Function at 0x14000d568
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x348]
sub rsp, 0x410
mov rbx, rcx
mov r12, rdx
xor r15d, r15d
lea rcx, [rsp + 0x30]
mov edx, 0x104
movaps xmmword [rax - 0x48], xmm6
mov r14, r8
mov word [rbp + 0x10], r15w
call fcn.14001edac
mov r13, qword [r12]
mov edi, r15d
lea rsi, str.ERROR
mov rcx, qword [rsi]
mov rdx, r13
call fcn.140028304
mov r8d, 1
test eax, eax
je 0x14000d5e2
lea rax, [0x1400bb1d8]
add rsi, 8
add edi, r8d
cmp rsi, rax
jl 0x14000d5ba
cmp edi, 0x61
je 0x14004a0dc
cmp edi, 0x60
ja case.0x14000d604.88
lea rdx, [0x140000000]
movsxd rax, edi
mov ecx, dword [rdx + rax*4 + 0xd778]
add rcx, rdx
jmp rcx
lea rdx, [rbx + 0x190]
mov rcx, r14
call fcn.140006848
lea rcx, [rsp + 0x30]
call fcn.14001c48c
lea r11, [rsp + 0x410]
mov eax, r15d
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, reloc.WSOCK32.dll_inet_addr
mov rcx, r14
call fcn.1400068b8
jmp case.0x14000d604.88
lea rdx, [rbx + 0x170]
jmp 0x14000d60d
mov rcx, r14
call fcn.1400065d0
mov eax, 1
mov dword [r14], eax
mov dword [r14 + 0x10], eax
jmp case.0x14000d604.88
lea rdx, [0x1400d1084]
jmp 0x14000d649
lea rdx, [0x1400d06ac]
jmp 0x14000d649
lea rdx, reloc.WSOCK32.dll_htons
jmp 0x14000d649
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroyData
jmp 0x14004a387
mov ecx, 0x2b
jmp 0x14004a387
mov ecx, 5
jmp 0x14004a387
mov ecx, SafeArrayDestroyData
jmp 0x14004a387
mov ecx, 0x19
jmp 0x14004a387
mov ecx, 0x2e
jmp 0x14004a387
mov ecx, reloc.OLEAUT32.dll_CreateStdDispatch
jmp 0x14004a387
mov ecx, reloc.WSOCK32.dll_socket
jmp 0x14004a387
mov ecx, socket
jmp 0x14004a387
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x14004a387
mov ecx, CreateStdDispatch
jmp 0x14004a387
mov ecx, 0x1a
jmp 0x14004a387
mov ecx, reloc.WSOCK32.dll_recv
jmp 0x14004a387
mov ecx, 6
jmp 0x14004a387
mov ecx, 2
jmp 0x14004a387
mov ecx, reloc.WSOCK32.dll_inet_ntoa
jmp 0x14004a387
mov rcx, r14
jmp 0x14004a54d
lea rdx, [rbx + 0x150]
jmp 0x14000d60d
lea rdx, str.WIN32_NT
jmp 0x14000d649
mov ecx, r8d
jmp 0x14004a88e
mov ecx, 2
jmp 0x14004a88e
mov ecx, 3
jmp 0x14004a88e
lea rdx, [rbx + 0x240]
jmp 0x14000d60d
lea rdx, [0x1400d1028]
lea rcx, [rbp - 0x48]
call fcn.14001f2ac
lea rcx, [rbp - 0x48]
mov rdx, r12
call fcn.14001ee50
lea r8, [rbp + 0x368]
lea rdx, [rbp - 0x48]
xor r9d, r9d
mov dword [rbp + 0x368], r15d
call fcn.140004e2c
test rax, rax
jne 0x14004a11d
or r15d, 0xffffffff
jmp 0x14004a128
mov rdx, rax
mov rcx, r14
call fcn.140006d9c
lea rcx, [rbp - 0x48]
jmp 0x14004a245
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rbx
call fcn.140004c10
mov ebx, dword [rax + 0x1c]
jmp 0x14004a14f
mov ebx, dword [rbx + 0x23c]
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], ebx
jmp case.0x14000d604.88
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rbx
call fcn.140004c10
mov rcx, r14
lea rdx, [rax + 0x28]
call fcn.140006d9c
nop
jmp case.0x14000d604.88
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rbp - 0x62]
lea rdx, str._.3d
jmp 0x14004a1ae
mov r8d, r15d
lea rdx, [0x1400d0380]
lea rcx, [rbp + 0x10]
call fcn.140028450
jmp 0x14004a1d4
lea rdx, [rbp + 0x358]
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x358], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp + 0x10]
jmp 0x14000d649
lea rcx, [rbp + 0x368]
call fcn.140091ba0
lea r8, [0x1400d109c]
lea rdx, [rbp + 0x220]
mov rcx, rax
call fcn.140091ad8
mov rcx, r14
mov rdx, rax
call fcn.140006848
lea rcx, [rbp + 0x220]
jmp 0x14004a245
lea rcx, [rsp + 0x60]
call fcn.140091ba0
lea r8, [0x1400d10c4]
lea rdx, [rbp + 0x2a0]
mov rcx, rax
call fcn.140091ad8
mov rcx, r14
mov rdx, rax
call fcn.140006848
lea rcx, [rbp + 0x2a0]
call fcn.14001c48c
nop
jmp case.0x14000d604.88
lea rcx, [rbp - 0x28]
call fcn.140091ba0
lea r8, [0x1400d10a4]
lea rdx, [rbp + 0x2e0]
mov rcx, rax
call fcn.140091ad8
mov rcx, r14
mov rdx, rax
call fcn.140006848
lea rcx, [rbp + 0x2e0]
jmp 0x14004a245
lea rcx, [rbp - 0x18]
call fcn.140091ba0
lea r8, [0x1400d10ac]
lea rdx, [rbp + 0x2c0]
mov rcx, rax
call fcn.140091ad8
mov rcx, r14
mov rdx, rax
call fcn.140006848
lea rcx, [rbp + 0x2c0]
jmp 0x14004a245
lea rcx, [rbp - 0x20]
call fcn.140091ba0
lea r8, [0x1400d0380]
lea rdx, [rbp + 0x280]
mov rcx, rax
call fcn.140091ad8
mov rcx, r14
mov rdx, rax
call fcn.140006848
lea rcx, [rbp + 0x280]
jmp 0x14004a245
lea rcx, [rbp - 8]
call fcn.140091ba0
lea r8, [0x1400d10b4]
lea rdx, [rbp + 0x240]
mov rcx, rax
call fcn.140091ad8
mov rcx, r14
mov rdx, rax
call fcn.140006848
lea rcx, [rbp + 0x240]
jmp 0x14004a245
lea rcx, [rbp - 0x10]
call fcn.140091ba0
lea r8, [0x1400d10bc]
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.140091ad8
mov rcx, r14
mov rdx, rax
call fcn.140006848
lea rcx, [rbp + 0x260]
jmp 0x14004a245
lea rcx, [rbp]
call fcn.140091ba0
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.140091b50
test rax, rax
je 0x14004a1a4
mov r8d, dword [rax + 0x18]
inc r8d
jmp 0x14004a1a7
mov ecx, 7
lea rdx, [rsp + 0x30]
call fcn.140074b64
jmp 0x14004a39d
lea rcx, [rsp + 0x30]
call fcn.14001a5d8
lea rdx, [rsp + 0x30]
jmp 0x14000d60d
lea rdx, [rbp + 0x358]
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x358], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x14004a1d4
lea rcx, [rbp + 0x10]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je case.0x14000d604.88
jmp 0x14004a1d4
mov rax, qword [0x1400e6630]
cmp byte [rax + 0x48], r15b
je 0x14004a424
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r15
call fcn.140091a88
lea rcx, [rbp + 0x10]
mov edx, 0x104
call rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14004a1d4
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14004a1d4
lea rcx, [rbp + 0x10]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x14004a1d4
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 6
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 3
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 9
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 5
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 0xa
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 2
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 7
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 8
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 4
jmp case.0x14000d604.88
cmp byte [0x1400e44cc], r8b
jmp 0x14004a544
cmp byte [0x1400e4f5d], r8b
mov rcx, r14
je 0x14000d65f
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], r15d
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 0x40
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 0x41
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 0x42
jmp case.0x14000d604.88
mov rcx, r14
call fcn.1400065d0
mov dword [r14 + 0x10], 1
mov dword [r14], 0x43
jmp case.0x14000d604.88
mov edx, dword [rbx + 0x1c0]
call fcn.14006f438
mov ebx, eax
jmp 0x14004a14f
lea rdx, [rbp + 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x14004a1d4
mov rax, qword [0x1400e6630]
movzx ecx, word [rax + 0x4a]
test ecx, ecx
je 0x14004a638
cmp ecx, 6
je 0x14004a62c
cmp ecx, 9
mov rcx, r14
je 0x14004a620
lea rdx, str.UNKNOWN
jmp 0x14000d64c
lea rdx, [0x1400d10e8]
jmp 0x14000d64c
lea rdx, str.IA64
jmp 0x14000d649
lea rdx, [0x1400d10d0]
jmp 0x14000d649
mov eax, 0x80000001
xor ecx, ecx
cpuid
bt edx, 0x1d
mov dword [rsp + 0x60], eax
lea rdx, [0x1400d10e8]
lea rax, [0x1400d10d0]
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], ecx
cmovae rdx, rax
jmp 0x14000d649
mov rax, qword [0x1400e6630]
cmp byte [rax + 0x44], r8b
jne 0x14004a68d
lea rdx, str.WIN_10
jmp 0x14000d649
cmp byte [rax + 0x46], r8b
jne 0x14004a69f
lea rdx, str.WIN_2016
jmp 0x14000d649
cmp byte [rax + 0x40], r8b
jne 0x14004a6b1
lea rdx, str.WIN_81
jmp 0x14000d649
cmp byte [rax + 0x42], r8b
jne 0x14004a6c3
lea rdx, str.WIN_2012R2
jmp 0x14000d649
cmp byte [rax + 0x3e], r8b
jne 0x14004a6d5
lea rdx, str.WIN_2012
jmp 0x14000d649
cmp byte [rax + 0x3c], r8b
jne 0x14004a6e7
lea rdx, str.WIN_8
jmp 0x14000d649
cmp byte [rax + 0x3a], r8b
jne 0x14004a6f9
lea rdx, str.WIN_2008R2
jmp 0x14000d649
cmp byte [rax + 0x38], r8b
jne 0x14004a70b
lea rdx, str.WIN_7
jmp 0x14000d649
cmp byte [rax + 0x36], r8b
jne 0x14004a71d
lea rdx, str.WIN_2008
jmp 0x14000d649
cmp byte [rax + 0x34], r8b
jne 0x14004a72f
lea rdx, str.WIN_VISTA
jmp 0x14000d649
cmp byte [rax + 0x32], r8b
jne 0x14004a741
lea rdx, str.WIN_2003
jmp 0x14000d649
cmp byte [rax + 0x30], r8b
jne 0x14004a762
cmp byte [rax + 0x4c], r15b
lea rdx, str.WIN_XPe
lea rcx, str.WIN_XP
cmove rdx, rcx
jmp 0x14000d649
lea rdx, str.UNKNOWN
jmp 0x14000d649
mov rax, qword [0x1400e6630]
mov ebx, dword [rax + 8]
jmp 0x14004a14f
mov rdx, qword [0x1400e6630]
add rdx, 0x10
jmp 0x14000d60d
lea rax, [rbp + 0x10]
lea r8, str.InstallLanguage
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400019fc
jmp 0x14004a1d4
lea rax, [rbp + 0x10]
lea r8, str.SchemeLangID
lea rdx, str.Control_PanelAppearance
mov r9d, 0x104
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.1400019fc
movzx eax, word [rbp + 0x10]
lea rdx, [rbp + 0x10]
mov ecx, eax
mov r8d, 4
mov dword [rbp + 0x358], eax
call fcn.140025828
jmp 0x14004a1d4
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rbp - 0x48]
jmp 0x14000d649
lea rdx, str.3__3__15__0
lea rcx, [rbp + 0x10]
call fcn.140027898
lea rcx, [rbp + 0x10]
mov edi, r15d
mov r13d, r15d
call fcn.1400276a8
test eax, eax
jle 0x14004a87b
lea rbx, [rbp + 0x10]
lea r12, [rbp + 0x10]
mov esi, 0x2e
movzx eax, word [r12]
cmp ax, 0x20
je 0x14004a866
inc edi
cmp ax, 0x2c
jne 0x14004a85f
mov word [rbx], si
jmp 0x14004a862
mov word [rbx], ax
add rbx, 2
lea rcx, [rbp + 0x10]
inc r13d
add r12, 2
call fcn.1400276a8
cmp r13d, eax
jl 0x14004a847
movsxd rax, edi
mov word [rbp + rax*2 + 0x10], r15w
jmp 0x14004a1d4
mov ecx, 4
lea rdx, [rsp + 0x70]
call fcn.140074a64
lea rdx, [rsp + 0x70]
jmp 0x14000d649
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x58]
jmp 0x14004a14f
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x5c]
jmp 0x14004a14f
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_ioctlsocket
jmp 0x14004a90c
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, r14
mov ebx, eax
call fcn.1400065d0
mov rdx, rdi
mov rcx, rsi
mov dword [r14 + 0x10], 1
mov dword [r14], ebx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
jmp case.0x14000d604.88
lea rcx, str.COMSPEC
jmp 0x14004a94f
lea rcx, str.USERDNSDOMAIN
lea rdx, [rbp + 0x10]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x14004a1d4
lea rdx, [rbp + 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp + 0x10]
call fcn.1400266b8
jmp 0x14004a1d4
mov eax, dword [0x1400e4570]
mov rcx, r14
add eax, 0xfffffffd
cmp eax, r8d
jbe 0x14000d65f
jmp 0x14004a54d
lea rcx, str.USERPROFILE
jmp 0x14004a94f
lea rcx, str.HOMEDRIVE
jmp 0x14004a94f
lea rcx, str.HOMEPATH
jmp 0x14004a94f
lea rcx, str.HOMESHARE
jmp 0x14004a94f
lea rcx, str.LOGONSERVER
jmp 0x14004a94f
lea rcx, str.USERDOMAIN
jmp 0x14004a94f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xorps xmm6, xmm6
mov rcx, r14
mov eax, eax
cvtsi2sd xmm6, rax
call fcn.1400065d0
movsd qword [r14], xmm6
mov dword [r14 + 0x10], 3
jmp case.0x14000d604.88