Function at 0x420e97
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
mov eax, 0x45038f
call fcn.004419dc
sub esp, 0x258
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.0040101d
mov dl, byte [0x45cb90]
push 0x41
pop ecx
xor eax, eax
and dword [ebp - 0x10], eax
lea edi, [ebp - 0x13b]
mov byte [ebp - 0x13c], dl
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
push 0x41
lea edi, [ebp - 0x263]
pop ecx
mov byte [ebp - 0x264], dl
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
call fcn.00442344
lea eax, [ebp - 0x34]
push eax
call fcn.004437e2
pop ecx
mov edi, eax
pop ecx
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_CharUpperBuffA]
mov ebx, dword [ebp - 0x20]
mov dword [ebp + 8], 0x4576c0
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call fcn.00441f20
pop ecx
test eax, eax
pop ecx
je 0x420f35
inc dword [ebp - 0x10]
add dword [ebp + 8], 4
cmp dword [ebp + 8], 0x457820
jl 0x420f14
mov eax, dword [ebp - 0x10]
cmp eax, 0x58
jne 0x420fcc
push 0x457e58
lea ecx, [ebp - 0x148]
call fcn.0040101d
lea eax, [ebp - 0x20]
xor esi, esi
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], esi
call fcn.004011b8
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x148]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14c], esp
push eax
call fcn.00401079
mov ecx, 0x4602d0
call fcn.0043f4ea
cmp dword [ebp + 8], esi
jne 0x420f9d
push 1
pop esi
jmp 0x420fa8
push dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.004035d7
push dword [ebp - 0x148]
and byte [ebp - 4], 0
call fcn.004415fb
push dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
call fcn.004415fb
pop ecx
mov eax, esi
pop ecx
jmp 0x421814
cmp eax, 0x57
ja case.default.0x420fd5
jmp dword [eax*4 + 0x421825]
push 0x45811c
jmp 0x421516
push 0x4569e0
jmp 0x421516
push 0x456afc
jmp 0x421516
push 0x458118
jmp 0x421516
push dword [esi + 0x15c]
jmp 0x4217fd
push dword [esi + 0x160]
jmp 0x4217fd
push dword [edi]
push str._.2d
lea eax, [ebp - 0x13c]
push eax
call fcn.00442173
add esp, 0xc
jmp 0x42150f
push dword [edi + 4]
jmp 0x42101c
push dword [edi + 8]
jmp 0x42101c
push dword [edi + 0xc]
jmp 0x42101c
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x42101c
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x4217fc
mov eax, dword [edi + 0x18]
inc eax
jmp 0x4217fc
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x421021
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x421502
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.CommonFilesDir
jmp 0x42107e
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
call fcn.0043d4e4
lea eax, [ebp - 0x13c]
push eax
call fcn.0043da36
add esp, 0x18
jmp 0x42150f
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Common_AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x421502
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Desktop
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043d4e4
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x42150f
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Desktop
push esi
push reloc.WSOCK32.dll_accept
jmp 0x421507
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Common_Documents
jmp 0x4210e0
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Favorites
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043d4e4
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x42150f
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Favorites
jmp 0x421129
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Programs
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043d4e4
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x42150f
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Programs
jmp 0x421129
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Start_Menu
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043d4e4
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x42150f
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Start_Menu
jmp 0x421129
lea eax, [ebp - 0x13c]
mov edi, 0x104
push eax
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.Common_Startup
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043d4e4
add esp, 0x14
cmp byte [ebp - 0x13c], 0
jne 0x42150f
lea eax, [ebp - 0x13c]
push eax
push edi
push str.Startup
jmp 0x421129
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.AppData
jmp 0x4212c4
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Desktop
jmp 0x4212c4
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Favorites
jmp 0x4212c4
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Programs
jmp 0x4212c4
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Start_Menu
jmp 0x4212c4
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42112a
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x42150f
lea eax, [ebp - 0x13c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x42150f
lea eax, [ebp - 0x13c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x42150f
push 6
jmp 0x4217fd
push 9
jmp 0x4217fd
push 5
jmp 0x4217fd
push 0xa
jmp 0x4217fd
push 3
jmp 0x4217fd
push 2
jmp 0x4217fd
push 7
jmp 0x4217fd
push 8
jmp 0x4217fd
push 4
jmp 0x4217fd
cmp byte [0x4600aa], 1
jmp 0x421368
cmp byte [0x460409], 1
je case.0x420fd5.42
push 0
jmp 0x4217fd
push 0x40
jmp 0x4217fd
push 0x41
jmp 0x4217fd
push 0x42
jmp 0x4217fd
push 0x43
jmp 0x4217fd
push dword [esi + 0x70]
jmp 0x421516
push dword [esi + 0x64]
jmp 0x421516
push dword [esi + 0x7c]
jmp 0x421516
push dword [esi + 0x90]
mov ecx, 0x4600b0
call fcn.00439aa0
jmp 0x4217fc
lea eax, [ebp - 0x13c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x42150f
mov eax, dword [0x464aec]
mov ecx, eax
dec ecx
je 0x421406
dec ecx
je 0x4213fc
dec ecx
je 0x4213f2
neg eax
push eax
push str.UNKN_d
jmp 0x421021
push 0x457fa8
jmp 0x421516
push str.IA64
jmp 0x421516
push 0x457f9c
jmp 0x421516
cmp byte [0x464ad4], 1
jne 0x421423
push str.WIN32_NT
jmp 0x421516
push str.WIN32_WINDOWS
jmp 0x421516
mov al, byte [0x464ad4]
cmp al, 1
jne 0x42149b
cmp byte [0x464ada], al
jne 0x421448
push str.WIN_6.1
jmp 0x421516
cmp byte [0x464ae0], 1
jne 0x42145b
push str.WIN_6.0
jmp 0x421516
cmp byte [0x464ade], 1
jne 0x42146e
push str.WIN_2003
jmp 0x421516
cmp byte [0x464ad8], 1
jne 0x421481
push str.WIN_XP
jmp 0x421516
cmp byte [0x464adc], 1
jne 0x421494
push str.WIN_2000
jmp 0x421516
push str.WIN_NT4
jmp 0x421516
cmp byte [0x464ae4], 1
jne 0x4214ab
push str.WIN_95
jmp 0x421516
cmp byte [0x464ae2], 1
jne 0x4214bb
push str.WIN_98
jmp 0x421516
push str.WIN_ME
jmp 0x421516
push dword [0x4649d0]
jmp 0x4217fd
push 0x4649d4
jmp 0x421516
mov al, byte [0x464ad4]
cmp al, 1
jne 0x421523
cmp byte [0x464add], al
lea eax, [ebp - 0x13c]
push eax
push 0x104
jne 0x4214f8
push str.InstallLanguage
jmp 0x4214fd
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043d4e4
add esp, 0x14
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00403875
jmp case.default.0x420fd5
lea eax, [ebp - 0x13c]
push eax
push 0x104
push 0x45cb90
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.0043d4e4
add esp, 0x14
lea eax, [ebp - 0x138]
jmp 0x421515
lea eax, [ebp - 0x264]
push str.3__1__1__128
push eax
call fcn.00441de0
lea eax, [ebp - 0x264]
xor esi, esi
push eax
xor edi, edi
call fcn.00441580
add esp, 0xc
test eax, eax
jle 0x4215a9
mov al, byte [ebp + edi - 0x264]
cmp al, 0x20
je 0x421597
cmp al, 0x2c
jne 0x42158f
mov byte [ebp + esi - 0x264], 0x2e
jmp 0x421596
mov byte [ebp + esi - 0x264], al
inc esi
lea eax, [ebp - 0x264]
inc edi
push eax
call fcn.00441580
cmp edi, eax
pop ecx
jl 0x421576
and byte [ebp + esi - 0x264], 0
lea eax, [ebp - 0x264]
jmp 0x421515
lea eax, [ebp - 0x13c]
push 0x105
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x42150f
lea eax, [ebp - 0x30]
push eax
push 1
call fcn.0043e7a2
pop ecx
lea eax, [ebp - 0x30]
pop ecx
jmp 0x421515
lea eax, [ebp - 0x30]
push eax
push 2
jmp 0x4215db
lea eax, [ebp - 0x30]
push eax
push 3
jmp 0x4215db
lea eax, [ebp - 0x30]
push eax
push 4
jmp 0x4215db
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x154]
jmp 0x4217fd
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x150]
jmp 0x4217fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0xc
jmp 0x421668
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x74
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0040374f
push edi
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x420fd5
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x42150f
lea eax, [ebp - 0x13c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x13c]
push eax
call fcn.0043da36
pop ecx
jmp 0x42150f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x42150f
push 1
jmp 0x4217fd
cmp byte [0x464ad4], 0
je 0x421705
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.USERPROFILE
jmp 0x421696
lea eax, [ebp - 0x13c]
push eax
push 0x104
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
call fcn.0043d4e4
lea eax, [ebp - 0x13c]
push eax
call fcn.00441580
add esp, 0x18
dec eax
js 0x421741
cmp byte [ebp + eax - 0x13c], 0x5c
jne 0x421734
and byte [ebp + eax - 0x13c], 0
jmp 0x42150f
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.HOMEDRIVE
jmp 0x421696
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.HOMEPATH
jmp 0x421696
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.HOMESHARE
jmp 0x421696
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.LOGONSERVER
jmp 0x421696
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.USERDOMAIN
jmp 0x421696
lea eax, [ebp - 0x13c]
push 0x104
push eax
push str.USERDNSDOMAIN
jmp 0x421696
push dword [esi + 0x120]
jmp 0x4217fd
movzx eax, byte [esi + 0x11c]
jmp 0x4217fc
push dword [esi + 0x164]
jmp 0x4217fd
push dword [esi + 0x168]
jmp 0x421516
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040374f
push dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
call fcn.004415fb
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8