Function at 0x470e45
Capabilities:
Get keyboard layout
Get session user name
Persist via run registry key

Disassembly:
sub esp, 0x49c
push ebx
push ebp
mov ebp, dword [esp + 0x4ac]
push esi
mov esi, dword [esp + 0x4ac]
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x7a]
push ecx
mov word [esp + 0x7c], ax
call fcn.00414fc0
add esp, 0xc
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x2a2]
push eax
mov word [esp + 0x2a4], dx
call fcn.00414fc0
lea ecx, [esp + 0x54]
add esp, 0xc
push ecx
xor ebx, ebx
call fcn.00417ad3
lea edx, [esp + 0x4c]
add esp, 4
push edx
call fcn.0041848a
mov edi, eax
mov eax, dword [esp + 0x4bc]
add esp, 4
mov dword [esp + 0x24], eax
jmp 0x470ec5
mov ecx, dword [esp + 0x24]
mov edx, dword [ebx*4 + 0x490930]
push ecx
push edx
call fcn.004151ce
add esp, 8
test eax, eax
je 0x470ee4
inc ebx
cmp ebx, 0x60
jl 0x470ec5
cmp ebx, 0x60
jne 0x470f62
mov edi, 0x48a5ac
lea esi, [esp + 0x28]
call fcn.00406780
lea eax, [esp + 0x4b8]
push eax
push esi
mov dword [esp + 0x2c], 0
call fcn.0045503a
lea edx, [esp + 0x18]
push edx
xor ecx, ecx
lea edi, [esp + 0x28]
mov ebx, esi
call fcn.0040e9e0
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x470f4c
mov ecx, esi
call fcn.004066f0
lea ecx, [esp + 0x4b8]
call fcn.004066f0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret 0x18
push eax
mov ebx, ebp
call fcn.00405b40
lea ecx, [esp + 0x28]
call fcn.004066f0
jmp case.default.0x470f6b
cmp ebx, 0x5f
ja case.default.0x470f6b
jmp dword [ebx*4 + 0x471b2d]
mov edi, 0x48a604
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov edi, 0x483e84
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov edi, 0x4860ec
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov edi, 0x48a608
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx + esi + 4]
call fcn.00402040
mov edi, dword [eax + 0x14]
mov esi, ebp
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
mov edx, dword [esi]
mov eax, dword [edx + 4]
lea eax, [eax + esi + 4]
call fcn.00402040
mov edi, dword [eax + 0x1c]
mov esi, ebp
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
lea ecx, [esp + 0x28]
push ecx
call dword [0x4811f0]
movzx edx, word [esp + 0x36]
push edx
push 0x48a60c
lea eax, [esp + 0x78]
push eax
call fcn.00415324
add esp, 0xc
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov ecx, dword [edi]
push ecx
push str._.2d
lea edx, [esp + 0x78]
push edx
jmp 0x471011
mov eax, dword [edi + 4]
push eax
push str._.2d
lea ecx, [esp + 0x78]
push ecx
jmp 0x471011
mov edx, dword [edi + 8]
push edx
push str._.2d
jmp 0x47100c
mov ecx, dword [edi + 0xc]
push ecx
push str._.2d
lea edx, [esp + 0x78]
push edx
jmp 0x471011
mov eax, dword [edi + 0x10]
inc eax
push eax
push str._.2d
lea ecx, [esp + 0x78]
push ecx
jmp 0x471011
mov edi, dword [edi + 0x14]
mov esi, ebp
add edi, 0x76c
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
mov edi, dword [edi + 0x18]
mov esi, ebp
inc edi
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
mov edx, dword [edi + 0x1c]
inc edx
jmp 0x471006
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
lea esi, [esp + 0x80]
call fcn.00410500
add esp, 0x10
mov edi, esi
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
push str.CommonFilesDir
jmp 0x4710b2
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [esp + 0x80]
call fcn.00410500
add esp, 0x10
call fcn.00411d80
mov edi, esi
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
push str.Common_AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x4710b7
push 0x104
push str.Common_Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
lea esi, [esp + 0x80]
call fcn.00410500
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x471019
push 0x104
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x4710bc
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x4710b7
push 0x104
push str.Common_Favorites
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
lea esi, [esp + 0x80]
call fcn.00410500
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x471019
push 0x104
push str.Favorites
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x4710bc
push 0x104
push str.Common_Programs
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
lea esi, [esp + 0x80]
call fcn.00410500
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x471019
push 0x104
push str.Programs
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x4710bc
push 0x104
push str.Common_Start_Menu
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
lea esi, [esp + 0x80]
call fcn.00410500
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x471019
push 0x104
push str.Start_Menu
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x4710bc
push 0x104
push str.Common_Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_bind
lea esi, [esp + 0x80]
call fcn.00410500
add esp, 0x10
cmp word [esp + 0x70], 0
jne 0x471019
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x4710bc
push 0x104
push str.AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
jmp 0x4710bc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x74]
push edx
mov dword [esp + 0x1c], 0x104
call dword [0x4812bc]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [0x4812c0]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov ecx, dword [0x4a4c24]
cmp byte [ecx + 0x2a], 0
push 0x104
lea edx, [esp + 0x74]
push edx
je 0x47134f
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
call fcn.00436bb5
call eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00436d0e
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
call dword [0x4812c4]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 6
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 3
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 9
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 5
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 0xa
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 2
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 7
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 8
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 4
jmp 0x471b09
mov ebx, 1
cmp byte [0x492b9a], bl
mov esi, ebp
jne 0x47142f
call fcn.00401f90
mov dword [ebp + 8], ebx
mov dword [ebp], ebx
jmp case.default.0x470f6b
call fcn.00401f90
mov dword [ebp + 8], ebx
mov dword [ebp], 0
jmp case.default.0x470f6b
mov ebx, 1
cmp byte [0x4a3d59], bl
jmp 0x47141b
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 0x40
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 0x41
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 0x42
jmp 0x471b09
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 0x43
jmp 0x471b09
mov edi, dword [esi + 0xc0]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov edi, dword [esi + 0xb0]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov edi, dword [esi + 0xd0]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov eax, dword [esi + 0xec]
push eax
call fcn.0043ab94
mov esi, ebp
mov edi, eax
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
lea ecx, [esp + 0x70]
push ecx
push 0x104
call dword [0x481330]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov edx, dword [0x4a4c24]
movzx eax, word [edx + 0x2c]
test eax, eax
je 0x47155f
cmp eax, 6
je 0x47153c
mov ebx, ebp
cmp eax, 9
jne 0x471631
mov edi, 0x48a8c4
call fcn.0040fc70
jmp case.default.0x470f6b
mov edi, str.IA64
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
call fcn.00412b00
mov edi, 0x48a8c4
test al, al
jne 0x47101d
mov edi, 0x48a8b0
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov edi, str.WIN32_NT
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov eax, dword [0x4a4c24]
mov cl, 1
cmp byte [eax + 0x28], cl
jne 0x47159e
mov edi, str.WIN_2008R2
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
cmp byte [eax + 0x26], cl
jne 0x4715b4
mov edi, str.WIN_7
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
cmp byte [eax + 0x24], cl
jne 0x4715ca
mov edi, str.WIN_2008
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
cmp byte [eax + 0x22], cl
jne 0x4715e0
mov edi, str.WIN_VISTA
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
cmp byte [eax + 0x20], cl
jne 0x4715f6
mov edi, str.WIN_2003
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
cmp byte [eax + 0x1e], cl
jne 0x47161b
cmp byte [eax + 0x2e], 0
mov edi, str.WIN_XPe
jne 0x47101d
mov edi, str.WIN_XP
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov ebx, ebp
cmp byte [eax + 0x1c], cl
jne 0x471631
mov edi, str.WIN_2000
call fcn.0040fc70
jmp case.default.0x470f6b
mov edi, str.UNKNOWN
call fcn.0040fc70
jmp case.default.0x470f6b
mov eax, dword [0x4a4c24]
mov edi, dword [eax + 8]
mov esi, ebp
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
mov edi, dword [0x4a4c24]
add edi, 0xc
mov esi, ebp
call fcn.0040fce0
jmp case.default.0x470f6b
push 0x104
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
jmp 0x4710b7
push 0x104
push str.SchemeLangID
push str.Control_PanelAppearance
push reloc.WSOCK32.dll_accept
lea esi, [esp + 0x80]
call fcn.00410500
movzx eax, word [esp + 0x80]
push 4
push esi
push eax
mov dword [esp + 0x30], eax
call fcn.00438a9a
add esp, 0x1c
mov edi, esi
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
lea edx, [esp + 0x284]
push edx
call dword [0x481498]
lea edi, [esp + 0x284]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
lea eax, [esp + 0x298]
push 0x48aa44
push eax
call fcn.004131c5
lea ecx, [esp + 0x2a0]
push ecx
xor esi, esi
xor edi, edi
call fcn.0041503a
add esp, 0xc
test eax, eax
jle 0x471756
lea esp, [esp]
movzx eax, word [esp + edi*2 + 0x298]
cmp ax, 0x20
je 0x471741
cmp ax, 0x2c
jne 0x471738
mov edx, 0x2e
mov word [esp + esi*2 + 0x298], dx
jmp 0x471740
mov word [esp + esi*2 + 0x298], ax
inc esi
lea eax, [esp + 0x298]
push eax
inc edi
call fcn.0041503a
add esp, 4
cmp edi, eax
jl 0x471715
xor ecx, ecx
lea edi, [esp + 0x298]
mov ebx, ebp
mov word [esp + esi*2 + 0x298], cx
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
lea edx, [esp + 0x74]
push edx
push 0
call dword [0x481300]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
lea eax, [esp + 0x50]
push eax
push 1
call fcn.004390e5
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
lea ecx, [esp + 0x50]
push ecx
push 2
call fcn.004390e5
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
lea edx, [esp + 0x50]
push edx
push 3
call fcn.004390e5
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
lea eax, [esp + 0x50]
push eax
push 4
call fcn.004390e5
add esp, 8
lea edi, [esp + 0x50]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
lea ecx, [esp + 0x38]
push ecx
call dword [0x481608]
push eax
call dword [0x481654]
mov edi, dword [esp + 0x40]
mov esi, ebp
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
lea edx, [esp + 0x38]
push edx
call dword [0x481608]
push eax
call dword [0x481654]
mov edi, dword [esp + 0x44]
mov esi, ebp
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
call dword [0x481608]
mov edi, eax
push edi
call dword [0x481688]
mov ebx, eax
push 0xc
push ebx
call dword [0x481138]
mov esi, ebp
mov dword [esp + 0x18], eax
call fcn.00401f90
mov eax, dword [esp + 0x18]
push ebx
push edi
mov dword [ebp + 8], 1
mov dword [ebp], eax
call dword [0x481684]
jmp case.default.0x470f6b
call dword [0x481608]
mov edi, eax
push edi
call dword [0x481688]
mov ebx, eax
push 0x74
push ebx
call dword [0x481138]
mov esi, ebp
mov dword [esp + 0x18], eax
call fcn.00401f90
mov ecx, dword [esp + 0x18]
push ebx
push edi
mov dword [ebp + 8], 1
mov dword [ebp], ecx
call dword [0x481684]
jmp case.default.0x470f6b
push 0x104
lea edx, [esp + 0x74]
push edx
push str.COMSPEC
call dword [0x481298]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
lea eax, [esp + 0x70]
push eax
push 0x104
call dword [0x481228]
lea esi, [esp + 0x70]
call fcn.00411d80
mov edi, esi
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x74]
push edx
mov dword [esp + 0x1c], 0x104
call dword [0x481014]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
mov eax, dword [0x4a36cc]
cmp eax, 3
je case.0x470f6b.43
cmp eax, 4
jne case.0x470f6b.30
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 1
jmp 0x471b09
push 0x104
lea eax, [esp + 0x74]
push eax
push str.USERPROFILE
call dword [0x481298]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
lea ecx, [esp + 0x74]
push ecx
push str.HOMEDRIVE
call dword [0x481298]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
lea edx, [esp + 0x74]
push edx
push str.HOMEPATH
call dword [0x481298]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
lea eax, [esp + 0x74]
push eax
push str.HOMESHARE
call dword [0x481298]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
lea ecx, [esp + 0x74]
push ecx
push str.LOGONSERVER
call dword [0x481298]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
lea edx, [esp + 0x74]
push edx
push str.USERDOMAIN
call dword [0x481298]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push 0x104
lea eax, [esp + 0x74]
push eax
push str.USERDNSDOMAIN
call dword [0x481298]
lea edi, [esp + 0x70]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
push esi
call fcn.004451dc
mov esi, ebp
mov edi, eax
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
push esi
call fcn.00453848
mov esi, ebp
mov bl, al
call fcn.00401f90
mov dword [ebp + 8], 9
mov byte [ebp], bl
jmp case.default.0x470f6b
mov edi, dword [esi + 0x140]
mov esi, ebp
call fcn.00401f90
mov dword [ebp], edi
jmp 0x471b09
mov edi, dword [esi + 0x144]
mov ebx, ebp
call fcn.0040fc70
jmp case.default.0x470f6b
call dword [0x4812c8]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
test eax, eax
jge 0x471ae0
fadd qword [0x48b510]
mov esi, ebp
fstp qword [esp + 0x18]
call fcn.00401f90
fld qword [esp + 0x18]
fstp qword [ebp]
mov dword [ebp + 8], 3
jmp case.default.0x470f6b
mov esi, ebp
call fcn.00401f90
mov dword [ebp], 0
mov dword [ebp + 8], 1
lea ecx, [esp + 0x4b8]
call fcn.004066f0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x49c
ret 0x18