Function at 0x461236
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4664d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x182c
call fcn.00438700
and dword [esp + 4], 0
push ebx
push esi
push edi
push 0x3ff
lea eax, [esp + 0x35]
push 0
push eax
mov byte [esp + 0x3c], 0
call fcn.004384e0
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 0xc
push edi
push 0x46cdc0
call esi
test eax, eax
je 0x461686
push edi
push str.lang
call esi
test eax, eax
je 0x461686
push edi
push str.btag1
call esi
test eax, eax
jne 0x4612bd
mov eax, dword [ebp + 0x14]
add eax, 0x1c
jmp 0x46168e
push edi
push str.btag2
call esi
test eax, eax
jne 0x4612d6
mov eax, dword [ebp + 0x14]
add eax, 0x21c
jmp 0x46168e
push edi
push str.btag3
call esi
test eax, eax
jne 0x4612ef
mov eax, dword [ebp + 0x14]
add eax, 0x41c
jmp 0x46168e
push edi
push str.btag4
call esi
test eax, eax
jne 0x461308
mov eax, dword [ebp + 0x14]
add eax, 0x61c
jmp 0x46168e
push edi
push str.btag5
call esi
test eax, eax
jne 0x461321
mov eax, dword [ebp + 0x14]
add eax, 0x81c
jmp 0x46168e
push edi
push str.region
call esi
test eax, eax
jne 0x46133a
mov eax, dword [ebp + 0x14]
add eax, 0xf28
jmp 0x46168e
push edi
push str.name
call esi
test eax, eax
jne 0x461359
mov eax, dword [ebp + 0x14]
add eax, 0x89dc
push eax
push 0x46cdfc
jmp 0x461694
push edi
push str.local_machinename
call esi
test eax, eax
jne 0x461381
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x46144b
push edi
push str.local_username
call esi
test eax, eax
jne 0x4613ae
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esp + 0x10]
dec eax
jmp 0x4616a2
push edi
mov ebx, 0x46ce24
push ebx
call esi
test eax, eax
jne 0x461400
mov eax, dword [ebp + 0x14]
add eax, 0x89dc
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.004013ae
pop ecx
push 0
push ebx
mov esi, eax
push esi
call fcn.0045fa50
add esp, 0xc
mov edi, eax
push edi
lea eax, [esp + 0x34]
push 0x46cdfc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
mov dword [esp + 0x14], eax
call fcn.00434554
pop ecx
jmp 0x461444
push edi
mov ebx, 0x46c6d4
push ebx
call esi
test eax, eax
jne 0x461454
mov eax, dword [ebp + 0x14]
add eax, 0x89dc
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.004013ae
pop ecx
mov esi, eax
push ebx
push esi
xor eax, eax
call fcn.0045f8f1
push eax
lea eax, [esp + 0x3c]
push 0x46ce30
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [esp + 0x10], eax
push esi
call fcn.00434554
pop ecx
mov eax, dword [esp + 0x10]
jmp 0x4616a2
push edi
mov ebx, str.userguid
push ebx
call esi
test eax, eax
je 0x461658
push edi
push 0x46ce40
call esi
test eax, eax
je 0x461658
push edi
push str.hddid
call esi
test eax, eax
je 0x4615f8
push edi
push 0x46ce6c
call esi
test eax, eax
je 0x4615f8
push edi
push str.casinoid
call esi
test eax, eax
je 0x4615ea
push edi
push str.serverid
call esi
test eax, eax
je 0x4615ea
push edi
push str.pcmversion
call esi
test eax, eax
jne 0x4614ce
mov eax, dword [ebp + 0x14]
add eax, 0x8858
jmp 0x46134e
push edi
push str.PCMGUID
call esi
test eax, eax
jne 0x4614e7
mov eax, dword [ebp + 0x14]
add eax, 0x8758
jmp 0x46134e
push edi
push str.RegistryPCMGUID
call esi
test eax, eax
jne 0x461500
mov eax, dword [ebp + 0x14]
add eax, 0x87d8
jmp 0x46134e
push edi
push str.EmbeddedPCMGUID
call esi
test eax, eax
jne 0x46151b
mov eax, dword [0x48a86c]
add eax, 0xc1c
jmp 0x46168e
push edi
push str.bytesDownloaded
call esi
test eax, eax
jne 0x46155b
push 0xffffffffffffffff
push dword [0x48a860]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x461550
mov esi, dword [0x48a224]
push dword [0x48a860]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push 0x46ce30
jmp 0x461694
push edi
push str.percentDownloaded
call esi
test eax, eax
jne 0x461589
push 0xffffffffffffffff
push dword [0x48a21c]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x461550
mov esi, dword [0x48a858]
push dword [0x48a21c]
jmp 0x46154a
push edi
push str.PCMHardwareInfo
call esi
test eax, eax
jne 0x4615cd
xor esi, esi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.0045fac3
test eax, eax
je 0x4615bc
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x18]
call fcn.0045eb40
add esp, 4
mov esi, eax
push dword [esp + 0x14]
call fcn.00434554
pop ecx
mov eax, esi
jmp 0x4616c3
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 0x89dc]
push ecx
add eax, 0x8adc
call fcn.004013ae
pop ecx
push 0
push edi
jmp 0x4613d2
mov eax, dword [ebp + 0x14]
push dword [eax + 0x88d8]
jmp 0x461551
mov byte [esp + 0x14], 0
xor eax, eax
lea edi, [esp + 0x15]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esi, [esp + 0x14]
stosb byte es:[edi], al
call fcn.00456ee5
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov byte [esp + 0x1c], 0
lea edi, [esp + 0x1d]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
lea ebx, [esp + 0x1c]
movzx eax, byte [esp + edi + 0x14]
push eax
push str._2.2X
push ebx
call esi
add esp, 0xc
inc edi
add ebx, 2
cmp edi, 8
jl 0x46162b
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push 0x46cdfc
push eax
call esi
jmp 0x46169f
push SysReAllocString
mov ecx, str.SoftwareMicrosoftMultimedia
lea eax, [esp + 0x434]
call fcn.00456a6e
and dword [esp + 0x1844], 0
push ebx
mov ecx, 0x46c62f
call fcn.00456e91
jmp 0x46134e
mov eax, dword [ebp + 0x14]
add eax, 0xf40
push eax
push 0x46c6dc
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test eax, eax
je 0x4616c1
cmp byte [esp + 0x30], 0
je 0x4616c1
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x34]
call fcn.0045eb40
add esp, 4
jmp 0x4616c3
xor eax, eax
mov ecx, dword [esp + 0x183c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10