Function at 0x4336fc
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x560
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
mov edi, 0x208
push edi
push eax
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x292]
push eax
call fcn.00456db0
add esp, 0xc
xor eax, eax
push edi
push eax
mov word [ebp - 0x55c], ax
lea eax, [ebp - 0x55a]
push eax
call fcn.00456db0
mov ebx, dword [ebp + 0xc]
add esp, 0xc
xor edi, edi
push ebx
push dword [edi*4 + 0x47a760]
call fcn.00456fac
pop ecx
pop ecx
test eax, eax
je 0x433761
inc edi
cmp edi, 0x60
jl 0x433748
cmp edi, 0x60
jne 0x4337c2
push 0x474e88
lea esi, [ebp - 0x24]
call fcn.00401983
and dword [ebp - 0x10], 0
lea eax, [ebp + 0xc]
push eax
mov eax, esi
call fcn.0040402d
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x24]
call fcn.00410264
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4337b6
xor esi, esi
inc esi
lea ecx, [ebp - 0x24]
call fcn.00401a04
lea ecx, [ebp + 0xc]
call fcn.00401a04
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
mov ebx, dword [ebp + 8]
call fcn.00412fbd
xor esi, esi
jmp 0x43379d
cmp edi, 0x5f
ja case.0x4337cb.87
jmp dword [edi*4 + 0x4340b0]
push 0x474ee4
mov edi, dword [ebp + 8]
call fcn.004132c2
jmp case.0x4337cb.87
push 0x46e560
jmp 0x4337d7
push 0x470a7c
jmp 0x4337d7
push 0x474ee8
jmp 0x4337d7
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea eax, [eax + esi + 4]
call fcn.00418902
push dword [eax + 0x14]
jmp 0x433fc8
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea eax, [eax + esi + 4]
call fcn.00418902
mov ebx, dword [ebp + 8]
add eax, 0x20
call fcn.00412fbd
jmp case.0x4337cb.87
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x296]
push eax
push 0x474eec
lea eax, [ebp - 0x294]
push eax
call fcn.0045710b
add esp, 0xc
lea eax, [ebp - 0x294]
push eax
jmp 0x4337d7
push 0
call fcn.00458723
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov dword [esp], 0x474ef8
push eax
lea eax, [ebp - 0x314]
mov dword [ebp - 0x10], edx
call fcn.00432da9
mov esi, dword [ebp + 8]
push eax
call fcn.004132f8
lea ecx, [ebp - 0x314]
call fcn.00401a04
jmp case.0x4337cb.87
push 0
call fcn.00458723
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
mov dword [esp], 0x474f00
push eax
lea eax, [ebp - 0x304]
mov dword [ebp - 0x38], edx
call fcn.00432da9
mov esi, dword [ebp + 8]
push eax
call fcn.004132f8
lea ecx, [ebp - 0x304]
jmp 0x433894
push 0
call fcn.00458723
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
mov dword [esp], 0x474f08
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x48], edx
call fcn.00432da9
mov esi, dword [ebp + 8]
push eax
call fcn.004132f8
lea ecx, [ebp - 0x2d4]
jmp 0x433894
push 0
call fcn.00458723
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
mov dword [esp], 0x46ef8c
push eax
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x50], edx
call fcn.00432da9
mov esi, dword [ebp + 8]
push eax
call fcn.004132f8
lea ecx, [ebp - 0x2f4]
jmp 0x433894
push 0
call fcn.00458723
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [esp], 0x474f10
push eax
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x28], edx
call fcn.00432da9
mov esi, dword [ebp + 8]
push eax
call fcn.004132f8
lea ecx, [ebp - 0x2e4]
jmp 0x433894
push 0
call fcn.00458723
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
mov dword [esp], 0x474f18
push eax
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x40], edx
call fcn.00432da9
mov esi, dword [ebp + 8]
push eax
call fcn.004132f8
lea ecx, [ebp - 0x2c4]
jmp 0x433894
push 0
call fcn.00458723
mov dword [ebp - 0x34], eax
pop ecx
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x30], edx
call fcn.00432d6c
test eax, eax
je 0x4339d3
mov eax, dword [eax + 0x18]
inc eax
jmp 0x4339d5
xor eax, eax
push eax
push 0x46ef8c
jmp 0x433847
push 0
call fcn.00458723
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [esp], 0x474f20
push eax
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x18], edx
call fcn.00432da9
mov esi, dword [ebp + 8]
push eax
call fcn.004132f8
lea ecx, [ebp - 0x2b4]
jmp 0x433894
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x433856
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x2b
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 5
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x23
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x19
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x2e
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x1f
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x17
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x16
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x18
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x1a
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0x10
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 6
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 2
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 0xb
jmp 0x433a24
lea eax, [ebp - 0x294]
push eax
xor eax, eax
push eax
push eax
push 7
jmp 0x433a24
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x433856
push 0x104
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x433856
mov eax, dword [0x492494]
cmp byte [eax + 0x2a], 0
je 0x433bb0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x433b89
push str.GetSystemWow64DirectoryW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x433b8e
mov eax, 0x405bd1
push 0x104
lea ecx, [ebp - 0x294]
push ecx
call eax
test esi, esi
je 0x433856
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x433856
push 0x104
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x433856
push 6
jmp 0x433fc8
push 3
jmp 0x433fc8
push 9
jmp 0x433fc8
push 5
jmp 0x433fc8
push 0xa
jmp 0x433fc8
push 2
jmp 0x433fc8
push 7
jmp 0x433fc8
push 8
jmp 0x433fc8
push 4
jmp 0x433fc8
push 1
jmp 0x433fc8
xor ecx, ecx
inc ecx
cmp byte [0x48038a], cl
mov esi, dword [ebp + 8]
jne 0x433c21
push ecx
jmp 0x433fcb
push 0
jmp 0x433fcb
xor ecx, ecx
inc ecx
cmp byte [0x4915b9], cl
jmp 0x433c16
push 0x40
jmp 0x433fc8
push 0x41
jmp 0x433fc8
push 0x42
jmp 0x433fc8
push 0x43
jmp 0x433fc8
push dword [esi + 0xc8]
jmp 0x4337d7
push dword [esi + 0xb8]
jmp 0x4337d7
push dword [esi + 0xd8]
jmp 0x4337d7
mov ecx, dword [esi + 0xf4]
call fcn.004086a4
push eax
jmp 0x433fc8
lea eax, [ebp - 0x294]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x433856
mov eax, dword [0x492494]
movzx eax, word [eax + 0x2c]
test eax, eax
je 0x433cca
cmp eax, 6
je 0x433cc0
mov edi, dword [ebp + 8]
cmp eax, 9
jne 0x433d7d
push 0x474f3c
jmp 0x4337da
push str.IA64
jmp 0x4337d7
push 0x474f28
jmp 0x4337d7
call fcn.00454b40
test al, al
mov eax, 0x474f3c
jne 0x43385c
mov eax, 0x474f28
jmp 0x43385c
push str.WIN32_NT
jmp 0x4337d7
mov eax, dword [0x492494]
xor ecx, ecx
inc ecx
cmp byte [eax + 0x28], cl
jne 0x433d11
push str.WIN_2008R2
jmp 0x4337d7
cmp byte [eax + 0x26], cl
jne 0x433d20
push str.WIN_7
jmp 0x4337d7
cmp byte [eax + 0x24], cl
jne 0x433d2f
push str.WIN_2008
jmp 0x4337d7
cmp byte [eax + 0x22], cl
jne 0x433d3e
push str.WIN_VISTA
jmp 0x4337d7
cmp byte [eax + 0x20], cl
jne 0x433d4d
push str.WIN_2003
jmp 0x4337d7
cmp byte [eax + 0x1e], cl
jne 0x433d6b
cmp byte [eax + 0x2e], 0
mov eax, str.WIN_XPe
jne 0x43385c
mov eax, str.WIN_XP
jmp 0x43385c
mov edi, dword [ebp + 8]
cmp byte [eax + 0x1c], cl
jne 0x433d7d
push str.WIN_2000
jmp 0x4337da
push str.UNKNOWN
jmp 0x4337da
mov eax, dword [0x492494]
push dword [eax + 8]
jmp 0x433fc8
mov eax, dword [0x492494]
mov esi, dword [ebp + 8]
add eax, 0xc
push eax
call fcn.004132f8
jmp case.0x4337cb.87
push 0x104
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
lea esi, [ebp - 0x294]
call fcn.0040df33
add esp, 0x10
jmp 0x433856
push 0x104
push str.SchemeLangID
push str.Control_PanelAppearance
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x294]
call fcn.0040df33
movzx eax, word [ebp - 0x294]
push eax
push 4
pop edx
mov ebx, esi
mov dword [ebp - 8], eax
call fcn.0040fca8
add esp, 0x14
jmp 0x433856
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x328]
jmp 0x43385c
lea eax, [ebp - 0x55c]
push str.3__3__7__1
push eax
call fcn.004553d7
lea eax, [ebp - 0x55c]
push eax
xor esi, esi
xor edi, edi
call fcn.00455031
add esp, 0xc
test eax, eax
jle 0x433e7d
movzx eax, word [ebp + edi*2 - 0x55c]
cmp eax, 0x20
je 0x433e6b
cmp eax, 0x2c
jne 0x433e62
push 0x2e
pop eax
mov word [ebp + esi*2 - 0x55c], ax
inc esi
lea eax, [ebp - 0x55c]
push eax
inc edi
call fcn.00455031
pop ecx
cmp edi, eax
jl 0x433e4d
xor eax, eax
mov word [ebp + esi*2 - 0x55c], ax
lea eax, [ebp - 0x55c]
jmp 0x43385c
push 0x104
lea eax, [ebp - 0x294]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x433856
lea eax, [ebp - 0x74]
push eax
xor eax, eax
inc eax
call fcn.0040f332
pop ecx
lea eax, [ebp - 0x74]
jmp 0x43385c
lea eax, [ebp - 0x74]
push eax
push 2
pop eax
jmp 0x433eb2
lea eax, [ebp - 0x74]
push eax
push 3
jmp 0x433ec6
lea eax, [ebp - 0x74]
push eax
push 4
jmp 0x433ec6
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x7c]
jmp 0x433fc8
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x78]
jmp 0x433fc8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 8]
push eax
call fcn.0041315d
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.0x4337cb.87
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x433f22
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x433856
lea eax, [ebp - 0x294]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea esi, [ebp - 0x294]
call fcn.0040e41a
jmp 0x433856
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x433856
mov eax, dword [0x490df4]
cmp eax, 3
je case.0x4337cb.43
cmp eax, 4
je case.0x4337cb.43
push 0
mov esi, dword [ebp + 8]
call fcn.0041315d
xor esi, esi
jmp 0x4337a5
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.USERPROFILE
jmp 0x433f65
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.HOMEDRIVE
jmp 0x433f65
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.HOMEPATH
jmp 0x433f65
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.HOMESHARE
jmp 0x433f65
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.LOGONSERVER
jmp 0x433f65
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.USERDOMAIN
jmp 0x433f65
push 0x104
lea eax, [ebp - 0x294]
push eax
push str.USERDNSDOMAIN
jmp 0x433f65
push dword [esi + 0x148]
jmp 0x433fc8
push dword [esi + 0x14c]
jmp 0x4337d7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
test eax, eax
jns 0x43409d
fadd qword [0x475bd0]
mov esi, dword [ebp + 8]
push ecx
push ecx
fstp qword [esp]
call fcn.004132a6
jmp case.0x4337cb.87