Function at 0x49ad4c
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x26
push 0
push 0
dec ecx
jne 0x49ad54
push ecx
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x49b0f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49b114
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49b120
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor edx, edx
push ebp
push 0x49b0a6
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0040b180
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x110]
mov eax, 0x49b13c
call fcn.0040cab0
mov edx, dword [ebp - 0x110]
mov eax, dword [esi]
add eax, 0x14
call fcn.004049d8
lea edx, [ebp - 0x114]
mov eax, dword [0x4a7d18]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x114]
mov eax, dword [esi]
add eax, 0x20
call fcn.004049d8
mov eax, dword [esi]
mov byte [eax + 0x38], 1
mov eax, dword [esi]
mov byte [eax + 0x18], 0
mov eax, dword [esi]
mov byte [eax + 0x39], 0
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, dword [esi]
add eax, 0x1c
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00404bf4
mov eax, dword [esi]
cmp dword [eax + 0xc], 0
jne 0x49af79
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 0x10c]
mov edx, dword [ebp - 8]
call fcn.00407a34
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49b114
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49b158
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ebx, 1
jmp 0x49aeea
cmp ebx, 0x1e
jle 0x49ae9e
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49b174
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b0d2
push 0x49b198
lea edx, [ebp - 0x11c]
mov eax, ebx
call fcn.004092e4
push dword [ebp - 0x11c]
push 0x49b1b8
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.00404d20
mov edx, dword [ebp - 0x118]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0xa
mov eax, edi
call fcn.0049b27c
inc ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x49ae7b
lea eax, [edi + 0x3e8]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00404bf4
mov eax, dword [0x4a7b04]
mov eax, dword [eax + 0x44]
cmp eax, 1
jne 0x49af35
lea edx, [ebp - 0xc]
mov eax, dword [edi + 0x3e8]
call fcn.00408e24
jmp 0x49af5e
mov edx, dword [0x4a7b04]
cmp eax, 2
jne 0x49af50
lea edx, [ebp - 0xc]
mov eax, dword [edi + 0x3e8]
call fcn.00408e74
jmp 0x49af5e
lea eax, [ebp - 0xc]
mov edx, dword [edi + 0x3e8]
call fcn.00404a1c
mov eax, dword [esi]
add eax, 0xc
mov edx, dword [ebp - 0xc]
call fcn.004049d8
lea eax, [edi + 0x3e4]
mov edx, dword [ebp - 0xc]
call fcn.004049d8
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49b114
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49b1c8
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ecx, dword [edi + 0x3e8]
lea eax, [ebp - 0x120]
mov edx, 0x49b1e0
call fcn.00404cac
mov edx, dword [ebp - 0x120]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 0x124]
mov edx, 0x49b1fc
call fcn.00404cac
mov edx, dword [ebp - 0x124]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
lea eax, [ebp - 0x128]
mov edx, 0x49b210
call fcn.00404cac
mov edx, dword [ebp - 0x128]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
lea eax, [ebp - 0x12c]
mov edx, 0x49b234
call fcn.00404cac
mov edx, dword [ebp - 0x12c]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4a7d18]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x49b098
inc esi
xor ebx, ebx
mov eax, dword [0x4a7d18]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 8]
lea ecx, [ebp - 0x134]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x134]
lea eax, [ebp - 0x130]
mov edx, 0x49b244
call fcn.00404cac
mov edx, dword [ebp - 0x130]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec esi
jne 0x49b053
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b0d2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b0ff
lea eax, [ebp - 0x134]
mov edx, 0xa
call fcn.004049a8
lea eax, [ebp - 0xc]
call fcn.00404984
ret