Function at 0x407cc0
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x1a0
call fcn.004081b0
call fcn.00408160
test ax, ax
mov dword [esp + 4], eax
jge 0x407cf8
mov ecx, dword [esp + 0x1a4]
movsx eax, ax
mov dword [ecx + 0x94], eax
call fcn.00408390
xor ax, ax
add esp, 0x1a0
ret
push ebx
mov ebx, dword [esp + 0x1a8]
push esi
push edi
mov edx, dword [ebx + 4]
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, 0x32
lea edi, [esp + 0xe4]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0xe8]
push str._02d
push eax
mov dword [ebx + 0x94], 1
call fcn.004157b1
mov eax, dword [ebx + 4]
mov cx, word [esp + 0xf0]
add esp, 0xc
cmp eax, 7
mov word [esp + 0x14], cx
je 0x407d99
cmp eax, 9
je 0x407d99
cmp eax, 0xb
je 0x407d99
cmp eax, 0xc
je 0x407d99
cmp eax, 0xd
je 0x407d99
cmp eax, 0x15
je 0x407d99
cmp eax, 0x16
je 0x407d99
cmp eax, 0x4d
je 0x407d99
lea edx, [ebx + 8]
mov eax, dword [ebx + 8]
mov dword [esp + 0x16], eax
mov eax, dword [ebx + 0x15]
mov ecx, dword [edx + 4]
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], ecx
mov edx, dword [edx + 8]
mov dword [esp + 0x1e], edx
jmp 0x407dbb
mov ecx, dword [0x4ae788]
add ecx, 0x34b
mov edx, dword [ecx]
mov dword [esp + 0x16], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x1a], eax
mov cx, word [ecx + 8]
mov word [esp + 0x1e], cx
mov edi, 0x4207d4
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebx + 0x1a]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x26], edx
lea edx, [esp + 0x2a]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x32
lea edi, [esp + 0xe4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xe4]
push ecx
call fcn.004085b0
mov ecx, dword [esp + 0xf0]
mov eax, dword [esp + 0xe8]
mov edx, dword [esp + 0xec]
mov dword [esp + 0x3e], ecx
mov ecx, dword [ebx + 4]
add esp, 4
cmp ecx, 7
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], edx
jne 0x407e4d
mov edx, dword [0x4ae788]
add edx, 0x22003
mov dword [edx], eax
mov eax, dword [esp + 0x36]
mov dword [edx + 4], eax
mov ecx, dword [esp + 0x3a]
mov dword [edx + 8], ecx
mov edx, dword [0x4ae788]
lea edi, [esp + 0x94]
mov dword [esp + 0xc], 0x28
lea eax, [edx + 0x34b]
mov ecx, dword [edx + 0x34b]
mov dword [esp + 0x3e], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x42], ecx
mov ecx, 0x14
mov ax, word [eax + 8]
mov word [esp + 0x46], ax
xor eax, eax
rep stosd dword es:[edi], eax
cmp dword [edx + 0x3dc60], 1
jne 0x407ea9
lea ecx, [esp + 0xc]
lea edx, [esp + 0x94]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x407ebc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x94]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov al, byte [esp + 0x94]
test al, al
jne 0x407efe
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x94]
lea edx, [esp + 0x94]
rep stosd dword es:[edi], eax
mov edi, str.Standalone
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xa
lea esi, [esp + 0x94]
lea edi, [esp + 0x66]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.00408a10
movsx edx, si
push edx
call fcn.00408850
add esp, 0xc
pop edi
pop esi
pop ebx
call fcn.00408390
xor ax, ax
add esp, 0x1a0
ret