Function at 0x42e00a
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov esi, 0x104
xor ebx, ebx
push esi
mov edi, eax
lea eax, [ebp - 0x12f]
push ebx
push eax
mov byte [ebp - 0x130], bl
call fcn.0044fdd0
add esp, 0xc
push esi
lea eax, [ebp - 0x24f]
push ebx
push eax
mov byte [ebp - 0x250], bl
call fcn.0044fdd0
lea eax, [ebp - 0x148]
add esp, 0xc
push eax
mov dword [ebp - 4], ebx
call fcn.00451757
pop ecx
lea eax, [ebp - 0x148]
push eax
call fcn.0045218b
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x471b30]
call fcn.0044d5b0
test eax, eax
pop ecx
pop ecx
je 0x42e08e
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5b
jl 0x42e06d
mov eax, dword [ebp - 4]
cmp eax, 0x5b
jne 0x42e0f0
push 0x46c100
lea esi, [ebp - 0x18]
call fcn.0040dab0
lea eax, [ebp + 8]
mov edi, esi
mov dword [ebp - 8], ebx
call fcn.0040dc17
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea esi, [ebp - 8]
call fcn.0040d895
cmp dword [ebp - 4], ebx
jne 0x42e0e1
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
call fcn.0044d0f0
pop ecx
push dword [ebp + 8]
call fcn.0044d0f0
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
call fcn.0040f6bd
xor ebx, ebx
jmp 0x42e0c6
cmp eax, 0x5a
ja case.default.0x42e0f5
jmp dword [eax*4 + 0x42ec3e]
push 0x46c130
mov edi, dword [ebp + 0x14]
call fcn.0040f936
jmp case.default.0x42e0f5
push 0x469398
jmp 0x42e101
push 0x469b38
jmp 0x42e101
push 0x46c134
jmp 0x42e101
push dword [edi + 0x254]
jmp 0x42eadf
push dword [edi + 0x258]
jmp 0x42eadf
mov eax, dword [ebp - 8]
push dword [eax]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.0044d7ab
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
jmp 0x42e101
mov eax, dword [ebp - 8]
push dword [eax + 4]
jmp 0x42e13b
mov eax, dword [ebp - 8]
push dword [eax + 8]
jmp 0x42e13b
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
jmp 0x42e13b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
inc eax
push eax
jmp 0x42e13b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
jmp 0x42eadf
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
inc eax
jmp 0x42e185
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x42e140
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42e14f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.CommonFilesDir
jmp 0x42e1d9
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e274
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Personal
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x130]
call fcn.0040ba9a
jmp 0x42e14f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_AppData
jmp 0x42e1d9
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e30c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
jmp 0x42e1d9
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Documents
jmp 0x42e1d9
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e3db
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Favorites
jmp 0x42e1d9
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e46b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Programs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Programs
jmp 0x42e1d9
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e4fb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Start_Menu
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Start_Menu
jmp 0x42e1d9
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e58b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Startup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e14f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Startup
jmp 0x42e1d9
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.AppData
jmp 0x42e1d9
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e320
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e3ef
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e47f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e50f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e59f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x42e14f
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x42e14f
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x42e14f
push 6
jmp 0x42eadf
push 3
jmp 0x42eadf
push 9
jmp 0x42eadf
push 5
jmp 0x42eadf
push 0xa
jmp 0x42eadf
push 2
jmp 0x42eadf
push 7
jmp 0x42eadf
push 8
jmp 0x42eadf
push 4
jmp 0x42eadf
push 1
jmp 0x42eadf
cmp byte [0x47354e], 1
mov esi, dword [ebp + 0x14]
jne 0x42e6fe
push 1
jmp 0x42eae2
push ebx
jmp 0x42eae2
cmp byte [0x47ded1], 1
jmp 0x42e6f2
push 0x40
jmp 0x42eadf
push 0x41
jmp 0x42eadf
push 0x42
jmp 0x42eadf
push 0x43
jmp 0x42eadf
push dword [edi + 0x168]
jmp 0x42e101
push dword [edi + 0x15c]
jmp 0x42e101
push dword [edi + 0x174]
jmp 0x42e101
mov ecx, dword [edi + 0x18c]
call fcn.00406178
jmp 0x42e185
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x42e14f
mov eax, dword [0x47d654]
mov ecx, eax
dec ecx
je 0x42e79e
dec ecx
je 0x42e794
dec ecx
je 0x42e78a
neg eax
push eax
push str.UNKN_d
jmp 0x42e140
push 0x46c2a8
jmp 0x42e101
push str.IA64
jmp 0x42e101
push 0x46c29c
jmp 0x42e101
cmp byte [0x47d63c], 1
mov edi, dword [ebp + 0x14]
jne 0x42e7be
push str.WIN32_NT
jmp 0x42e104
push str.WIN32_WINDOWS
jmp 0x42e104
cmp byte [0x47d63c], 1
jne 0x42e83d
cmp byte [0x47d642], 1
jne 0x42e7e4
push str.WIN_LONGHORN
jmp 0x42e101
cmp byte [0x47d648], 1
jne 0x42e7f7
push str.WIN_VISTA
jmp 0x42e101
cmp byte [0x47d646], 1
jne 0x42e80a
push str.WIN_2003
jmp 0x42e101
cmp byte [0x47d640], 1
jne 0x42e81d
push str.WIN_XP
jmp 0x42e101
cmp byte [0x47d644], 1
mov edi, dword [ebp + 0x14]
jne 0x42e833
push str.WIN_2000
jmp 0x42e104
push str.WIN_NT4
jmp 0x42e104
cmp byte [0x47d64c], 1
jne 0x42e850
push str.WIN_95
jmp 0x42e101
cmp byte [0x47d64a], 1
mov edi, dword [ebp + 0x14]
jne 0x42e866
push str.WIN_98
jmp 0x42e104
push str.WIN_ME
jmp 0x42e104
push dword [0x47d538]
jmp 0x42eadf
push 0x47d53c
jmp 0x42e101
cmp byte [0x47d63c], 1
lea eax, [ebp - 4]
push eax
push 1
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
push ebx
jne 0x42e8fb
cmp byte [0x47d645], 1
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
jne 0x42e8d6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.InstallLanguage
jmp 0x42e1d9
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e14f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Default
jmp 0x42e1d9
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e933
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push 0x468eee
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x12c]
jmp 0x42e155
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x18]
jmp 0x42e155
lea eax, [ebp - 0x250]
push 0x46c39c
push eax
call fcn.0044cf30
lea eax, [ebp - 0x250]
push eax
xor esi, esi
xor edi, edi
call fcn.0044d720
add esp, 0xc
test eax, eax
jle 0x42e9ab
mov al, byte [ebp + edi - 0x250]
cmp al, 0x20
je 0x42e999
cmp al, 0x2c
jne 0x42e991
mov byte [ebp + esi - 0x250], 0x2e
jmp 0x42e998
mov byte [ebp + esi - 0x250], al
inc esi
lea eax, [ebp - 0x250]
push eax
inc edi
call fcn.0044d720
cmp edi, eax
pop ecx
jl 0x42e978
mov byte [ebp + esi - 0x250], bl
lea eax, [ebp - 0x250]
jmp 0x42e155
push esi
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x42e14f
lea eax, [ebp - 0x28]
xor esi, esi
push eax
inc esi
call fcn.0040c8a2
pop ecx
lea eax, [ebp - 0x28]
jmp 0x42e155
lea eax, [ebp - 0x28]
push eax
push 2
pop esi
jmp 0x42e9d8
lea eax, [ebp - 0x28]
push eax
push 3
jmp 0x42e9ec
lea eax, [ebp - 0x28]
push eax
push 4
jmp 0x42e9ec
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x42eadf
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x134]
jmp 0x42eadf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.0040f871
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x42e0f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x42ea4e
push esi
lea eax, [ebp - 0x130]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x42e14f
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x42e274
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x42e14f
mov eax, dword [0x47d670]
cmp eax, 2
je case.0x42e0f5.42
cmp eax, 3
je case.0x42e0f5.42
push ebx
mov esi, dword [ebp + 0x14]
call fcn.0040f871
jmp case.default.0x42e0f5
cmp byte [0x47d63c], bl
je 0x42eb03
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERPROFILE
jmp 0x42ea90
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eb4b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130]
push eax
call fcn.0044d720
pop ecx
jmp 0x42eb64
cmp byte [ebp + eax - 0x130], 0x5c
je 0x42eb67
dec eax
jns 0x42eb5a
mov byte [ebp + eax - 0x130], bl
jmp 0x42e14f
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEDRIVE
jmp 0x42ea90
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEPATH
jmp 0x42ea90
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMESHARE
jmp 0x42ea90
push esi
lea eax, [ebp - 0x130]
push eax
push str.LOGONSERVER
jmp 0x42ea90
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDOMAIN
jmp 0x42ea90
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDNSDOMAIN
jmp 0x42ea90
push dword [edi + 0x21c]
jmp 0x42eadf
movzx eax, byte [edi + 0x218]
jmp 0x42e185
push dword [edi + 0x25c]
jmp 0x42eadf
push dword [edi + 0x260]
jmp 0x42e101
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x42ec22
fadd qword [0x46c960]
mov esi, dword [ebp + 0x14]
push ecx
push ecx
fstp qword [esp]
call fcn.0040f91d
jmp case.default.0x42e0f5
push 0x5780000
jmp 0x42eadf