Function at 0x436f8f
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get session user name
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
mov edx, 0x82
mov esi, eax
xor eax, eax
xor ebx, ebx
mov ecx, edx
mov word [ebp - 0x260], bx
lea edi, [ebp - 0x25e]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 0x46c], bx
lea edi, [ebp - 0x46a]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0044be72
lea eax, [ebp - 0xc]
push eax
call fcn.0044beab
pop ecx
pop ecx
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push dword [ebp + 8]
push dword [ebx*4 + 0x466e00]
call fcn.00449703
test eax, eax
pop ecx
pop ecx
je 0x437005
inc ebx
cmp ebx, 0x5b
jl 0x436fea
cmp ebx, 0x5b
jne 0x437072
push 0x4610b4
lea esi, [ebp - 0x1c]
call fcn.00416d81
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.00416ebe
push 0
lea eax, [ebp - 8]
push eax
sub esp, 0xc
lea edi, [ebp - 0x1c]
mov esi, esp
call fcn.00416dcf
lea ebx, [ebp - 0x44]
mov edi, 0x47bd30
call fcn.00416b63
cmp dword [ebp - 8], 0
jne 0x43704d
xor esi, esi
inc esi
jmp 0x43705a
push dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
call fcn.00418a19
xor esi, esi
push dword [ebp - 0x1c]
call fcn.0044951c
push dword [ebp + 8]
call fcn.0044951c
pop ecx
mov eax, esi
jmp 0x43787f
cmp ebx, 0x5a
ja case.default.0x43707b
jmp dword [ebx*4 + 0x437887]
push 0x461058
jmp 0x437578
push 0x45d0f8
jmp 0x437578
push 0x45c43c
jmp 0x437578
push 0x461054
jmp 0x437578
push dword [esi + 0x354]
jmp 0x43786d
push dword [esi + 0x358]
jmp 0x43786d
push dword [edi]
push str._.2d
lea eax, [ebp - 0x260]
push eax
call fcn.00449872
add esp, 0xc
jmp 0x437571
push dword [edi + 4]
jmp 0x4370c2
push dword [edi + 8]
jmp 0x4370c2
push dword [edi + 0xc]
jmp 0x4370c2
mov eax, dword [edi + 0x10]
inc eax
push eax
jmp 0x4370c2
mov eax, dword [edi + 0x14]
add eax, 0x76c
jmp 0x437861
mov eax, dword [edi + 0x18]
inc eax
jmp 0x437861
mov eax, dword [edi + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x4370c7
push 0x104
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x4371c9
push 0x104
push str.CommonFilesDir
jmp 0x43711d
push 0x104
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
call fcn.004146c5
add esp, 0x10
lea esi, [ebp - 0x260]
call fcn.00414d77
jmp 0x437571
push 0x104
push str.Common_AppData
jmp 0x4371c4
mov ebx, 0x104
push ebx
push str.Common_Desktop
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004146c5
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x437571
push ebx
push str.Desktop
push edi
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
jmp 0x437569
push 0x104
push str.Common_Documents
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x260]
jmp 0x437564
mov ebx, 0x104
push ebx
push str.Common_Favorites
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004146c5
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x437571
push ebx
push str.Favorites
jmp 0x4371a9
mov ebx, 0x104
push ebx
push str.Common_Programs
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004146c5
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x437571
push ebx
push str.Programs
jmp 0x4371a9
mov ebx, 0x104
push ebx
push str.Common_Start_Menu
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004146c5
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x437571
push ebx
push str.Start_Menu
jmp 0x4371a9
mov ebx, 0x104
push ebx
push str.Common_Startup
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x260]
call fcn.004146c5
add esp, 0x10
cmp word [ebp - 0x260], 0
jne 0x437571
push ebx
push str.Startup
jmp 0x4371a9
push 0x104
push str.AppData
jmp 0x43730b
push 0x104
push str.Desktop
jmp 0x43730b
push 0x104
push str.Favorites
jmp 0x43730b
push 0x104
push str.Programs
jmp 0x43730b
push 0x104
push str.Start_Menu
jmp 0x43730b
push 0x104
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x4371aa
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
jmp 0x437571
push 0x104
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
jmp 0x437571
push 0x104
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
jmp 0x437571
push 6
jmp 0x43786d
push 9
jmp 0x43786d
push 5
jmp 0x43786d
push 0xa
jmp 0x43786d
push 3
jmp 0x43786d
push 2
jmp 0x43786d
push 7
jmp 0x43786d
push 8
jmp 0x43786d
push 4
jmp 0x43786d
xor eax, eax
inc eax
cmp byte [0x4679c6], al
jmp 0x4373b3
xor eax, eax
inc eax
cmp byte [0x47a6c1], al
mov esi, dword [ebp + 0x14]
jne 0x4373be
push eax
jmp 0x437870
push 0
jmp 0x437870
push pe_nt_image_headers32
jmp 0x43786d
push 0x41
jmp 0x43786d
push 0x42
jmp 0x43786d
push 0x43
jmp 0x43786d
push dword [esi + 0x268]
jmp 0x437578
push dword [esi + 0x25c]
jmp 0x437578
push dword [esi + 0x274]
jmp 0x437578
mov eax, dword [esi + 0x28c]
mov ecx, 0x47bd40
call fcn.0040fd91
jmp 0x437861
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
jmp 0x437571
mov eax, dword [0x479bcc]
mov ecx, eax
dec ecx
je 0x43745f
dec ecx
je 0x437455
dec ecx
je 0x43744b
neg eax
push eax
push str.UNKN_d
jmp 0x4370c7
push 0x460d94
jmp 0x437578
push str.IA64
jmp 0x437578
push 0x460da8
jmp 0x437578
cmp byte [0x479bb4], 1
mov edi, dword [ebp + 0x14]
jne 0x43747f
push str.WIN32_NT
jmp 0x43757b
push str.WIN32_WINDOWS
jmp 0x43757b
xor eax, eax
inc eax
cmp byte [0x479bb4], al
jne 0x4374fb
cmp byte [0x479bba], al
jne 0x4374a6
push str.WIN_LONGHORN
jmp 0x437578
cmp byte [0x479bc0], al
jne 0x4374b8
push str.WIN_VISTA
jmp 0x437578
cmp byte [0x479bbe], al
jne 0x4374ca
push str.WIN_2003
jmp 0x437578
cmp byte [0x479bb8], al
jne 0x4374dc
push str.WIN_XP
jmp 0x437578
cmp byte [0x479bbc], al
mov edi, dword [ebp + 0x14]
jne 0x4374f1
push str.WIN_2000
jmp 0x43757b
push str.WIN_NT4
jmp 0x43757b
cmp byte [0x479bc4], al
jne 0x43750a
push str.WIN_95
jmp 0x437578
cmp byte [0x479bc2], al
mov edi, dword [ebp + 0x14]
jne 0x43751c
push str.WIN_98
jmp 0x43757b
push str.WIN_ME
jmp 0x43757b
push dword [0x4799b0]
jmp 0x43786d
push 0x4799b4
jmp 0x437578
xor eax, eax
inc eax
cmp byte [0x479bb4], al
push 0x104
lea esi, [ebp - 0x260]
jne 0x437585
cmp byte [0x479bbd], al
jne 0x43755a
push str.InstallLanguage
jmp 0x43755f
push str.Default
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004146c5
add esp, 0x10
lea eax, [ebp - 0x260]
push eax
mov edi, dword [ebp + 0x14]
call fcn.00418c7e
jmp case.default.0x43707b
push 0x45bfe0
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call fcn.004146c5
add esp, 0x10
lea eax, [ebp - 0x258]
jmp 0x437577
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x20]
jmp 0x437577
lea eax, [ebp - 0x46c]
push str.3__2__5__0
push eax
call fcn.004495f8
lea eax, [ebp - 0x46c]
push eax
xor esi, esi
xor edi, edi
call fcn.0044985c
add esp, 0xc
test eax, eax
jle 0x437616
mov ax, word [ebp + edi*2 - 0x46c]
cmp ax, 0x20
je 0x437604
cmp ax, 0x2c
jne 0x4375fb
mov word [ebp + esi*2 - 0x46c], 0x2e
jmp 0x437603
mov word [ebp + esi*2 - 0x46c], ax
inc esi
lea eax, [ebp - 0x46c]
push eax
inc edi
call fcn.0044985c
cmp edi, eax
pop ecx
jl 0x4375db
and word [ebp + esi*2 - 0x46c], 0
lea eax, [ebp - 0x46c]
jmp 0x437577
push 0x104
lea eax, [ebp - 0x260]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
jmp 0x437571
lea eax, [ebp - 0x40]
push eax
xor eax, eax
inc eax
call fcn.00415ba5
pop ecx
lea eax, [ebp - 0x40]
jmp 0x437577
lea eax, [ebp - 0x40]
push eax
push 2
jmp 0x43766e
lea eax, [ebp - 0x40]
push eax
push 3
jmp 0x43766e
lea eax, [ebp - 0x40]
push eax
push 4
pop eax
jmp 0x43764a
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x4c]
jmp 0x43786d
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x48]
jmp 0x43786d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
jmp 0x4376c7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.00418bb9
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x43707b
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
jmp 0x437571
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
jmp 0x437155
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x437571
mov eax, dword [0x479be8]
cmp eax, 2
je case.0x43707b.42
cmp eax, 3
je case.0x43707b.42
push 0
jmp 0x43786d
cmp byte [0x479bb4], 0
push 0x104
je 0x437770
lea eax, [ebp - 0x260]
push eax
push str.USERPROFILE
jmp 0x4376f7
push str.Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
lea esi, [ebp - 0x260]
call fcn.004146c5
mov eax, esi
push eax
call fcn.0044985c
add esp, 0x14
jmp 0x4377a2
cmp word [ebp + eax*2 - 0x260], 0x5c
je 0x4377a5
dec eax
jns 0x437797
and word [ebp + eax*2 - 0x260], 0
jmp 0x437571
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMEDRIVE
jmp 0x4376f7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMEPATH
jmp 0x4376f7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.HOMESHARE
jmp 0x4376f7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.LOGONSERVER
jmp 0x4376f7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.USERDOMAIN
jmp 0x4376f7
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.USERDNSDOMAIN
jmp 0x4376f7
push dword [esi + 0x31c]
jmp 0x43786d
movzx eax, byte [esi + 0x318]
jmp 0x437861
push dword [esi + 0x35c]
jmp 0x43786d
push dword [esi + 0x360]
jmp 0x437578
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
jmp 0x43786d
push 0x51e0001
jmp 0x43786d
push 1
mov esi, dword [ebp + 0x14]
call fcn.00418bb9
push dword [ebp + 8]
call fcn.0044951c
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10