Function at 0x42f519
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov esi, 0x104
xor ebx, ebx
push esi
mov edi, eax
lea eax, [ebp - 0x12f]
push ebx
push eax
mov byte [ebp - 0x130], bl
call fcn.004512d0
add esp, 0xc
push esi
lea eax, [ebp - 0x24f]
push ebx
push eax
mov byte [ebp - 0x250], bl
call fcn.004512d0
lea eax, [ebp - 0x148]
add esp, 0xc
push eax
mov dword [ebp - 4], ebx
call fcn.00453c4a
pop ecx
lea eax, [ebp - 0x148]
push eax
call fcn.0045466b
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x473a20]
call fcn.004514b0
test eax, eax
pop ecx
pop ecx
je 0x42f59d
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5c
jl 0x42f57c
mov eax, dword [ebp - 4]
cmp eax, 0x5c
jne 0x42f5ff
push 0x46e28c
lea esi, [ebp - 0x18]
call fcn.0040fd2f
lea eax, [ebp + 8]
mov edi, esi
mov dword [ebp - 8], ebx
call fcn.0040feff
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea esi, [ebp - 8]
call fcn.0040fb38
cmp dword [ebp - 4], ebx
jne 0x42f5f0
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
call fcn.0044f520
pop ecx
push dword [ebp + 8]
call fcn.0044f520
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
call fcn.004123b1
xor ebx, ebx
jmp 0x42f5d5
cmp eax, 0x5b
ja case.default.0x42f604
jmp dword [eax*4 + 0x430155]
push 0x46e2bc
mov edi, dword [ebp + 0x14]
call fcn.0041262a
jmp case.default.0x42f604
push 0x46b4ac
jmp 0x42f610
push 0x46bc20
jmp 0x42f610
push 0x46e2c0
jmp 0x42f610
lea eax, [edi + 0x220]
call fcn.0041c565
push dword [eax + 0x14]
jmp 0x42fffe
lea eax, [edi + 0x220]
call fcn.0041c565
push dword [eax + 0x1c]
jmp 0x42fffe
mov eax, dword [ebp - 8]
push dword [eax]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.00451899
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
jmp 0x42f610
mov eax, dword [ebp - 8]
push dword [eax + 4]
jmp 0x42f65a
mov eax, dword [ebp - 8]
push dword [eax + 8]
jmp 0x42f65a
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
jmp 0x42f65a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
inc eax
push eax
jmp 0x42f65a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
jmp 0x42fffe
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
inc eax
jmp 0x42f6a4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x42f65f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42f66e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.CommonFilesDir
jmp 0x42f6f8
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f793
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Personal
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x130]
call fcn.0040dd4b
jmp 0x42f66e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_AppData
jmp 0x42f6f8
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f82b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f66e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
jmp 0x42f6f8
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Documents
jmp 0x42f6f8
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f8fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f66e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Favorites
jmp 0x42f6f8
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f98a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Programs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f66e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Programs
jmp 0x42f6f8
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42fa1a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Start_Menu
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f66e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Start_Menu
jmp 0x42f6f8
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42faaa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Startup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42f66e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Startup
jmp 0x42f6f8
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.AppData
jmp 0x42f6f8
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42f83f
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42f90e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42f99e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42fa2e
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42fabe
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
jmp 0x42f66e
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x42f66e
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x42f66e
push 6
jmp 0x42fffe
push 3
jmp 0x42fffe
push 9
jmp 0x42fffe
push 5
jmp 0x42fffe
push 0xa
jmp 0x42fffe
push 2
jmp 0x42fffe
push 7
jmp 0x42fffe
push 8
jmp 0x42fffe
push 4
jmp 0x42fffe
push 1
jmp 0x42fffe
cmp byte [0x4754ae], 1
mov esi, dword [ebp + 0x14]
jne 0x42fc1d
push 1
jmp 0x430001
push ebx
jmp 0x430001
cmp byte [0x47e6e1], 1
jmp 0x42fc11
push 0x40
jmp 0x42fffe
push 0x41
jmp 0x42fffe
push 0x42
jmp 0x42fffe
push 0x43
jmp 0x42fffe
push dword [edi + 0x160]
jmp 0x42f610
push dword [edi + 0x154]
jmp 0x42f610
push dword [edi + 0x16c]
jmp 0x42f610
mov ecx, dword [edi + 0x184]
call fcn.00408415
jmp 0x42f6a4
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x42f66e
mov eax, dword [0x47e0f4]
mov ecx, eax
dec ecx
je 0x42fcbd
dec ecx
je 0x42fcb3
dec ecx
je 0x42fca9
neg eax
push eax
push str.UNKN_d
jmp 0x42f65f
push 0x46e438
jmp 0x42f610
push str.IA64
jmp 0x42f610
push 0x46e42c
jmp 0x42f610
cmp byte [0x47e0dc], 1
mov edi, dword [ebp + 0x14]
jne 0x42fcdd
push str.WIN32_NT
jmp 0x42f613
push str.WIN32_WINDOWS
jmp 0x42f613
cmp byte [0x47e0dc], 1
jne 0x42fd5c
cmp byte [0x47e0e2], 1
jne 0x42fd03
push str.WIN_2008
jmp 0x42f610
cmp byte [0x47e0e8], 1
jne 0x42fd16
push str.WIN_VISTA
jmp 0x42f610
cmp byte [0x47e0e6], 1
jne 0x42fd29
push str.WIN_2003
jmp 0x42f610
cmp byte [0x47e0e0], 1
jne 0x42fd3c
push str.WIN_XP
jmp 0x42f610
cmp byte [0x47e0e4], 1
mov edi, dword [ebp + 0x14]
jne 0x42fd52
push str.WIN_2000
jmp 0x42f613
push str.WIN_NT4
jmp 0x42f613
cmp byte [0x47e0ec], 1
jne 0x42fd6f
push str.WIN_95
jmp 0x42f610
cmp byte [0x47e0ea], 1
mov edi, dword [ebp + 0x14]
jne 0x42fd85
push str.WIN_98
jmp 0x42f613
push str.WIN_ME
jmp 0x42f613
push dword [0x47dfd8]
jmp 0x42fffe
push 0x47dfdc
jmp 0x42f610
cmp byte [0x47e0dc], 1
lea eax, [ebp - 4]
push eax
push 1
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
push ebx
jne 0x42fe1a
cmp byte [0x47e0e5], 1
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
jne 0x42fdf5
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.InstallLanguage
jmp 0x42f6f8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Default
jmp 0x42f6f8
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42fe52
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push 0x46ad3e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x12c]
jmp 0x42f674
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x18]
jmp 0x42f674
lea eax, [ebp - 0x250]
push str.3__2__12__0
push eax
call fcn.0044f360
lea eax, [ebp - 0x250]
push eax
xor esi, esi
xor edi, edi
call fcn.00451750
add esp, 0xc
test eax, eax
jle 0x42feca
mov al, byte [ebp + edi - 0x250]
cmp al, 0x20
je 0x42feb8
cmp al, 0x2c
jne 0x42feb0
mov byte [ebp + esi - 0x250], 0x2e
jmp 0x42feb7
mov byte [ebp + esi - 0x250], al
inc esi
lea eax, [ebp - 0x250]
push eax
inc edi
call fcn.00451750
cmp edi, eax
pop ecx
jl 0x42fe97
mov byte [ebp + esi - 0x250], bl
lea eax, [ebp - 0x250]
jmp 0x42f674
push esi
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
jmp 0x42f66e
lea eax, [ebp - 0x28]
xor esi, esi
push eax
inc esi
call fcn.0040ebe4
pop ecx
lea eax, [ebp - 0x28]
jmp 0x42f674
lea eax, [ebp - 0x28]
push eax
push 2
pop esi
jmp 0x42fef7
lea eax, [ebp - 0x28]
push eax
push 3
jmp 0x42ff0b
lea eax, [ebp - 0x28]
push eax
push 4
jmp 0x42ff0b
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x42fffe
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x134]
jmp 0x42fffe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.00412565
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x42f604
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x42ff6d
push esi
lea eax, [ebp - 0x130]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
jmp 0x42f66e
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x42f793
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x42f66e
mov eax, dword [0x47e114]
cmp eax, 2
je case.0x42f604.42
cmp eax, 3
je case.0x42f604.42
push ebx
mov esi, dword [ebp + 0x14]
call fcn.00412565
jmp case.default.0x42f604
cmp byte [0x47e0dc], bl
je 0x430022
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERPROFILE
jmp 0x42ffaf
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43006a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130]
push eax
call fcn.00451750
pop ecx
jmp 0x430083
cmp byte [ebp + eax - 0x130], 0x5c
je 0x430086
dec eax
jns 0x430079
mov byte [ebp + eax - 0x130], bl
jmp 0x42f66e
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEDRIVE
jmp 0x42ffaf
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEPATH
jmp 0x42ffaf
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMESHARE
jmp 0x42ffaf
push esi
lea eax, [ebp - 0x130]
push eax
push str.LOGONSERVER
jmp 0x42ffaf
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDOMAIN
jmp 0x42ffaf
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDNSDOMAIN
jmp 0x42ffaf
push dword [edi + 0x210]
jmp 0x42fffe
movzx eax, byte [edi + 0x20c]
jmp 0x42f6a4
push dword [edi + 0x240]
jmp 0x42fffe
push dword [edi + 0x244]
jmp 0x42f610
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x430141
fadd qword [0x46eb90]
mov esi, dword [ebp + 0x14]
push ecx
push ecx
fstp qword [esp]
call fcn.00412611
jmp case.default.0x42f604