Function at 0x42f4e8
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov esi, 0x104
xor ebx, ebx
push esi
mov edi, eax
lea eax, [ebp - 0x12f]
push ebx
push eax
mov byte [ebp - 0x130], bl
call fcn.004512b0
add esp, 0xc
push esi
lea eax, [ebp - 0x24f]
push ebx
push eax
mov byte [ebp - 0x250], bl
call fcn.004512b0
lea eax, [ebp - 0x148]
add esp, 0xc
push eax
mov dword [ebp - 4], ebx
call fcn.00453c2a
pop ecx
lea eax, [ebp - 0x148]
push eax
call fcn.0045464b
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x473a20]
call fcn.00451490
test eax, eax
pop ecx
pop ecx
je 0x42f56c
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5c
jl 0x42f54b
mov eax, dword [ebp - 4]
cmp eax, 0x5c
jne 0x42f5ce
push 0x46e28c
lea esi, [ebp - 0x18]
call fcn.0040fcfe
lea eax, [ebp + 8]
mov edi, esi
mov dword [ebp - 8], ebx
call fcn.0040fece
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea esi, [ebp - 8]
call fcn.0040fb07
cmp dword [ebp - 4], ebx
jne 0x42f5bf
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
call fcn.0044f500
pop ecx
push dword [ebp + 8]
call fcn.0044f500
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
call fcn.00412380
xor ebx, ebx
jmp 0x42f5a4
cmp eax, 0x5b
ja case.default.0x42f5d3
jmp dword [eax*4 + 0x430124]
push 0x46e2bc
mov edi, dword [ebp + 0x14]
call fcn.004125f9
jmp case.default.0x42f5d3
push 0x46b4ac
jmp 0x42f5df
push 0x46bc20
jmp 0x42f5df
push 0x46e2c0
jmp 0x42f5df
lea eax, [edi + 0x220]
call fcn.0041c534
push dword [eax + 0x14]
jmp 0x42ffcd
lea eax, [edi + 0x220]
call fcn.0041c534
push dword [eax + 0x1c]
jmp 0x42ffcd
mov eax, dword [ebp - 8]
push dword [eax]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.00451879
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
jmp 0x42f5df
mov eax, dword [ebp - 8]
push dword [eax + 4]
jmp 0x42f629
mov eax, dword [ebp - 8]
push dword [eax + 8]
jmp 0x42f629
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
jmp 0x42f629
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
inc eax
push eax
jmp 0x42f629
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
jmp 0x42ffcd
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
inc eax
jmp 0x42f673
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x42f62e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42f63d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.CommonFilesDir
jmp 0x42f6c7
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f762
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Personal
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x130]
call fcn.0040dd1a
jmp 0x42f63d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_AppData
jmp 0x42f6c7
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f63d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
jmp 0x42f6c7
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Documents
jmp 0x42f6c7
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f8c9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f63d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Favorites
jmp 0x42f6c7
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f959
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Programs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f63d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Programs
jmp 0x42f6c7
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f9e9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Start_Menu
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f63d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Start_Menu
jmp 0x42f6c7
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42fa79
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Startup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f63d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Startup
jmp 0x42f6c7
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.AppData
jmp 0x42f6c7
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42f80e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42f8dd
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42f96d
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42f9fd
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42fa8d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x42f63d
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x42f63d
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x42f63d
push 6
jmp 0x42ffcd
push 3
jmp 0x42ffcd
push 9
jmp 0x42ffcd
push 5
jmp 0x42ffcd
push 0xa
jmp 0x42ffcd
push 2
jmp 0x42ffcd
push 7
jmp 0x42ffcd
push 8
jmp 0x42ffcd
push 4
jmp 0x42ffcd
push 1
jmp 0x42ffcd
cmp byte [0x4754ae], 1
mov esi, dword [ebp + 0x14]
jne 0x42fbec
push 1
jmp 0x42ffd0
push ebx
jmp 0x42ffd0
cmp byte [0x47e6e1], 1
jmp 0x42fbe0
push 0x40
jmp 0x42ffcd
push 0x41
jmp 0x42ffcd
push 0x42
jmp 0x42ffcd
push 0x43
jmp 0x42ffcd
push dword [edi + 0x160]
jmp 0x42f5df
push dword [edi + 0x154]
jmp 0x42f5df
push dword [edi + 0x16c]
jmp 0x42f5df
mov ecx, dword [edi + 0x184]
call fcn.004083e4
jmp 0x42f673
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x42f63d
mov eax, dword [0x47e0f4]
mov ecx, eax
dec ecx
je 0x42fc8c
dec ecx
je 0x42fc82
dec ecx
je 0x42fc78
neg eax
push eax
push str.UNKN_d
jmp 0x42f62e
push 0x46e438
jmp 0x42f5df
push str.IA64
jmp 0x42f5df
push 0x46e42c
jmp 0x42f5df
cmp byte [0x47e0dc], 1
mov edi, dword [ebp + 0x14]
jne 0x42fcac
push str.WIN32_NT
jmp 0x42f5e2
push str.WIN32_WINDOWS
jmp 0x42f5e2
cmp byte [0x47e0dc], 1
jne 0x42fd2b
cmp byte [0x47e0e2], 1
jne 0x42fcd2
push str.WIN_2008
jmp 0x42f5df
cmp byte [0x47e0e8], 1
jne 0x42fce5
push str.WIN_VISTA
jmp 0x42f5df
cmp byte [0x47e0e6], 1
jne 0x42fcf8
push str.WIN_2003
jmp 0x42f5df
cmp byte [0x47e0e0], 1
jne 0x42fd0b
push str.WIN_XP
jmp 0x42f5df
cmp byte [0x47e0e4], 1
mov edi, dword [ebp + 0x14]
jne 0x42fd21
push str.WIN_2000
jmp 0x42f5e2
push str.WIN_NT4
jmp 0x42f5e2
cmp byte [0x47e0ec], 1
jne 0x42fd3e
push str.WIN_95
jmp 0x42f5df
cmp byte [0x47e0ea], 1
mov edi, dword [ebp + 0x14]
jne 0x42fd54
push str.WIN_98
jmp 0x42f5e2
push str.WIN_ME
jmp 0x42f5e2
push dword [0x47dfd8]
jmp 0x42ffcd
push 0x47dfdc
jmp 0x42f5df
cmp byte [0x47e0dc], 1
lea eax, [ebp - 4]
push eax
push 1
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
push ebx
jne 0x42fde9
cmp byte [0x47e0e5], 1
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.WSOCK32.dll_bind
jne 0x42fdc4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.InstallLanguage
jmp 0x42f6c7
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f63d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Default
jmp 0x42f6c7
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42fe21
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push 0x46ad3e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x12c]
jmp 0x42f643
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x18]
jmp 0x42f643
lea eax, [ebp - 0x250]
push 0x46e528
push eax
call fcn.0044f340
lea eax, [ebp - 0x250]
push eax
xor esi, esi
xor edi, edi
call fcn.00451730
add esp, 0xc
test eax, eax
jle 0x42fe99
mov al, byte [ebp + edi - 0x250]
cmp al, 0x20
je 0x42fe87
cmp al, 0x2c
jne 0x42fe7f
mov byte [ebp + esi - 0x250], 0x2e
jmp 0x42fe86
mov byte [ebp + esi - 0x250], al
inc esi
lea eax, [ebp - 0x250]
push eax
inc edi
call fcn.00451730
cmp edi, eax
pop ecx
jl 0x42fe66
mov byte [ebp + esi - 0x250], bl
lea eax, [ebp - 0x250]
jmp 0x42f643
push esi
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x42f63d
lea eax, [ebp - 0x28]
xor esi, esi
push eax
inc esi
call fcn.0040ebb3
pop ecx
lea eax, [ebp - 0x28]
jmp 0x42f643
lea eax, [ebp - 0x28]
push eax
push 2
pop esi
jmp 0x42fec6
lea eax, [ebp - 0x28]
push eax
push 3
jmp 0x42feda
lea eax, [ebp - 0x28]
push eax
push 4
jmp 0x42feda
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x42ffcd
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x134]
jmp 0x42ffcd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.00412534
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x42f5d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x42ff3c
push esi
lea eax, [ebp - 0x130]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x42f63d
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x42f762
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x42f63d
mov eax, dword [0x47e114]
cmp eax, 2
je case.0x42f5d3.42
cmp eax, 3
je case.0x42f5d3.42
push ebx
mov esi, dword [ebp + 0x14]
call fcn.00412534
jmp case.default.0x42f5d3
cmp byte [0x47e0dc], bl
je 0x42fff1
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERPROFILE
jmp 0x42ff7e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430039
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130]
push eax
call fcn.00451730
pop ecx
jmp 0x430052
cmp byte [ebp + eax - 0x130], 0x5c
je 0x430055
dec eax
jns 0x430048
mov byte [ebp + eax - 0x130], bl
jmp 0x42f63d
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEDRIVE
jmp 0x42ff7e
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEPATH
jmp 0x42ff7e
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMESHARE
jmp 0x42ff7e
push esi
lea eax, [ebp - 0x130]
push eax
push str.LOGONSERVER
jmp 0x42ff7e
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDOMAIN
jmp 0x42ff7e
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDNSDOMAIN
jmp 0x42ff7e
push dword [edi + 0x210]
jmp 0x42ffcd
movzx eax, byte [edi + 0x20c]
jmp 0x42f673
push dword [edi + 0x240]
jmp 0x42ffcd
push dword [edi + 0x244]
jmp 0x42f5df
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x430110
fadd qword [0x46eb90]
mov esi, dword [ebp + 0x14]
push ecx
push ecx
fstp qword [esp]
call fcn.004125e0
jmp case.default.0x42f5d3