Function at 0x42e6b5
Capabilities:
Get keyboard layout
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov esi, 0x104
xor ebx, ebx
push esi
mov edi, eax
lea eax, [ebp - 0x12f]
push ebx
push eax
mov byte [ebp - 0x130], bl
call fcn.004507e0
add esp, 0xc
push esi
lea eax, [ebp - 0x24f]
push ebx
push eax
mov byte [ebp - 0x250], bl
call fcn.004507e0
lea eax, [ebp - 0x148]
add esp, 0xc
push eax
mov dword [ebp - 4], ebx
call fcn.00452177
pop ecx
lea eax, [ebp - 0x148]
push eax
call fcn.00452bab
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x472b30]
call fcn.0044dfd0
test eax, eax
pop ecx
pop ecx
je 0x42e739
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5b
jl 0x42e718
mov eax, dword [ebp - 4]
cmp eax, 0x5b
jne 0x42e79b
push 0x46d128
lea esi, [ebp - 0x18]
call fcn.0040e021
lea eax, [ebp + 8]
mov edi, esi
mov dword [ebp - 8], ebx
call fcn.0040e188
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea esi, [ebp - 8]
call fcn.0040dddd
cmp dword [ebp - 4], ebx
jne 0x42e78c
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
call fcn.0044db10
pop ecx
push dword [ebp + 8]
call fcn.0044db10
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
call fcn.0040fc2e
xor ebx, ebx
jmp 0x42e771
cmp eax, 0x5a
ja case.default.0x42e7a0
jmp dword [eax*4 + 0x42f2e9]
push 0x46d158
mov edi, dword [ebp + 0x14]
call fcn.0040fea7
jmp case.default.0x42e7a0
push 0x46a384
jmp 0x42e7ac
push 0x46ab2c
jmp 0x42e7ac
push 0x46d15c
jmp 0x42e7ac
push dword [edi + 0x254]
jmp 0x42f18a
push dword [edi + 0x258]
jmp 0x42f18a
mov eax, dword [ebp - 8]
push dword [eax]
push str._.2d
lea eax, [ebp - 0x130]
push eax
call fcn.0044e1cb
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
jmp 0x42e7ac
mov eax, dword [ebp - 8]
push dword [eax + 4]
jmp 0x42e7e6
mov eax, dword [ebp - 8]
push dword [eax + 8]
jmp 0x42e7e6
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
jmp 0x42e7e6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
inc eax
push eax
jmp 0x42e7e6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
jmp 0x42f18a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
inc eax
jmp 0x42e830
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
inc eax
push eax
push str._.3d
jmp 0x42e7eb
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.CommonFilesDir
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e91f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Personal
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x130]
call fcn.0040bfe2
jmp 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_AppData
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e9b7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Documents
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ea86
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Favorites
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eb16
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Programs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Programs
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eba6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Start_Menu
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Start_Menu
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ec36
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Common_Startup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
jne 0x42e7fa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push reloc.WSOCK32.dll_accept
mov byte [ebp - 0x130], bl
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Startup
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.AppData
jmp 0x42e884
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42e9cb
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42ea9a
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42eb2a
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42ebba
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
jmp 0x42ec4a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
jmp 0x42e7fa
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x42e7fa
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x42e7fa
push 6
jmp 0x42f18a
push 3
jmp 0x42f18a
push 9
jmp 0x42f18a
push 5
jmp 0x42f18a
push 0xa
jmp 0x42f18a
push 2
jmp 0x42f18a
push 7
jmp 0x42f18a
push 8
jmp 0x42f18a
push 4
jmp 0x42f18a
push 1
jmp 0x42f18a
cmp byte [0x4745ae], 1
mov esi, dword [ebp + 0x14]
jne 0x42eda9
push 1
jmp 0x42f18d
push ebx
jmp 0x42f18d
cmp byte [0x47ef31], 1
jmp 0x42ed9d
push 0x40
jmp 0x42f18a
push 0x41
jmp 0x42f18a
push 0x42
jmp 0x42f18a
push 0x43
jmp 0x42f18a
push dword [edi + 0x16c]
jmp 0x42e7ac
push dword [edi + 0x160]
jmp 0x42e7ac
push dword [edi + 0x178]
jmp 0x42e7ac
mov ecx, dword [edi + 0x190]
call fcn.004065e9
jmp 0x42e830
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x42e7fa
mov eax, dword [0x47e6b4]
mov ecx, eax
dec ecx
je 0x42ee49
dec ecx
je 0x42ee3f
dec ecx
je 0x42ee35
neg eax
push eax
push str.UNKN_d
jmp 0x42e7eb
push 0x46d2d0
jmp 0x42e7ac
push str.IA64
jmp 0x42e7ac
push 0x46d2c4
jmp 0x42e7ac
cmp byte [0x47e69c], 1
mov edi, dword [ebp + 0x14]
jne 0x42ee69
push str.WIN32_NT
jmp 0x42e7af
push str.WIN32_WINDOWS
jmp 0x42e7af
cmp byte [0x47e69c], 1
jne 0x42eee8
cmp byte [0x47e6a2], 1
jne 0x42ee8f
push str.WIN_LONGHORN
jmp 0x42e7ac
cmp byte [0x47e6a8], 1
jne 0x42eea2
push str.WIN_VISTA
jmp 0x42e7ac
cmp byte [0x47e6a6], 1
jne 0x42eeb5
push str.WIN_2003
jmp 0x42e7ac
cmp byte [0x47e6a0], 1
jne 0x42eec8
push str.WIN_XP
jmp 0x42e7ac
cmp byte [0x47e6a4], 1
mov edi, dword [ebp + 0x14]
jne 0x42eede
push str.WIN_2000
jmp 0x42e7af
push str.WIN_NT4
jmp 0x42e7af
cmp byte [0x47e6ac], 1
jne 0x42eefb
push str.WIN_95
jmp 0x42e7ac
cmp byte [0x47e6aa], 1
mov edi, dword [ebp + 0x14]
jne 0x42ef11
push str.WIN_98
jmp 0x42e7af
push str.WIN_ME
jmp 0x42e7af
push dword [0x47e598]
jmp 0x42f18a
push 0x47e59c
jmp 0x42e7ac
cmp byte [0x47e69c], 1
lea eax, [ebp - 4]
push eax
push 1
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
push ebx
jne 0x42efa6
cmp byte [0x47e6a5], 1
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
jne 0x42ef81
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.InstallLanguage
jmp 0x42e884
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Default
jmp 0x42e884
push str..DEFAULTControl_PanelDesktopResourceLocale
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42efde
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push 0x469ede
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x12c]
jmp 0x42e800
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x18]
jmp 0x42e800
lea eax, [ebp - 0x250]
push str.3__2__9__1
push eax
call fcn.0044d950
lea eax, [ebp - 0x250]
push eax
xor esi, esi
xor edi, edi
call fcn.0044e140
add esp, 0xc
test eax, eax
jle 0x42f056
mov al, byte [ebp + edi - 0x250]
cmp al, 0x20
je 0x42f044
cmp al, 0x2c
jne 0x42f03c
mov byte [ebp + esi - 0x250], 0x2e
jmp 0x42f043
mov byte [ebp + esi - 0x250], al
inc esi
lea eax, [ebp - 0x250]
push eax
inc edi
call fcn.0044e140
cmp edi, eax
pop ecx
jl 0x42f023
mov byte [ebp + esi - 0x250], bl
lea eax, [ebp - 0x250]
jmp 0x42e800
push esi
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
jmp 0x42e7fa
lea eax, [ebp - 0x28]
xor esi, esi
push eax
inc esi
call fcn.0040cdea
pop ecx
lea eax, [ebp - 0x28]
jmp 0x42e800
lea eax, [ebp - 0x28]
push eax
push 2
pop esi
jmp 0x42f083
lea eax, [ebp - 0x28]
push eax
push 3
jmp 0x42f097
lea eax, [ebp - 0x28]
push eax
push 4
jmp 0x42f097
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x138]
jmp 0x42f18a
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x134]
jmp 0x42f18a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, dword [ebp + 0x14]
push eax
call fcn.0040fde2
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x42e7a0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
jmp 0x42f0f9
push esi
lea eax, [ebp - 0x130]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
jmp 0x42e7fa
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x42e91f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x42e7fa
mov eax, dword [0x47e6d0]
cmp eax, 2
je case.0x42e7a0.42
cmp eax, 3
je case.0x42e7a0.42
push ebx
mov esi, dword [ebp + 0x14]
call fcn.0040fde2
jmp case.default.0x42e7a0
cmp byte [0x47e69c], bl
je 0x42f1ae
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERPROFILE
jmp 0x42f13b
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
mov dword [ebp - 8], esi
mov byte [ebp - 0x130], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f1f6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push str.Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130]
push eax
call fcn.0044e140
pop ecx
jmp 0x42f20f
cmp byte [ebp + eax - 0x130], 0x5c
je 0x42f212
dec eax
jns 0x42f205
mov byte [ebp + eax - 0x130], bl
jmp 0x42e7fa
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEDRIVE
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMEPATH
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.HOMESHARE
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.LOGONSERVER
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDOMAIN
jmp 0x42f13b
push esi
lea eax, [ebp - 0x130]
push eax
push str.USERDNSDOMAIN
jmp 0x42f13b
push dword [edi + 0x220]
jmp 0x42f18a
movzx eax, byte [edi + 0x21c]
jmp 0x42e830
push dword [edi + 0x25c]
jmp 0x42f18a
push dword [edi + 0x260]
jmp 0x42e7ac
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x42f2cd
fadd qword [0x46d9b0]
mov esi, dword [ebp + 0x14]
push ecx
push ecx
fstp qword [esp]
call fcn.0040fe8e
jmp case.default.0x42e7a0
push 0x5780000
jmp 0x42f18a