Function at 0x41f4b0
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x2cc
push ebx
push ebp
push esi
push edi
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x28]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2e4]
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
mov ecx, dword [eax]
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x2c], edx
mov ax, word [eax + 8]
mov word [esp + 0x20], cx
mov word [esp + 0x30], ax
mov byte [esp + 0x22], cl
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x10], edx
movsx eax, dx
lea edi, [esp + 0x18]
xor ebp, ebp
lea ecx, [eax + eax*4]
lea eax, [eax + ecx*2 + 0xad65a8]
mov ecx, 5
mov esi, eax
repe cmpsw word [esi], word es:[edi]
je 0x41f566
cmp byte [eax], 0
je 0x41f566
inc edx
cmp dx, 0xa
jl 0x41f528
pop edi
pop esi
pop ebp
mov dword [esp + 4], edx
mov ax, 1
pop ebx
add esp, 0x2cc
ret
cmp dx, 0xa
mov dword [esp + 0x10], edx
jl 0x41f57f
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0x2cc
ret
mov edx, dword [0x968af8]
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x98]
mov dword [esp + 0x14], 0x28
rep stosd dword es:[edi], eax
cmp dword [edx + 0x3dc60], 1
jne 0x41f5bb
lea eax, [esp + 0x14]
lea ecx, [esp + 0x98]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x41f5ce
lea edx, [esp + 0x14]
lea eax, [esp + 0x98]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov al, byte [esp + 0x98]
test al, al
jne 0x41f610
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x98]
lea edx, [esp + 0x98]
rep stosd dword es:[edi], eax
mov edi, str.Standalone
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x28]
mov dl, byte [esp + 0x98]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x98]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov al, byte [esp + 0x99]
dec ecx
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], al
mov cl, byte [esp + ecx + 0x97]
mov byte [esp + 0x28], cl
mov cl, byte [esp + 0x9a]
mov byte [esp + 0x2b], cl
mov eax, dword [esp + 0x28]
push eax
mov dword [0xad4130], eax
call dword [sym.imp.MSVCRT.dll_srand]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 4
mov edx, dword [0x968a9c]
mov ecx, 0x14
add edx, 0x33
xor eax, eax
mov edi, 0xad3f28
push edx
push str._sTUCLOCKLOCK
push 0xad3f28
rep stosd dword es:[edi], eax
call ebp
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, 0xad3f28
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
mov ecx, edx
push 2
push eax
and ecx, 3
push eax
push 0xc0000000
push 0xad3f28
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x41f7ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp word [esp + 0x2e0], 0
mov dword [0xad3f24], eax
je 0x41f841
cmp ebx, 5
je 0x41f71f
cmp ebx, 0xa
je 0x41f71f
cmp ebx, 0xf
je 0x41f71f
cmp ebx, 0x14
je 0x41f71f
cmp ebx, 0x19
je 0x41f71f
cmp ebx, 0x1e
jl 0x41f769
mov ecx, 0x7d
xor eax, eax
lea edi, [esp + 0xe8]
push 0xad3f28
rep stosd dword es:[edi], eax
lea eax, [esp + 0xec]
push 0x42e034
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0xe8]
push 0x40015
push 0x42d960
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x41f841
inc ebx
cmp ebx, 0x12c
jg 0x41f841
call dword [sym.imp.MSVCRT.dll_rand]
mov edx, eax
mov ecx, 0x14
push edx
xor eax, eax
lea edi, [esp + 0x2c]
lea edx, [esp + 0x2c]
push 0x426234
push edx
rep stosd dword es:[edi], eax
call ebp
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x84]
lea edx, [esp + 0x84]
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x35]
push edx
stosw word es:[edi], ax
mov al, byte [esp + 0x38]
mov byte [esp + 0x89], cl
mov byte [esp + 0x88], al
mov byte [esp + 0x8a], 0x30
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0x10
mov dword [0xad3fcc], eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41f671
movsx ecx, word [esp + 0x10]
lea edi, [esp + 0x18]
mov dword [ecx*4 + 0xad3e84], eax
lea eax, [ecx + ecx*4]
lea edx, [ecx + eax*2 + 0xad65a8]
xor ecx, ecx
mov eax, edx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
mov byte [eax + 0xa], cl
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2cc
ret
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2cc
ret