Function at 0x4a8a90
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a91a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x298
mov eax, dword [0x5b706c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x224], edi
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5c1bf4]
cmp eax, dword [ecx + 4]
jle 0x4a8b3f
push 0x5c1bf4
call fcn.0051eddf
add esp, 4
cmp dword [0x5c1bf4], 0xffffffff
jne 0x4a8b3f
push 0x55ff50
mov dword [0x5c1c28], 0
mov dword [0x5c1c2c], 0xf
mov byte [0x5c1c18], 0
call fcn.0051f13c
add esp, 4
push 0x5c1bf4
call fcn.0051ed95
add esp, 4
cmp dword [0x5c1c28], 0
je 0x4a8b59
push 0x5c1c18
mov ecx, edi
call fcn.00409180
jmp 0x4a91cc
lea ecx, [ebp - 0x258]
call fcn.004a8770
push 0x208
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00525340
add esp, 0xc
mov dword [ebp - 0x224], 0x104
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4a8cfe
xor eax, eax
mov dword [ebp - 0x278], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a8bd0
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x288]
call fcn.00403df0
lea edx, [ebp - 0x288]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x240]
call fcn.004ad250
push 2
push 0x594a64
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00415960
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2a0], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
movq qword [ebp - 0x290], xmm0
mov byte [eax], 0
lea eax, [ebp - 0x2a0]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x258]
call fcn.0040c900
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x28c]
cmp edx, 0x10
jb 0x4a8c96
mov ecx, dword [ebp - 0x2a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8c8c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a91ec
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x22c]
cmp edx, 0x10
jb 0x4a8cd4
mov ecx, dword [ebp - 0x240]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8cca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a91f1
push edx
push ecx
call fcn.0051ec14
add esp, 8
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0xf
mov byte [ebp - 0x240], 0
mov byte [ebp - 4], 0
call fcn.00403d90
push 0x208
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], 0x104
push 0
push eax
call fcn.00525340
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x4a8e8e
xor eax, eax
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a8d60
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x240]
call fcn.00403df0
lea edx, [ebp - 0x240]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x288]
call fcn.004ad250
push 2
push 0x594a68
push ecx
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00415960
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2a0], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
movq qword [ebp - 0x290], xmm0
mov byte [eax], 0
lea eax, [ebp - 0x2a0]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x258]
call fcn.0040c900
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x28c]
cmp edx, 0x10
jb 0x4a8e26
mov ecx, dword [ebp - 0x2a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8e1c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a91f6
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x274]
cmp edx, 0x10
jb 0x4a8e64
mov ecx, dword [ebp - 0x288]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8e5a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a91fb
push edx
push ecx
call fcn.0051ec14
add esp, 8
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0xf
mov byte [ebp - 0x288], 0
mov byte [ebp - 4], 0
call fcn.00403d90
lea ecx, [ebp - 0x240]
call fcn.004a80c0
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x288]
call fcn.004ad250
push 2
push 0x594a5c
push ecx
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00415960
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2a0], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
movq qword [ebp - 0x290], xmm0
mov byte [eax], 0
lea eax, [ebp - 0x2a0]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x258]
call fcn.0040c900
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x28c]
cmp edx, 0x10
jb 0x4a8f39
mov ecx, dword [ebp - 0x2a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8f2f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9200
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x274]
cmp edx, 0x10
jb 0x4a8f77
mov ecx, dword [ebp - 0x288]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a8f6d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9205
push edx
push ecx
call fcn.0051ec14
add esp, 8
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0xf
mov byte [ebp - 0x288], 0
mov byte [ebp - 4], 0
call fcn.00403d90
call fcn.004a7f70
lea ecx, [ebp - 0x258]
test al, al
je 0x4a8fb7
push 0x594a60
jmp 0x4a8fbc
push 0x594ac0
call fcn.0040c890
push 0xb
xor eax, eax
mov dword [ebp - 0x278], 0
push 0x594ac4
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
call fcn.00403df0
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
xor eax, eax
push 0x24
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.HKLMSoftwareMicrosoftCryptography
mov word [ecx], ax
call fcn.00403df0
lea edx, [ebp - 0x288]
lea ecx, [ebp - 0x270]
call fcn.004b1650
add esp, 0x18
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0xc
call fcn.00403d90
cmp dword [ebp - 0x260], 0
je 0x4a9126
lea edx, [ebp - 0x270]
lea ecx, [ebp - 0x288]
call fcn.004ad250
push 2
push 0x594abc
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.00415960
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2a0], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
movq qword [ebp - 0x290], xmm0
mov byte [eax], 0
lea eax, [ebp - 0x2a0]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x258]
call fcn.0040c900
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x28c]
cmp edx, 0x10
jb 0x4a90e8
mov ecx, dword [ebp - 0x2a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a90de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a920a
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x274]
cmp edx, 0x10
jb 0x4a9126
mov ecx, dword [ebp - 0x288]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a911c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a920f
push edx
push ecx
call fcn.0051ec14
add esp, 8
cmp dword [ebp - 0x244], 0x10
lea eax, [ebp - 0x238]
push 0
push dword [ebp - 0x248]
lea ecx, [ebp - 0x258]
cmovae ecx, dword [ebp - 0x258]
push eax
call fcn.004ae790
add esp, 0xc
xor esi, esi
movups xmm0, xmmword [eax]
mov eax, 0x5c1c18
movups xmmword [ebp - 0x238], xmm0
mov dl, byte [ebp + esi - 0x238]
lea ecx, [ebp - 0x2a4]
push eax
call fcn.004ac980
inc esi
add esp, 4
mov eax, dword [eax]
cmp esi, 0x10
jne 0x4a9162
push 0x5c1c18
mov ecx, edi
call fcn.00409180
lea ecx, [ebp - 0x270]
call fcn.00403d90
mov edx, dword [ebp - 0x244]
cmp edx, esi
jb 0x4a91cc
mov ecx, dword [ebp - 0x258]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a91c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9214
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051e9d8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
int3