Function at 0x46183f
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x466a76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x182c
call fcn.00438a90
and dword [esp + 4], 0
push ebx
push esi
push edi
push 0x3ff
lea eax, [esp + 0x35]
push 0
push eax
mov byte [esp + 0x3c], 0
call fcn.00438870
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 0xc
push edi
push 0x46cde8
call esi
test eax, eax
je 0x461ca8
push edi
push str.lang
call esi
test eax, eax
je 0x461ca8
push edi
push str.btag1
call esi
test eax, eax
jne 0x4618c6
mov eax, dword [ebp + 0x14]
add eax, 0x1c
jmp 0x461cb0
push edi
push str.btag2
call esi
test eax, eax
jne 0x4618df
mov eax, dword [ebp + 0x14]
add eax, 0x21c
jmp 0x461cb0
push edi
push str.btag3
call esi
test eax, eax
jne 0x4618f8
mov eax, dword [ebp + 0x14]
add eax, 0x41c
jmp 0x461cb0
push edi
push str.btag4
call esi
test eax, eax
jne 0x461911
mov eax, dword [ebp + 0x14]
add eax, 0x61c
jmp 0x461cb0
push edi
push str.btag5
call esi
test eax, eax
jne 0x46192a
mov eax, dword [ebp + 0x14]
add eax, 0x81c
jmp 0x461cb0
push edi
push str.region
call esi
test eax, eax
jne 0x461943
mov eax, dword [ebp + 0x14]
add eax, 0xf28
jmp 0x461cb0
push edi
push str.name
call esi
test eax, eax
jne 0x461962
mov eax, dword [ebp + 0x14]
add eax, 0x8a5c
push eax
push 0x46ce24
jmp 0x461cb6
push edi
push str.local_machinename
call esi
test eax, eax
jne 0x46198a
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x461a54
push edi
push str.local_username
call esi
test eax, eax
jne 0x4619b7
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esp + 0x10]
dec eax
jmp 0x461cc4
push edi
mov ebx, 0x46ce4c
push ebx
call esi
test eax, eax
jne 0x461a09
mov eax, dword [ebp + 0x14]
add eax, 0x8a5c
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.004013ae
pop ecx
push 0
push ebx
mov esi, eax
push esi
call fcn.00460004
add esp, 0xc
mov edi, eax
push edi
lea eax, [esp + 0x34]
push 0x46ce24
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
mov dword [esp + 0x14], eax
call fcn.00434a14
pop ecx
jmp 0x461a4d
push edi
mov ebx, 0x46c724
push ebx
call esi
test eax, eax
jne 0x461a5d
mov eax, dword [ebp + 0x14]
add eax, 0x8a5c
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.004013ae
pop ecx
mov esi, eax
push ebx
push esi
xor eax, eax
call fcn.0045fea5
push eax
lea eax, [esp + 0x3c]
push 0x46ce58
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [esp + 0x10], eax
push esi
call fcn.00434a14
pop ecx
mov eax, dword [esp + 0x10]
jmp 0x461cc4
push edi
mov ebx, str.userguid
push ebx
call esi
test eax, eax
je 0x461c7a
push edi
push 0x46ce68
call esi
test eax, eax
je 0x461c7a
push edi
push str.hddid
call esi
test eax, eax
je 0x461c1a
push edi
push 0x46ce94
call esi
test eax, eax
je 0x461c1a
push edi
push str.casinoid
call esi
test eax, eax
je 0x461c0c
push edi
push str.serverid
call esi
test eax, eax
je 0x461c0c
push edi
push str.pcmversion
call esi
test eax, eax
jne 0x461ad7
mov eax, dword [ebp + 0x14]
add eax, 0x8858
jmp 0x461957
push edi
push str.PCMGUID
call esi
test eax, eax
jne 0x461af0
mov eax, dword [ebp + 0x14]
add eax, 0x8758
jmp 0x461957
push edi
push str.RegistryPCMGUID
call esi
test eax, eax
jne 0x461b09
mov eax, dword [ebp + 0x14]
add eax, 0x87d8
jmp 0x461957
push edi
push str.EmbeddedPCMGUID
call esi
test eax, eax
jne 0x461b24
mov eax, dword [0x48ab6c]
add eax, 0xc1c
jmp 0x461cb0
push edi
push str.SerialNumber
call esi
test eax, eax
jne 0x461b3d
mov eax, dword [ebp + 0x14]
add eax, 0x88d8
jmp 0x461cb0
push edi
push str.bytesDownloaded
call esi
test eax, eax
jne 0x461b7d
push 0xffffffffffffffff
push dword [0x48ab60]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x461b72
mov esi, dword [0x48a524]
push dword [0x48ab60]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push 0x46ce58
jmp 0x461cb6
push edi
push str.percentDownloaded
call esi
test eax, eax
jne 0x461bab
push 0xffffffffffffffff
push dword [0x48a51c]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x461b72
mov esi, dword [0x48ab58]
push dword [0x48a51c]
jmp 0x461b6c
push edi
push str.PCMHardwareInfo
call esi
test eax, eax
jne 0x461bef
xor esi, esi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.00460077
test eax, eax
je 0x461bde
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x18]
call fcn.0045f0f4
add esp, 4
mov esi, eax
push dword [esp + 0x14]
call fcn.00434a14
pop ecx
mov eax, esi
jmp 0x461ce5
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 0x8a5c]
push ecx
add eax, 0x8b5c
call fcn.004013ae
pop ecx
push 0
push edi
jmp 0x4619db
mov eax, dword [ebp + 0x14]
push dword [eax + 0x8958]
jmp 0x461b73
mov byte [esp + 0x14], 0
xor eax, eax
lea edi, [esp + 0x15]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esi, [esp + 0x14]
stosb byte es:[edi], al
call fcn.00457275
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov byte [esp + 0x1c], 0
lea edi, [esp + 0x1d]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
lea ebx, [esp + 0x1c]
movzx eax, byte [esp + edi + 0x14]
push eax
push str._2.2X
push ebx
call esi
add esp, 0xc
inc edi
add ebx, 2
cmp edi, 8
jl 0x461c4d
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push 0x46ce24
push eax
call esi
jmp 0x461cc1
push SysReAllocString
mov ecx, str.SoftwareMicrosoftMultimedia
lea eax, [esp + 0x434]
call fcn.00456dfe
and dword [esp + 0x1844], 0
push ebx
mov ecx, 0x46c667
call fcn.00457221
jmp 0x461957
mov eax, dword [ebp + 0x14]
add eax, 0xf40
push eax
push 0x46c72c
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test eax, eax
je 0x461ce3
cmp byte [esp + 0x30], 0
je 0x461ce3
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x34]
call fcn.0045f0f4
add esp, 4
jmp 0x461ce5
xor eax, eax
mov ecx, dword [esp + 0x183c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10