
push eax
xor esi, esi
xor edi, edi
call fcn.00448c0c
add esp, 0xc
test eax, eax
jle 0x436dd6
mov ax, word [ebp + edi*2 - 0x46c]
cmp ax, 0x20
je 0x436dc4
cmp ax, 0x2c
jne 0x436dbb
mov word [ebp + esi*2 - 0x46c], 0x2e
jmp 0x436dc3
mov word [ebp + esi*2 - 0x46c], ax
inc esi
lea eax, [ebp - 0x46c]
push eax
inc edi
call fcn.00448c0c
cmp edi, eax
pop ecx
jl 0x436d9b
and word [ebp + esi*2 - 0x46c], 0
lea eax, [ebp - 0x46c]
jmp 0x436d37
push 0x104
lea eax, [ebp - 0x260]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x436d31
lea eax, [ebp - 0x40]
xor edi, edi
push eax
inc edi
call fcn.00415821
pop ecx
lea eax, [ebp - 0x40]
jmp 0x436d37
lea eax, [ebp - 0x40]
push eax
push 2
jmp 0x436e2e
lea eax, [ebp - 0x40]
push eax
push 3
jmp 0x436e2e
lea eax, [ebp - 0x40]
push eax
push 4
pop edi
jmp 0x436e0a
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x4c]
jmp 0x437028
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x48]
jmp 0x437028
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
jmp 0x436e87
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.00418741
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x43683b
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x436d31
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x436915
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x436d31
mov eax, dword [0x478be8]
cmp eax, 2
je case.0x43683b.42
cmp eax, 3
je case.0x43683b.42
push 0
jmp 0x437028
push 1
jmp 0x437028
cmp byte [0x478bb4], 0
push 0x104
je 0x436f2f
lea eax, [ebp - 0x260]
push eax
push str.USERPROFILE
jmp 0x436eb7
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
call fcn.00414343
mov eax, esi
push eax
call fcn.00448c0c
add esp, 0x14
jmp 0x436f61
cmp word [ebp + eax*2 - 0x260], 0x5c
je 0x436f64
dec eax
jns 0x436f56
and word [ebp + eax*2 - 0x260], 0
jmp 0x436d31
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMEDRIVE
jmp 0x436eb7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMEPATH
jmp 0x436eb7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMESHARE
jmp 0x436eb7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.LOGONSERVER
jmp 0x436eb7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.USERDOMAIN
jmp 0x436eb7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.USERDNSDOMAIN
jmp 0x436eb7
push dword [esi + 0x318]
jmp 0x437028
movzx eax, byte [esi + 0x314]
jmp 0x437020
push dword [esi + 0x354]
jmp 0x437028
push dword [esi + 0x358]
jmp 0x436d38
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
jmp 0x437028
push 0x51e0001
mov esi, dword [ebp + 0x14]
call fcn.00418741
push dword [ebp + 8]
call fcn.004488cc
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10