Function at 0x14001f3f4
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x2f0
mov r12, rdx
movaps xmmword [rax - 0x48], xmm6
mov rbx, rcx
xor r15d, r15d
mov edx, 0x104
mov word [rbp - 0x30], r15w
lea rcx, [rsp + 0x30]
mov r14, r8
call fcn.1400098e8
mov r13, qword [r12]
lea rsi, str.ERROR
mov edi, r15d
mov rcx, qword [rsi]
mov rdx, r13
call fcn.1400295bc
mov r8d, 1
test eax, eax
je 0x14001f46e
add edi, r8d
lea rax, [0x1400c8048]
add rsi, 8
cmp rsi, rax
jl 0x14001f446
cmp edi, 0x61
je 0x140062ad4
cmp edi, 0x60
ja case.0x14001f490.88
lea rdx, [0x140000000]
movsxd rax, edi
mov ecx, dword [rdx + rax*4 + 0x1f504]
add rcx, rdx
jmp rcx
lea rdx, [rbx + 0x190]
mov rcx, r14
call fcn.140007bb8
lea rcx, [rsp + 0x30]
call fcn.14000a07c
lea r11, [rsp + 0x2f0]
mov eax, r15d
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x1400b65b4]
mov rcx, r14
call fcn.14001f688
jmp case.0x14001f490.88
lea rdx, [rbx + 0x170]
jmp 0x14001f499
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 1
mov dword [r14 + 0x10], 1
jmp case.0x14001f490.88
lea rdx, [0x1400de048]
lea rcx, [rbp - 0x58]
call fcn.14000ec00
mov rdx, r12
lea rcx, [rbp - 0x58]
call fcn.140007c24
xor r9d, r9d
mov dword [rbp + 0x248], r15d
lea r8, [rbp + 0x248]
lea rdx, [rbp - 0x58]
call fcn.1400220d0
test rax, rax
jne 0x140062b15
or r15d, 0xffffffff
jmp 0x140062b20
mov rdx, rax
mov rcx, r14
call fcn.14000ee20
lea rcx, [rbp - 0x58]
jmp 0x140062c38
lea rdx, [0x1400de0a4]
jmp 0x14001f4d5
lea rdx, [0x1400c53b8]
jmp 0x14001f4d5
lea rdx, reloc.OLEAUT32.dll_VariantCopy
jmp 0x14001f4d5
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rbx
call fcn.140004afc
mov ebx, dword [rax + 0x1c]
jmp 0x140062b6b
mov ebx, dword [rbx + 0x244]
mov rcx, r14
call fcn.1400113e0
mov dword [r14], ebx
jmp 0x14001f4f7
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rbx
call fcn.140004afc
mov rcx, r14
lea rdx, [rax + 0x28]
call fcn.14000ee20
nop
jmp case.0x14001f490.88
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx r8d, word [rsp + 0x5e]
lea rdx, str._.3d
jmp 0x140062bc4
mov r8d, r15d
lea rdx, [0x1400dd310]
lea rcx, [rbp - 0x30]
call fcn.140024834
jmp 0x140062bea
lea rdx, [rbp + 0x238]
mov dword [rbp + 0x238], 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp - 0x30]
jmp 0x14001f4d5
lea rcx, [rbp + 0x248]
call fcn.14009b0d0
lea r8, [0x1400de0bc]
jmp 0x140062c1b
lea rcx, [rbp + 0x248]
call fcn.14009b0d0
lea r8, [0x1400de0e4]
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.14009b008
mov rdx, rax
mov rcx, r14
call fcn.140007bb8
lea rcx, [rsp + 0x50]
call fcn.14000a07c
nop
jmp case.0x14001f490.88
lea rcx, [rbp + 0x248]
call fcn.14009b0d0
lea r8, [0x1400de0c4]
jmp 0x140062c1b
lea rcx, [rbp + 0x248]
call fcn.14009b0d0
lea r8, [0x1400de0cc]
jmp 0x140062c1b
lea rcx, [rbp + 0x248]
call fcn.14009b0d0
lea r8, [0x1400dd310]
jmp 0x140062c1b
lea rcx, [rbp + 0x248]
call fcn.14009b0d0
lea r8, [0x1400de0d4]
jmp 0x140062c1b
lea rcx, [rbp + 0x248]
call fcn.14009b0d0
lea r8, [0x1400de0dc]
jmp 0x140062c1b
lea rcx, [rbp + 0x248]
call fcn.14009b0d0
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14009b080
test rax, rax
je 0x140062bba
mov r8d, dword [rax + 0x18]
inc r8d
jmp 0x140062bbd
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroyData
jmp 0x140062ce9
mov ecx, 7
lea rdx, [rsp + 0x30]
call fcn.14007cb98
jmp 0x140062cff
lea rcx, [rsp + 0x30]
call fcn.140005680
lea rdx, [rsp + 0x30]
jmp 0x14001f499
mov ecx, 0x2b
jmp 0x140062ce9
mov ecx, 5
jmp 0x140062ce9
mov ecx, SafeArrayDestroyData
jmp 0x140062ce9
mov ecx, 0x19
jmp 0x140062ce9
mov ecx, 0x2e
jmp 0x140062ce9
mov ecx, reloc.OLEAUT32.dll_CreateStdDispatch
jmp 0x140062ce9
mov ecx, reloc.OLEAUT32.dll_SafeArrayUnaccessData
jmp 0x140062ce9
mov ecx, SafeArrayUnaccessData
jmp 0x140062ce9
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x140062ce9
mov ecx, CreateStdDispatch
jmp 0x140062ce9
mov ecx, 0x1a
jmp 0x140062ce9
mov ecx, reloc.WSOCK32.dll_recv
jmp 0x140062ce9
mov ecx, 6
jmp 0x140062ce9
mov ecx, 2
jmp 0x140062ce9
mov ecx, reloc.OLEAUT32.dll_VariantChangeType
jmp 0x140062ce9
lea rdx, [rbp + 0x238]
mov dword [rbp + 0x238], 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.DLL_GetComputerNameW]
jmp 0x140062bea
mov edx, 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
je case.0x14001f490.88
jmp 0x140062bea
cmp byte [0x1400f046e], r15b
je 0x140062df5
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
call fcn.14009af20
mov edx, 0x104
lea rcx, [rbp - 0x30]
call rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140062bea
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
jmp 0x140062bea
mov edx, 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
jmp 0x140062bea
mov rcx, r14
call fcn.1400113e0
mov dword [r14], r15d
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 6
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 9
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 5
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 0xa
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 3
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 2
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 7
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 8
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 4
jmp 0x14001f4f7
cmp byte [0x1400f03bc], r8b
jmp 0x140062edd
cmp byte [0x1400f0e6d], r8b
mov ebx, r15d
sete bl
jmp 0x140062ef7
mov eax, dword [0x1400f04c0]
mov ebx, r15d
add eax, 0xfffffffd
cmp eax, r8d
setbe bl
mov rcx, r14
call fcn.1400113e0
mov dword [r14 + 0x10], 1
mov dword [r14], ebx
jmp case.0x14001f490.88
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 0x40
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 0x41
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 0x42
jmp 0x14001f4f7
mov rcx, r14
call fcn.1400113e0
mov dword [r14], 0x43
jmp 0x14001f4f7
lea rdx, [rbx + 0x150]
jmp 0x14001f499
mov edx, dword [rbx + 0x1c4]
call fcn.140077838
mov ebx, eax
jmp 0x140062b6b
lea rdx, [rbp - 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
jmp 0x140062bea
movzx eax, word [0x1400f0470]
test eax, eax
je 0x140062fc7
cmp eax, 6
je 0x140062fbb
cmp eax, 9
lea rdx, str.UNKNOWN
lea rcx, [0x1400de108]
cmove rdx, rcx
jmp 0x14001f4d5
lea rdx, str.IA64
jmp 0x14001f4d5
lea rdx, [0x1400de0f0]
jmp 0x14001f4d5
xor ecx, ecx
mov eax, 0x80000001
cpuid
bt edx, 0x1d
lea rcx, [0x1400de108]
lea rdx, [0x1400de0f0]
cmovae rcx, rdx
mov rdx, rcx
jmp 0x14001f4d5
lea rdx, str.WIN32_NT
jmp 0x14001f4d5
cmp byte [0x1400f0466], r8b
jne 0x14006301b
lea rdx, str.WIN_11
jmp 0x14001f4d5
cmp byte [0x1400f0464], r8b
jne 0x140063030
lea rdx, str.WIN_10
jmp 0x14001f4d5
cmp byte [0x1400f046c], r8b
jne 0x140063045
lea rdx, str.WIN_2022
jmp 0x14001f4d5
cmp byte [0x1400f046a], r8b
jne 0x14006305a
lea rdx, str.WIN_2019
jmp 0x14001f4d5
cmp byte [0x1400f0468], r8b
jne 0x14006306f
lea rdx, str.WIN_2016
jmp 0x14001f4d5
cmp byte [0x1400f0460], r8b
jne 0x140063084
lea rdx, str.WIN_81
jmp 0x14001f4d5
cmp byte [0x1400f0462], r8b
jne 0x140063099
lea rdx, str.WIN_2012R2
jmp 0x14001f4d5
cmp byte [0x1400f045e], r8b
jne 0x1400630ae
lea rdx, str.WIN_2012
jmp 0x14001f4d5
cmp byte [0x1400f045c], r8b
jne 0x1400630c3
lea rdx, str.WIN_8
jmp 0x14001f4d5
cmp byte [0x1400f045a], r8b
jne 0x1400630d8
lea rdx, str.WIN_2008R2
jmp 0x14001f4d5
cmp byte [0x1400f0458], r8b
jne 0x1400630ed
lea rdx, str.WIN_7
jmp 0x14001f4d5
cmp byte [0x1400f0456], r8b
jne 0x140063102
lea rdx, str.WIN_2008
jmp 0x14001f4d5
cmp byte [0x1400f0454], r8b
jne 0x140063117
lea rdx, str.WIN_VISTA
jmp 0x14001f4d5
cmp byte [0x1400f0452], r8b
jne 0x14006312c
lea rdx, str.WIN_2003
jmp 0x14001f4d5
cmp byte [0x1400f0450], r8b
jne 0x140063153
cmp byte [0x1400f0472], r15b
lea rdx, str.WIN_XPe
lea rax, str.WIN_XP
cmove rdx, rax
jmp 0x14001f4d5
lea rdx, str.UNKNOWN
jmp 0x14001f4d5
mov ebx, dword [0x1400f0428]
jmp 0x140062b6b
lea rdx, [0x1400f0430]
jmp 0x14001f499
lea rax, [rbp - 0x30]
mov r9d, 0x104
lea r8, str.InstallLanguage
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlNlsLanguage
mov rcx, 0xffffffff80000002
call fcn.140006f60
jmp 0x140062bea
lea rax, [rbp - 0x30]
mov r9d, 0x104
lea r8, str.SchemeLangID
mov qword [rsp + 0x20], rax
lea rdx, str.Control_PanelAppearance
mov rcx, 0xffffffff80000001
call fcn.140006f60
movzx ecx, word [rbp - 0x30]
lea rdx, [rbp - 0x30]
mov r8d, 4
mov dword [rbp + 0x238], ecx
call fcn.14000ec90
jmp 0x140062bea
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rdx, [rbp - 0x58]
jmp 0x14001f4d5
lea rcx, [rbp - 0x30]
call fcn.14009af70
jmp 0x140062bea
mov ecx, r8d
jmp 0x140063216
mov ecx, 4
lea rdx, [rbp - 0x78]
call fcn.14007ca98
lea rdx, [rbp - 0x78]
jmp 0x14001f4d5
mov ecx, 2
jmp 0x140063216
mov ecx, 3
jmp 0x140063216
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rbp - 0x80]
jmp 0x140062b6b
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [rbp - 0x7c]
jmp 0x140062b6b
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x14006329e
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, reloc.WSOCK32.dll_WSACleanup
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, r14
mov ebx, eax
call fcn.1400113e0
mov rdx, rdi
mov dword [r14 + 0x10], 1
mov rcx, rsi
mov dword [r14], ebx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
jmp case.0x14001f490.88
lea rcx, str.COMSPEC
jmp 0x1400632e1
lea rcx, str.USERDNSDOMAIN
lea rdx, [rbp - 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
jmp 0x140062bea
lea rdx, [rbp - 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea rcx, [rbp - 0x30]
call fcn.140023a98
jmp 0x140062bea
lea rcx, str.USERPROFILE
jmp 0x1400632e1
lea rcx, str.HOMEDRIVE
jmp 0x1400632e1
lea rcx, str.HOMEPATH
jmp 0x1400632e1
lea rcx, str.HOMESHARE
jmp 0x1400632e1
lea rcx, str.LOGONSERVER
jmp 0x1400632e1
lea rcx, str.USERDOMAIN
jmp 0x1400632e1
lea rdx, [rbx + 0x248]
jmp 0x14001f499
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov eax, eax
xorps xmm6, xmm6
mov rcx, r14
cvtsi2sd xmm6, rax
call fcn.1400113e0
mov dword [r14 + 0x10], 3
movsd qword [r14], xmm6
jmp case.0x14001f490.88