Function at 0x404031
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45abc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x182c
call fcn.00454b50
and dword [esp + 4], 0
push ebx
push esi
push edi
push 0x3ff
lea eax, [esp + 0x35]
push 0
push eax
mov byte [esp + 0x3c], 0
call fcn.0044f6b0
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 0xc
push edi
push 0x45f23c
call esi
test eax, eax
je 0x40447f
push edi
push str.lang
call esi
test eax, eax
je 0x40447f
push edi
push str.btag1
call esi
test eax, eax
jne 0x4040b8
mov eax, dword [ebp + 0x14]
add eax, 0x1c
jmp 0x404487
push edi
push str.btag2
call esi
test eax, eax
jne 0x4040d1
mov eax, dword [ebp + 0x14]
add eax, 0x21c
jmp 0x404487
push edi
push str.btag3
call esi
test eax, eax
jne 0x4040ea
mov eax, dword [ebp + 0x14]
add eax, 0x41c
jmp 0x404487
push edi
push str.btag4
call esi
test eax, eax
jne 0x404103
mov eax, dword [ebp + 0x14]
add eax, 0x61c
jmp 0x404487
push edi
push str.btag5
call esi
test eax, eax
jne 0x40411c
mov eax, dword [ebp + 0x14]
add eax, 0x81c
jmp 0x404487
push edi
push str.rafid
call esi
test eax, eax
jne 0x404135
mov eax, dword [ebp + 0x14]
add eax, 0xa1c
jmp 0x404487
push edi
push str.name
call esi
test eax, eax
jne 0x404154
mov eax, dword [ebp + 0x14]
add eax, 0x89c4
push eax
push 0x45f278
jmp 0x40448d
push edi
push str.local_machinename
call esi
test eax, eax
jne 0x40417c
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x404246
push edi
push str.local_username
call esi
test eax, eax
jne 0x4041a9
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esp + 0x10]
dec eax
jmp 0x40449b
push edi
mov ebx, 0x45f2a0
push ebx
call esi
test eax, eax
jne 0x4041fb
mov eax, dword [ebp + 0x14]
add eax, 0x89c4
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.00401cf4
pop ecx
push 0
push ebx
mov esi, eax
push esi
call fcn.0040275d
add esp, 0xc
mov edi, eax
push edi
lea eax, [esp + 0x34]
push 0x45f278
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
mov dword [esp + 0x14], eax
call fcn.00445f74
pop ecx
jmp 0x40423f
push edi
mov ebx, 0x45ec6c
push ebx
call esi
test eax, eax
jne 0x40424f
mov eax, dword [ebp + 0x14]
add eax, 0x89c4
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.00401cf4
pop ecx
mov esi, eax
push ebx
push esi
xor eax, eax
call fcn.004028f1
push eax
lea eax, [esp + 0x3c]
push 0x45f2ac
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [esp + 0x10], eax
push esi
call fcn.00445f74
pop ecx
mov eax, dword [esp + 0x10]
jmp 0x40449b
push edi
mov ebx, str.userguid
push ebx
call esi
test eax, eax
je 0x404451
push edi
push 0x45f2bc
call esi
test eax, eax
je 0x404451
push edi
push str.hddid
call esi
test eax, eax
je 0x4043f2
push edi
push 0x45f2e8
call esi
test eax, eax
je 0x4043f2
push edi
push str.casinoid
call esi
test eax, eax
je 0x4043e4
push edi
push str.serverid
call esi
test eax, eax
je 0x4043e4
push edi
push str.pcmversion
call esi
test eax, eax
jne 0x4042c9
mov eax, dword [ebp + 0x14]
add eax, 0x8840
jmp 0x404149
push edi
push str.PCMGUID
call esi
test eax, eax
jne 0x4042e2
mov eax, dword [ebp + 0x14]
add eax, 0x8740
jmp 0x404149
push edi
push str.RegistryPCMGUID
call esi
test eax, eax
jne 0x4042fb
mov eax, dword [ebp + 0x14]
add eax, 0x87c0
jmp 0x404149
push edi
push str.EmbeddedPCMGUID
call esi
test eax, eax
jne 0x404316
mov eax, dword [0x477638]
add eax, 0xc1c
jmp 0x404487
push edi
push str.bytesDownloaded
call esi
test eax, eax
jne 0x404356
push 0xffffffffffffffff
push dword [0x477524]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40434b
mov esi, dword [0x477518]
push dword [0x477524]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push 0x45f2ac
jmp 0x40448d
push edi
push str.percentDownloaded
call esi
test eax, eax
jne 0x404384
push 0xffffffffffffffff
push dword [0x476ee0]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40434b
mov esi, dword [0x47751c]
push dword [0x476ee0]
jmp 0x404345
push edi
push str.PCMHardwareInfo
call esi
test eax, eax
jne 0x4043c7
xor esi, esi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.0040221e
test eax, eax
je 0x4043b6
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [ebp + 0xc]
call fcn.00403e77
pop ecx
pop ecx
mov esi, eax
push dword [esp + 0x14]
call fcn.00445f74
pop ecx
mov eax, esi
jmp 0x4044bb
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 0x89c4]
push ecx
add eax, 0x8ac4
call fcn.00401cf4
pop ecx
push 0
push edi
jmp 0x4041cd
mov eax, dword [ebp + 0x14]
push dword [eax + 0x88c0]
jmp 0x40434c
mov byte [esp + 0x14], 0
xor eax, eax
lea edi, [esp + 0x15]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esi, [esp + 0x14]
stosb byte es:[edi], al
call fcn.0040d512
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov byte [esp + 0x1c], 0
lea edi, [esp + 0x1d]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
lea ebx, [esp + 0x1c]
movzx eax, byte [esp + edi + 0x14]
push eax
push str._2.2X
push ebx
call esi
add esp, 0xc
inc edi
inc ebx
inc ebx
cmp edi, 8
jl 0x404425
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push 0x45f278
push eax
call esi
jmp 0x404498
push SysReAllocStringLen
mov ecx, str.SoftwareMicrosoftMultimedia
lea eax, [esp + 0x434]
call fcn.0040d63a
and dword [esp + 0x1844], 0
push ebx
mov ecx, 0x45ebc7
call fcn.0040d76c
jmp 0x404149
mov eax, dword [ebp + 0x14]
add eax, 0xf28
push eax
push 0x45ec74
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test eax, eax
je 0x4044b9
cmp byte [esp + 0x30], 0
je 0x4044b9
push dword [ebp + 0x10]
lea eax, [esp + 0x34]
push dword [ebp + 0xc]
call fcn.00403e77
pop ecx
pop ecx
jmp 0x4044bb
xor eax, eax
mov ecx, dword [esp + 0x183c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10