Function at 0x4454d6
Capabilities:
Get hostname
Get session user name

Disassembly:
mov eax, 0x5cfa42
call fcn.005a39e4
sub esp, 0x48
and byte [ebp - 0xd], 0
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx + 0x21c]
mov dword [ebp - 0x24], ebx
call fcn.005a6d39
lea eax, [ebx + 0x20]
test eax, eax
pop ecx
mov dword [ebp - 0x1c], eax
je 0x445525
push 0x6006dc
lea ecx, [eax + 0x5c]
call fcn.00555fcb
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x445525
lea edi, [eax + 0x64]
mov esi, 0x6003a0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x624c00]
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
cmp byte [0x645370], 0
mov esi, 0x5ff7e0
jne 0x445572
lea eax, [ebp - 0x14]
push eax
mov edi, 0x645370
push edi
mov dword [ebp - 0x14], 0x100
call dword [sym.imp.advapi32.dll_GetUserNameA]
cmp dword [ebp - 0x14], 0
ja 0x445567
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.kernel32.dll_GetComputerNameA]
cmp byte [0x645370], 0
je 0x44557a
jmp 0x445577
mov edi, 0x645370
push edi
jmp 0x445598
mov ecx, dword [0x63cef0]
test ecx, ecx
mov eax, esi
je 0x445590
push 0x6006d0
call fcn.004e0444
push eax
call fcn.005a763f
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.005bcec6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
call fcn.00442a89
mov eax, esi
test eax, eax
je 0x4455bd
push esi
lea ecx, [ebx + 0x98]
call fcn.005bcec6
push dword [ebx + 0x21c]
lea ecx, [ebp - 0x14]
call fcn.005bcdab
push dword [ebx + 0x98]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005bd119
mov ecx, dword [ebp - 0x14]
call fcn.0053308d
test al, al
jne 0x4455f2
push dword [ebp - 0x14]
call fcn.005a6d39
pop ecx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.005bcd3d
push dword [ebp + 8]
lea esi, [ebx + 0x20]
push 0
mov ecx, esi
call fcn.00444599
cmp byte [ebp + 8], 0
mov byte [ebp - 0xe], al
jne 0x44561d
mov ecx, esi
call fcn.0044308d
cmp byte [ebp - 0xe], 0
lea esi, [ebx + 0x84]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x445652
push 4
pop ecx
mov edi, 0x6003a0
lea esi, [ebp - 0x38]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x445652
push 4
pop ecx
mov edi, 0x62d3b8
lea esi, [ebp - 0x38]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x445685
push dword [ebx + 0x30]
lea ecx, [ebp - 0x14]
call fcn.005bcdab
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00442a89
push dword [ebp + 8]
lea ecx, [ebx + 0x20]
push 0
call fcn.00443c20
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.005bcd3d
lea eax, [ebx + 0x20]
push eax
mov ecx, ebx
call fcn.004458da
lea ecx, [ebp - 0x54]
call fcn.0059b70a
push dword [ebx + 0x21c]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005bcdab
push 0x600294
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.005bd119
push 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x54]
call fcn.0059b7cd
test eax, eax
je 0x4457a2
lea ecx, [ebp - 0x54]
call fcn.0059b9ed
mov edi, eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x54]
call fcn.0059bbe5
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 5
call fcn.0059b9b4
test eax, eax
jne 0x44578e
push 0x10
lea ecx, [ebp - 0x54]
call fcn.0059b8ad
test eax, eax
je 0x44578e
push 2
lea ecx, [ebp - 0x54]
call fcn.0059b8ad
test eax, eax
jne 0x44578e
push 0x1fc
call fcn.005bca7e
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 6
je 0x44573b
mov ecx, eax
call fcn.00442d6c
mov esi, eax
jmp 0x44573d
xor esi, esi
cmp dword [ebp - 0x14], 0
mov byte [ebp - 4], 5
je 0x445752
push dword [ebp - 0x14]
lea ecx, [esi + 0x78]
call fcn.005bcec6
push dword [ebp + 8]
mov ecx, esi
push 0
call fcn.00444599
test al, al
je 0x44577c
cmp byte [ebp + 8], 0
jne 0x44576f
mov ecx, esi
call fcn.0044308d
push esi
mov ecx, ebx
call fcn.004458da
mov byte [ebp - 0xd], al
jmp 0x44578e
test esi, esi
je 0x44578e
mov ecx, esi
call fcn.004430cb
push esi
call fcn.005bcaa7
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.005bcd3d
test edi, edi
jne 0x4456d0
cmp byte [ebp + 8], 0
jne 0x4458a2
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4457be
lea ecx, [ebx + 0x20]
cmp eax, ecx
jne 0x445897
cmp byte [0x6489c0], 0
je 0x4457ff
cmp dword [0x62d19c], 0
jbe 0x4457ff
mov eax, dword [0x62d198]
mov edi, dword [eax]
mov dword [ebp + 8], eax
mov esi, dword [edi + 8]
push dword [esi + 0x78]
push 0x6489c0
call fcn.005a5310
test eax, eax
pop ecx
pop ecx
je 0x4457f9
mov edi, dword [edi]
cmp edi, dword [ebp + 8]
je 0x4457ff
jmp 0x4457da
push esi
jmp 0x44589b
push 4
xor eax, eax
mov eax, dword [0x62d198]
pop ecx
mov edi, 0x62d3b8
mov esi, 0x6490ec
repe cmpsd dword [esi], dword es:[edi]
je 0x445850
cmp dword [0x62d19c], 0
jbe 0x445850
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [ecx + 8]
push 4
pop ecx
lea edi, [edx + 0x64]
mov esi, 0x6490ec
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x445847
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
cmp ecx, eax
mov dword [ebp + 8], ecx
je 0x44584d
jmp 0x445825
mov ecx, dword [ebp - 0x24]
push edx
jmp 0x44589d
mov ebx, dword [ebp - 0x24]
mov ecx, 0x645370
test ecx, ecx
je 0x445897
cmp byte [0x645370], 0
je 0x445897
cmp dword [0x62d19c], 0
jbe 0x445897
mov esi, dword [eax]
mov dword [ebp + 8], eax
mov edi, dword [esi + 8]
mov eax, dword [edi + 0x78]
test eax, eax
je 0x44588b
push eax
push 0x645370
call fcn.005a5310
test eax, eax
pop ecx
pop ecx
je 0x445894
mov esi, dword [esi]
cmp esi, dword [ebp + 8]
je 0x445897
jmp 0x445870
push edi
jmp 0x44589b
lea eax, [ebx + 0x20]
push eax
mov ecx, ebx
call fcn.00445cb2
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005bcd3d
and byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0059b747
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.005bcd3d
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4