Function at 0x404d20
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x1a0
call fcn.00405250
call fcn.00405200
test ax, ax
mov dword [esp + 4], eax
jge 0x404d58
mov ecx, dword [esp + 0x1a4]
movsx eax, ax
mov dword [ecx + 0x94], eax
call fcn.00405430
xor ax, ax
add esp, 0x1a0
ret
push ebx
mov ebx, dword [esp + 0x1a8]
push esi
push edi
mov edx, dword [ebx + 4]
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, 0x32
lea edi, [esp + 0xe4]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0xe8]
push 0x413338
push eax
mov dword [ebx + 0x94], 1
call fcn.00409684
mov eax, dword [ebx + 4]
mov cx, word [esp + 0xf0]
add esp, 0xc
cmp eax, 7
mov word [esp + 0x14], cx
je 0x404dfe
cmp eax, 9
je 0x404dfe
cmp eax, 0xb
je 0x404dfe
cmp eax, 0xc
je 0x404dfe
cmp eax, 0xd
je 0x404dfe
cmp eax, 0x15
je 0x404dfe
cmp eax, 0x16
je 0x404dfe
cmp eax, 0x4d
je 0x404dfe
cmp eax, 0x5b
je 0x404dfe
lea edx, [ebx + 8]
mov eax, dword [ebx + 8]
mov dword [esp + 0x16], eax
mov eax, dword [ebx + 0x15]
mov ecx, dword [edx + 4]
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], ecx
mov edx, dword [edx + 8]
mov dword [esp + 0x1e], edx
jmp 0x404e20
mov ecx, dword [0x4542e8]
add ecx, 0x34b
mov edx, dword [ecx]
mov dword [esp + 0x16], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x1a], eax
mov cx, word [ecx + 8]
mov word [esp + 0x1e], cx
mov edi, 0x41383c
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebx + 0x1a]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x26], edx
lea edx, [esp + 0x2a]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x32
lea edi, [esp + 0xe4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xe4]
push ecx
call fcn.00405650
mov ecx, dword [esp + 0xf0]
mov eax, dword [esp + 0xe8]
mov edx, dword [esp + 0xec]
mov dword [esp + 0x3e], ecx
mov ecx, dword [ebx + 4]
add esp, 4
cmp ecx, 7
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], edx
jne 0x404ebf
mov edx, dword [0x4542e8]
add edx, 0x22003
mov dword [edx], eax
mov eax, dword [esp + 0x36]
mov dword [edx + 4], eax
mov ecx, dword [esp + 0x3a]
mov dword [edx + 8], ecx
mov dl, byte [ebx + 0x8d]
mov byte [esp + 0x8e], dl
mov edx, dword [0x4542e8]
lea edi, [esp + 0x94]
mov dword [esp + 0xc], 0x28
lea eax, [edx + 0x34b]
mov ecx, dword [edx + 0x34b]
mov dword [esp + 0x3e], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x42], ecx
mov ecx, 0x14
mov ax, word [eax + 8]
mov word [esp + 0x46], ax
xor eax, eax
rep stosd dword es:[edi], eax
cmp dword [edx + 0x3dc60], 1
jne 0x404f1b
lea ecx, [esp + 0xc]
lea edx, [esp + 0x94]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x404f2e
lea eax, [esp + 0xc]
lea ecx, [esp + 0x94]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov al, byte [esp + 0x94]
test al, al
jne 0x404f70
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x94]
lea edx, [esp + 0x94]
rep stosd dword es:[edi], eax
mov edi, str.Standalone
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xa
lea esi, [esp + 0x94]
lea edi, [esp + 0x66]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.00405ab0
movsx edx, si
push edx
call fcn.004058f0
add esp, 0xc
pop edi
pop esi
pop ebx
call fcn.00405430
xor ax, ax
add esp, 0x1a0
ret