Function at 0x436c04
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
mov edx, 0x82
mov esi, eax
xor eax, eax
xor ebx, ebx
mov ecx, edx
mov word [ebp - 0x260], bx
lea edi, [ebp - 0x25e]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 0x46c], bx
lea edi, [ebp - 0x46a]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0044b9d2
lea eax, [ebp - 0xc]
push eax
call fcn.0044ba0b
pop ecx
pop ecx
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push dword [ebp + 8]
push dword [ebx*4 + 0x466e00]
call fcn.0044925f
test eax, eax
pop ecx
pop ecx
je 0x436c7a
inc ebx
cmp ebx, 0x5b
jl 0x436c5f
cmp ebx, 0x5b
jne 0x436ce7
push 0x4617a4
lea esi, [ebp - 0x1c]
call fcn.00416bfe
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.00416d3b
push 0
lea eax, [ebp - 8]
push eax
sub esp, 0xc
lea edi, [ebp - 0x1c]
mov esi, esp
call fcn.00416c4c
lea ebx, [ebp - 0x44]
mov edi, 0x47bd20
call fcn.004169e0
cmp dword [ebp - 8], 0
jne 0x436cc2
xor esi, esi
inc esi
jmp 0x436ccf
push dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
call fcn.00418874
xor esi, esi
push dword [ebp - 0x1c]
call fcn.00449078
push dword [ebp + 8]
call fcn.00449078
pop ecx
mov eax, esi
jmp 0x4374f4
cmp ebx, 0x5a
ja case.default.0x436cf0
jmp dword [ebx*4 + 0x4374fc]
push 0x461748
jmp 0x4371ed
push 0x45d7e8
jmp 0x4371ed
push 0x45cb2c
jmp 0x4371ed
push 0x461744
jmp 0x4371ed
push dword [esi + 0x34c]
jmp 0x4374e2
push dword [esi + 0x350]
jmp 0x4374e2
push dword [edi]
push str._.2d
lea eax, [ebp - 0x260]
push eax
call fcn.004493ce
add esp, 0xc
jmp 0x4371e6
push dword [edi + 4]
jmp 0x436d37
push dword [edi + 8]
jmp 0x436d37
push dword [edi + 0xc]
jmp 0x436d37
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x436d37
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x4374d6
mov eax, dword [edi + 0x18]
inc eax
jmp 0x4374d6
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x436d3c
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x436e3e
push 0x104
push str.CommonFilesDir
jmp 0x436d92
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
call fcn.00414513
add esp, 0x10
lea esi, [ebp - 0x260]
call fcn.00414bbc
jmp 0x4371e6
push 0x104
push str.Common_AppData
jmp 0x436e39
mov ebx, 0x104
push ebx
push str.Common_Desktop
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414513
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x4371e6
push ebx
push str.Desktop
push edi
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
jmp 0x4371de
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x260]
jmp 0x4371d9
mov ebx, 0x104
push ebx
push str.Common_Favorites
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414513
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x4371e6
push ebx
push str.Favorites
jmp 0x436e1e
mov ebx, 0x104
push ebx
push str.Common_Programs
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414513
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x4371e6
push ebx
push str.Programs
jmp 0x436e1e
mov ebx, 0x104
push ebx
push str.Common_Start_Menu
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414513
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x4371e6
push ebx
push str.Start_Menu
jmp 0x436e1e
mov ebx, 0x104
push ebx
push str.Common_Startup
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x260]
call fcn.00414513
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x4371e6
push ebx
push str.Startup
jmp 0x436e1e
push 0x104
push str.AppData
jmp 0x436f80
push 0x104
push str.Desktop
jmp 0x436f80
push 0x104
push str.Favorites
jmp 0x436f80
push 0x104
push str.Programs
jmp 0x436f80
push 0x104
push str.Start_Menu
jmp 0x436f80
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x436e1f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x4371e6
push 0x104
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4371e6
push 0x104
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x4371e6
push 6
jmp 0x4374e2
push 9
jmp 0x4374e2
push 5
jmp 0x4374e2
push 0xa
jmp 0x4374e2
push 3
jmp 0x4374e2
push 2
jmp 0x4374e2
push 7
jmp 0x4374e2
push 8
jmp 0x4374e2
push 4
jmp 0x4374e2
xor eax, eax
inc eax
cmp byte [0x4679c6], al
jmp 0x437028
xor eax, eax
inc eax
cmp byte [0x47a6b1], al
mov esi, dword [ebp + 0x14]
jne 0x437033
push eax
jmp 0x4374e5
push 0
jmp 0x4374e5
push 0x40
jmp 0x4374e2
push 0x41
jmp 0x4374e2
push 0x42
jmp 0x4374e2
push 0x43
jmp 0x4374e2
push dword [esi + 0x264]
jmp 0x4371ed
push dword [esi + 0x258]
jmp 0x4371ed
push dword [esi + 0x270]
jmp 0x4371ed
mov eax, dword [esi + 0x288]
mov ecx, 0x47bd30
call fcn.0040fc7f
jmp 0x4374d6
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x4371e6
mov eax, dword [0x479bcc]
mov ecx, eax
dec ecx
je 0x4370d4
dec ecx
je 0x4370ca
dec ecx
je 0x4370c0
neg eax
push eax
push str.UNKN_d
jmp 0x436d3c
push 0x461484
jmp 0x4371ed
push str.IA64
jmp 0x4371ed
push 0x461498
jmp 0x4371ed
cmp byte [0x479bb4], 1
mov edi, dword [ebp + 0x14]
jne 0x4370f4
push str.WIN32_NT
jmp 0x4371f0
push str.WIN32_WINDOWS
jmp 0x4371f0
xor eax, eax
inc eax
cmp byte [0x479bb4], al
jne 0x437170
cmp byte [0x479bba], al
jne 0x43711b
push str.WIN_LONGHORN
jmp 0x4371ed
cmp byte [0x479bc0], al
jne 0x43712d
push str.WIN_VISTA
jmp 0x4371ed
cmp byte [0x479bbe], al
jne 0x43713f
push str.WIN_2003
jmp 0x4371ed
cmp byte [0x479bb8], al
jne 0x437151
push str.WIN_XP
jmp 0x4371ed
cmp byte [0x479bbc], al
mov edi, dword [ebp + 0x14]
jne 0x437166
push str.WIN_2000
jmp 0x4371f0
push str.WIN_NT4
jmp 0x4371f0
cmp byte [0x479bc4], al
jne 0x43717f
push str.WIN_95
jmp 0x4371ed
cmp byte [0x479bc2], al
mov edi, dword [ebp + 0x14]
jne 0x437191
push str.WIN_98
jmp 0x4371f0
push str.WIN_ME
jmp 0x4371f0
push dword [0x4799b0]
jmp 0x4374e2
push 0x4799b4
jmp 0x4371ed
xor eax, eax
inc eax
cmp byte [0x479bb4], al
push 0x104
lea esi, [ebp - 0x260]
jne 0x4371fa
cmp byte [0x479bbd], al
jne 0x4371cf
push str.InstallLanguage
jmp 0x4371d4
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
call fcn.00414513
add esp, 0x10
lea eax, [ebp - 0x260]
push eax
mov edi, dword [ebp + 0x14]
call fcn.00418ad9
jmp case.default.0x436cf0
push 0x45c6d0
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.00414513
add esp, 0x10
lea eax, [ebp - 0x258]
jmp 0x4371ec
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x20]
jmp 0x4371ec
lea eax, [ebp - 0x46c]
push str.3__2__4__9
push eax
call fcn.00449154
lea eax, [ebp - 0x46c]
push eax
xor esi, esi
xor edi, edi
call fcn.004493b8
add esp, 0xc
test eax, eax
jle 0x43728b
mov ax, word [ebp + edi*2 - 0x46c]
cmp ax, 0x20
je 0x437279
cmp ax, 0x2c
jne 0x437270
mov word [ebp + esi*2 - 0x46c], 0x2e
jmp 0x437278
mov word [ebp + esi*2 - 0x46c], ax
inc esi
lea eax, [ebp - 0x46c]
push eax
inc edi
call fcn.004493b8
cmp edi, eax
pop ecx
jl 0x437250
and word [ebp + esi*2 - 0x46c], 0
lea eax, [ebp - 0x46c]
jmp 0x4371ec
push 0x104
lea eax, [ebp - 0x260]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x4371e6
lea eax, [ebp - 0x40]
push eax
xor eax, eax
inc eax
call fcn.004159f1
pop ecx
lea eax, [ebp - 0x40]
jmp 0x4371ec
lea eax, [ebp - 0x40]
push eax
push 2
jmp 0x4372e3
lea eax, [ebp - 0x40]
push eax
push 3
jmp 0x4372e3
lea eax, [ebp - 0x40]
push eax
push 4
pop eax
jmp 0x4372bf
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x4c]
jmp 0x4374e2
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x48]
jmp 0x4374e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
jmp 0x43733c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.00418a14
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x436cf0
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x4371e6
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x436dca
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4371e6
mov eax, dword [0x479be8]
cmp eax, 2
je case.0x436cf0.42
cmp eax, 3
je case.0x436cf0.42
push 0
jmp 0x4374e2
cmp byte [0x479bb4], 0
push 0x104
je 0x4373e5
lea eax, [ebp - 0x260]
push eax
push str.USERPROFILE
jmp 0x43736c
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
call fcn.00414513
mov eax, esi
push eax
call fcn.004493b8
add esp, 0x14
jmp 0x437417
cmp word [ebp + eax*2 - 0x260], 0x5c
je 0x43741a
dec eax
jns 0x43740c
and word [ebp + eax*2 - 0x260], 0
jmp 0x4371e6
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMEDRIVE
jmp 0x43736c
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMEPATH
jmp 0x43736c
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMESHARE
jmp 0x43736c
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.LOGONSERVER
jmp 0x43736c
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.USERDOMAIN
jmp 0x43736c
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.USERDNSDOMAIN
jmp 0x43736c
push dword [esi + 0x318]
jmp 0x4374e2
movzx eax, byte [esi + 0x314]
jmp 0x4374d6
push dword [esi + 0x354]
jmp 0x4374e2
push dword [esi + 0x358]
jmp 0x4371ed
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
jmp 0x4374e2
push 0x51e0001
jmp 0x4374e2
push 1
mov esi, dword [ebp + 0x14]
call fcn.00418a14
push dword [ebp + 8]
call fcn.00449078
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10