Function at 0x140080620
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d0
mov rbx, rcx
mov rbp, r8
mov r15, rdx
mov edi, 0x208
lea rcx, [rax - 0x466]
xor esi, esi
movaps xmmword [rax - 0x48], xmm6
mov r8, rdi
xor edx, edx
mov word [rax - 0x468], si
call fcn.140018a40
lea rcx, [rsp + 0x2b2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x2b0], si
call fcn.140018a40
lea rcx, [rsp + 0x78]
call fcn.14001b51c
lea rcx, [rsp + 0x78]
call fcn.14001e09c
mov r14, qword [r15]
lea r13, str.ERROR
mov rdi, rax
lea r12d, [rsi + 1]
mov rcx, qword [r13]
mov rdx, r14
call fcn.140018ccc
test eax, eax
je 0x1400806c7
lea rax, [0x1400aa788]
add r13, 8
add esi, r12d
cmp r13, rax
jl 0x1400806a4
cmp esi, 0x5f
jne 0x140080745
lea rdx, [0x14009d948]
lea rcx, [rsp + 0x80]
call fcn.1400022f0
lea rcx, [rsp + 0x80]
xor ebx, ebx
mov rdx, r15
mov dword [rsp + 0x528], ebx
call fcn.140063280
lea r9, [rsp + 0x528]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x80]
lea rcx, [0x1400bfb08]
mov dword [rsp + 0x20], ebx
call fcn.140012cb0
mov rdx, qword [rsp + 0x30]
cmp rdx, rbx
je 0x140080733
mov rcx, rbp
call fcn.140004170
mov r12d, ebx
lea rcx, [rsp + 0x80]
call fcn.1400036e0
jmp 0x140080f97
cmp esi, 0x5e
ja case.default.0x140080762
lea rdx, [0x140000000]
movsxd rax, esi
mov ecx, dword [rdx + rax*4 + 0x81070]
add rcx, rdx
jmp rcx
lea rdx, [0x14009d9a4]
mov rcx, rbp
call fcn.1400148c0
jmp case.default.0x140080762
lea rdx, reloc.WSOCK32.dll_inet_addr
jmp 0x14008076b
lea rdx, [0x14009902c]
jmp 0x14008076b
lea rdx, reloc.WSOCK32.dll_htons
jmp 0x14008076b
lea rcx, [rbx + 0x230]
call fcn.140003d40
mov ebx, dword [rax + 0x1c]
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], ebx
jmp 0x140080f8e
lea rcx, [rbx + 0x230]
call fcn.140003d40
mov ebx, dword [rax + 0x24]
jmp 0x1400807a2
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rsp + 0x3e]
lea rdx, str._.2d
lea rcx, [rsp + 0xa0]
call fcn.140018e18
lea rdx, [rsp + 0xa0]
jmp 0x14008076b
mov r8d, dword [rdi]
jmp 0x1400807d4
mov r8d, dword [rdi + 4]
jmp 0x1400807d4
mov r8d, dword [rdi + 8]
jmp 0x1400807d4
mov r8d, dword [rdi + 0xc]
jmp 0x1400807d4
mov r8d, dword [rdi + 0x10]
add r8d, r12d
jmp 0x1400807d4
mov ebx, dword [rdi + 0x14]
add ebx, 0x76c
jmp 0x1400807a2
mov ebx, dword [rdi + 0x18]
add ebx, r12d
jmp 0x1400807a2
mov r8d, dword [rdi + 0x1c]
lea rdx, str._.3d
add r8d, r12d
jmp 0x1400807db
lea r8, str.ProgramFilesDir
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0xa0]
mov r9d, 0x104
mov qword [rsp + 0x20], rax
call fcn.1400175d0
jmp 0x1400807e8
lea r8, str.CommonFilesDir
jmp 0x140080842
lea rax, [rsp + 0xa0]
lea r8, [0x14009da68]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.1400175d0
lea rcx, [rsp + 0xa0]
call fcn.140015b80
jmp 0x1400807e8
lea r8, str.Common_AppData
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x140080849
lea rax, [rsp + 0xa0]
lea r8, str.Common_Desktop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400175d0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400807e8
lea r8, str.Desktop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
jmp 0x140080850
lea r8, str.Common_Documents
jmp 0x1400808bc
lea rax, [rsp + 0xa0]
lea r8, str.Common_Favorites
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400175d0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400807e8
lea r8, str.Favorites
jmp 0x140080909
lea rax, [rsp + 0xa0]
lea r8, str.Common_Programs
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400175d0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400807e8
lea r8, str.Programs
jmp 0x140080909
lea rax, [rsp + 0xa0]
lea r8, str.Common_Start_Menu
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400175d0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400807e8
lea r8, str.Start_Menu
jmp 0x140080909
lea rax, [rsp + 0xa0]
lea r8, str.Common_Startup
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x104
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400175d0
xor eax, eax
cmp word [rsp + 0xa0], ax
jne 0x1400807e8
lea r8, str.Startup
jmp 0x140080909
lea r8, str.AppData
jmp 0x140080909
lea rdx, [rsp + 0x518]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x518], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x1400807e8
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1400807e8
xor eax, eax
cmp byte [0x1400bde7a], al
je 0x140080acc
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
call fcn.14003f080
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call rax
lea rcx, [rsp + 0x30]
call fcn.140045ab0
jmp 0x1400807e8
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1400807e8
mov rcx, rbp
call fcn.140003c60
xor eax, eax
mov dword [rbp], eax
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 6
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 3
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 9
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 5
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 0xa
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 2
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 7
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 8
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 4
jmp 0x140080f8e
cmp byte [0x1400ad246], r12b
mov rcx, rbp
je 0x140080f85
jmp 0x140080ae7
cmp byte [0x1400be7ad], r12b
jmp 0x140080bb1
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 0x40
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 0x41
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 0x42
jmp 0x140080f8e
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], 0x43
jmp 0x140080f8e
mov rdx, qword [rbx + 0xa8]
jmp 0x14008076b
mov rdx, qword [rbx + 0x88]
jmp 0x14008076b
mov rdx, qword [rbx + 0xc8]
jmp 0x14008076b
mov edx, dword [rbx + 0xf8]
lea rcx, [0x1400bfb30]
call fcn.140043820
mov ebx, eax
jmp 0x1400807a2
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x1400807e8
movzx eax, word [0x1400bde7c]
xor ecx, ecx
cmp eax, ecx
je 0x140080ca3
cmp eax, 6
je 0x140080c97
mov rcx, rbp
cmp eax, 9
jne 0x140080d49
lea rdx, [0x14009dc90]
jmp 0x14008076e
lea rdx, str.IA64
jmp 0x14008076b
lea rdx, [0x14009dc78]
jmp 0x14008076b
call fcn.140017a90
xor r8d, r8d
lea rdx, [0x14009dc90]
lea rcx, [0x14009dc78]
cmp al, r8b
cmove rdx, rcx
jmp 0x14008076b
lea rdx, str.WIN32_NT
jmp 0x14008076b
cmp byte [0x1400bde72], r12b
jne 0x140080cf2
lea rdx, str.WIN_2008
jmp 0x14008076b
cmp byte [0x1400bde78], r12b
jne 0x140080d07
lea rdx, str.WIN_VISTA
jmp 0x14008076b
cmp byte [0x1400bde76], r12b
jne 0x140080d1c
lea rdx, str.WIN_2003
jmp 0x14008076b
cmp byte [0x1400bde70], r12b
jne 0x140080d31
lea rdx, str.WIN_XP
jmp 0x14008076b
mov rcx, rbp
cmp byte [0x1400bde74], r12b
jne 0x140080d49
lea rdx, str.WIN_2000
jmp 0x14008076e
lea rdx, str.UNKNOWN
jmp 0x14008076e
mov ebx, dword [0x1400bde48]
jmp 0x1400807a2
lea rdx, [0x1400bde50]
mov rcx, rbp
call fcn.1400146c0
jmp case.default.0x140080762
lea r8, str.InstallLanguage
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
jmp 0x140080849
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rsp + 0x80]
jmp 0x14008076b
lea rdx, [0x14009dda0]
lea rcx, [rsp + 0x2b0]
call fcn.140018120
xor eax, eax
lea rcx, [rsp + 0x2b0]
mov edi, eax
mov r13d, eax
call fcn.140018b2c
xor ecx, ecx
cmp eax, ecx
jle 0x140080e19
lea rbx, [rsp + 0x2b0]
lea rsi, [rsp + 0x2b0]
movzx eax, word [rsi]
cmp ax, 0x20
je 0x140080dfe
add edi, r12d
cmp ax, 0x2c
jne 0x140080df7
mov eax, 0x2e
mov word [rbx], ax
add rbx, 2
lea rcx, [rsp + 0x2b0]
add r13d, r12d
add rsi, 2
call fcn.140018b2c
cmp r13d, eax
jl 0x140080de0
xor ecx, ecx
movsxd rax, edi
lea rdx, [rsp + 0x2b0]
mov word [rsp + rax*2 + 0x2b0], cx
jmp 0x14008076b
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x1400807e8
mov ecx, r12d
lea rdx, [rsp + 0x58]
call fcn.1400418f0
lea rdx, [rsp + 0x58]
jmp 0x14008076b
mov ecx, 2
jmp 0x140080e4f
mov ecx, 3
jmp 0x140080e4f
mov ecx, 4
jmp 0x140080e4f
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x50]
jmp 0x1400807a2
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rsp + 0x54]
jmp 0x1400807a2
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, listen
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, rbp
mov ebx, eax
call fcn.140003c60
mov rdx, rdi
mov rcx, rsi
mov dword [rbp + 8], r12d
mov dword [rbp], ebx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x140080762
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
jmp 0x140080ec9
lea rcx, str.COMSPEC
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x1400807e8
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x1400808a3
lea rdx, [rsp + 0x518]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x518], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x1400807e8
mov eax, dword [0x1400bdec8]
cmp eax, 2
je case.0x140080762.43
cmp eax, 3
jne case.0x140080762.30
mov rcx, rbp
call fcn.140003c60
mov dword [rbp], r12d
mov dword [rbp + 8], r12d
xor ebp, ebp
mov r12d, ebp
mov rcx, r15
call fcn.1400036e0
lea r11, [rsp + 0x4d0]
mov eax, r12d
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.USERPROFILE
jmp 0x140080f17
lea rcx, str.HOMEDRIVE
jmp 0x140080f17
lea rcx, str.HOMEPATH
jmp 0x140080f17
lea rcx, str.HOMESHARE
jmp 0x140080f17
lea rcx, str.LOGONSERVER
jmp 0x140080f17
lea rcx, str.USERDOMAIN
jmp 0x140080f17
lea rcx, str.USERDNSDOMAIN
jmp 0x140080f17
mov ebx, dword [rbx + 0x21c]
jmp 0x1400807a2
movzx ebx, byte [rbx + 0x218]
jmp 0x1400807a2
mov ebx, dword [rbx + 0x26c]
jmp 0x1400807a2
mov rdx, qword [rbx + 0x270]
jmp 0x14008076b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
pxor xmm6, xmm6
mov rcx, rbp
mov r11d, eax
cvtsi2sd xmm6, r11
call fcn.140003c60
movsd qword [rbp], xmm6
mov dword [rbp + 8], 3
jmp case.default.0x140080762