Function at 0x4128a0
Capabilities:
Get hostname
Get session user name
Query or enumerate registry value

Disassembly:
sub esp, 0x590
xor eax, eax
push ebx
push ebp
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], eax
push esi
lea eax, [esp + 0x11c]
push edi
push eax
call fcn.00448107
mov ebx, dword [esp + 0x5a8]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 4
lea ecx, [esp + 0x120]
lea esi, [ebx + 0x6dc]
push ecx
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x498700
push esi
call edi
lea edx, [esp + 0x120]
push edx
call fcn.0044808e
add esp, 4
lea eax, [esp + 0x120]
push eax
push esi
call edi
push ebx
call fcn.00410840
add esp, 4
lea ecx, [esp + 0x10]
lea esi, [ebx + 0xc4]
mov edi, 0x104
push ecx
push esi
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [esp + 0x10], edi
lea edx, [esp + 0x10]
lea edi, [ebx + 0x2cc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push edi
mov edi, dword [esp + 0x5ac]
lea eax, [edi + 0x8c8]
push eax
call ebp
add edi, 0x9cc
push esi
push edi
call ebp
lea ecx, [esp + 0x18]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
jne 0x412b93
push 0x4a9180
lea edx, [esp + 0x1a4]
push 0x49b15c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x24]
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1a0]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412ab0
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0
mov edi, 0x104
push 0x4a9174
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x4129fb
lea eax, [esp + 0x1c]
lea ecx, [ebx + 0x5d8]
push eax
push ecx
call ebp
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push 0
push 0x4a9164
push ecx
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x412a2b
lea edx, [esp + 0x1c]
lea eax, [ebx + 0x3d0]
push edx
push eax
call ebp
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push 0
push 0x4a914c
push eax
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x412a5b
lea ecx, [esp + 0x1c]
lea edx, [ebx + 0x4d4]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x14]
test eax, eax
je 0x412a72
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
push 0x4a911c
lea eax, [esp + 0x1a4]
push 0x49b15c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x24]
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1a0]
push ecx
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x412ace
mov eax, dword [esp + 0x18]
test eax, eax
je 0x412b93
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x590
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push 0
push 0x4a9174
push eax
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x412afe
lea ecx, [esp + 0x1c]
lea edx, [ebx + 0x5d8]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0
push 0x4a9164
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x412b2e
lea eax, [esp + 0x1c]
lea ecx, [ebx + 0x3d0]
push eax
push ecx
call ebp
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
lea eax, [esp + 0x1c]
push edx
xor edi, edi
push eax
push edi
push edi
push 0x4a914c
push ecx
call esi
test eax, eax
jne 0x412b5e
lea edx, [esp + 0x1c]
lea eax, [ebx + 0x4d4]
push edx
push eax
call ebp
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x412b71
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x412b84
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], edi
add ebx, 0xefc
push ebx
call fcn.004390b0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x590
ret