Function at 0x417a90
Capabilities:
Get hostname
Get session user name
Query or enumerate registry value

Disassembly:
sub esp, 0x590
xor eax, eax
push ebx
push ebp
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], eax
push esi
lea eax, [esp + 0x11c]
push edi
push eax
call fcn.00461f82
mov ebx, dword [esp + 0x5a8]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 4
lea ecx, [esp + 0x120]
lea esi, [ebx + 0x6dc]
push ecx
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x579d7c
push esi
call edi
lea edx, [esp + 0x120]
push edx
call fcn.00461f09
add esp, 4
lea eax, [esp + 0x120]
push eax
push esi
call edi
push ebx
call fcn.004146c0
add esp, 4
lea ecx, [esp + 0x10]
lea esi, [ebx + 0xc4]
mov edi, 0x104
push ecx
push esi
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [esp + 0x10], edi
lea edx, [esp + 0x10]
lea edi, [ebx + 0x2cc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push edi
mov edi, dword [esp + 0x5ac]
lea eax, [edi + 0x5b8]
push eax
call ebp
add edi, 0x6bc
push esi
push edi
call ebp
lea ecx, [esp + 0x18]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
jne 0x417d83
push 0x5908e4
lea edx, [esp + 0x1a4]
push 0x57c890
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x24]
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1a0]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x417ca0
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0
mov edi, 0x104
push 0x5908d8
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x417beb
lea eax, [esp + 0x1c]
lea ecx, [ebx + 0x5d8]
push eax
push ecx
call ebp
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push 0
push 0x5908c8
push ecx
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x417c1b
lea edx, [esp + 0x1c]
lea eax, [ebx + 0x3d0]
push edx
push eax
call ebp
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push 0
push 0x5908b0
push eax
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x417c4b
lea ecx, [esp + 0x1c]
lea edx, [ebx + 0x4d4]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x14]
test eax, eax
je 0x417c62
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
push 0x590880
lea eax, [esp + 0x1a4]
push 0x57c890
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x24]
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1a0]
push ecx
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417cbe
mov eax, dword [esp + 0x18]
test eax, eax
je 0x417d83
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x590
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push 0
push 0x5908d8
push eax
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x417cee
lea ecx, [esp + 0x1c]
lea edx, [ebx + 0x5d8]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0
push 0x5908c8
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x417d1e
lea eax, [esp + 0x1c]
lea ecx, [ebx + 0x3d0]
push eax
push ecx
call ebp
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
lea eax, [esp + 0x1c]
push edx
xor edi, edi
push eax
push edi
push edi
push 0x5908b0
push ecx
call esi
test eax, eax
jne 0x417d4e
lea edx, [esp + 0x1c]
lea eax, [ebx + 0x4d4]
push edx
push eax
call ebp
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x417d61
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x417d74
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], edi
add ebx, 0xefc
push ebx
call fcn.004381e0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x590
ret