Function at 0x412da2
Capabilities:
Get hostname
Query environment variable

Disassembly:
mov eax, 0x43edff
call fcn.0042eda4
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x45c9f0
mov esi, 0x45c5f0
push esi
mov dword [ebp - 4], ebx
call fcn.0042dbd0
pop ecx
pop ecx
mov edi, esi
push esi
dec edi
call fcn.0042d620
cmp byte [eax + edi], 0x5c
pop ecx
push esi
je 0x412de7
call fcn.0042d620
mov byte [eax + edi], bl
jmp 0x412dcb
call fcn.0042d620
dec esi
mov byte [eax + esi], bl
mov edi, 0x458570
push edi
mov esi, 0x45d3b8
push esi
call fcn.0042dbd0
push esi
mov esi, 0x45cfb0
push esi
call fcn.0042dbd0
lea eax, [ebp - 0x34]
push str.gKg5XIBmKAXcZHazRWY0FmLkFGd
push eax
call fcn.00411c3b
add esp, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x412e29
mov eax, dword [eax + 4]
jmp 0x412e2c
add eax, 4
push eax
push 0x45d3b8
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00409968
lea eax, [ebp - 0x34]
push str.gKg5XIBmKcxldoRWY0FmLzl3c
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x412e5f
mov eax, dword [eax + 4]
jmp 0x412e62
add eax, 4
push eax
push esi
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00409968
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00401d95
push edi
mov esi, 0x45c1f0
push esi
mov dword [0x45d7e8], eax
call fcn.0042dbd0
push edi
push esi
call fcn.0042dbd0
push esi
call fcn.0042d620
push 0x44313c
push esi
mov byte [eax + 0x45c1f0], bl
call fcn.0042dbe0
push esi
mov edi, 0x45bdf0
push edi
call fcn.0042dbd0
push edi
call fcn.0042d620
push esi
push 0x45b9f0
mov byte [eax + 0x45bdf0], bl
call fcn.0042dbd0
push 0x45b9f0
call fcn.0042d620
push esi
push 0x45b5f0
mov byte [eax + 0x45b9f0], bl
call fcn.0042dbd0
add esp, 0x40
push 0x45b5f0
call fcn.0042d620
push esi
push 0x45b1f0
mov byte [eax + 0x45b5f0], bl
call fcn.0042dbd0
push 0x45b1f0
call fcn.0042d620
push esi
push 0x45adf0
mov byte [eax + 0x45b1f0], bl
call fcn.0042dbd0
push 0x45adf0
call fcn.0042d620
push esi
push 0x45a9f0
mov byte [eax + 0x45adf0], bl
call fcn.0042dbd0
push 0x45a9f0
call fcn.0042d620
push esi
push 0x45a5f0
mov byte [eax + 0x45a9f0], bl
call fcn.0042dbd0
push 0x45a5f0
call fcn.0042d620
push esi
push 0x459df0
mov byte [eax + 0x45a5f0], bl
call fcn.0042dbd0
push 0x459df0
call fcn.0042d620
add esp, 0x40
push esi
push 0x4599f0
mov byte [eax + 0x459df0], bl
call fcn.0042dbd0
push 0x4599f0
call fcn.0042d620
mov byte [eax + 0x4599f0], bl
lea eax, [ebp - 0x34]
push str.gKg5XIBmKgdp1mLzl3c
push eax
call fcn.00411c3b
add esp, 0x14
cmp dword [eax + 0x18], 0x10
jb 0x412fc3
mov eax, dword [eax + 4]
jmp 0x412fc6
add eax, 4
push eax
push esi
call fcn.0042dbe0
pop ecx
pop ecx
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x34]
call fcn.00409968
lea eax, [ebp - 0x34]
push str.gKg5XIBmKgep1mLzl3c
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x412ff7
mov eax, dword [eax + 4]
jmp 0x412ffa
add eax, 4
push eax
push edi
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x34]
call fcn.00409968
lea eax, [ebp - 0x34]
push str.gKg5XIBmKoXatBjLzl3c
push eax
call fcn.00411c3b
pop ecx
pop ecx
push 0x10
pop edi
cmp dword [eax + 0x18], edi
jb 0x41302a
mov eax, dword [eax + 4]
jmp 0x41302d
add eax, 4
push eax
push 0x45b5f0
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x34]
call fcn.00409968
lea eax, [ebp - 0x34]
push str.gKg5XIBmKoXatJjLzl3c
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x41305e
mov eax, dword [eax + 4]
jmp 0x413061
add eax, 4
push eax
push 0x45b9f0
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x34]
call fcn.00409968
lea eax, [ebp - 0x34]
push str.gKg5XIBmKAapNnLzl3c
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x413092
mov eax, dword [eax + 4]
jmp 0x413095
add eax, 4
push eax
push 0x45b1f0
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x34]
call fcn.00409968
lea eax, [ebp - 0x34]
push str.gKg5XIBmKQWY0FmLzl3c
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x4130c6
mov eax, dword [eax + 4]
jmp 0x4130c9
add eax, 4
push eax
push 0x45adf0
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x34]
call fcn.00409968
lea eax, [ebp - 0x34]
push str.gKg5XIBmKcHalxGclJnLzl3c
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x4130fa
mov eax, dword [eax + 4]
jmp 0x4130fd
add eax, 4
push eax
push 0x459df0
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x34]
call fcn.00409968
lea eax, [ebp - 0x34]
push str.gKg5XIBmK3hWZsBXZypnLzl3c
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x41312e
mov eax, dword [eax + 4]
jmp 0x413131
add eax, 4
push eax
push 0x4599f0
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x34]
call fcn.00409968
push 0x64
mov edi, 0x457c68
push edi
mov esi, str._username_
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
push esi
call fcn.0042dec0
test eax, eax
pop ecx
pop ecx
jne 0x413176
push str.System
push edi
call fcn.0042dbd0
pop ecx
pop ecx
push edi
call fcn.0042d620
push edi
mov esi, 0x45a9f0
push esi
mov byte [eax + 0x457c68], bl
call fcn.0042dbe0
push edi
mov edi, 0x45a5f0
push edi
call fcn.0042dbe0
lea eax, [ebp - 0x34]
push str.gKg5XIBmKgL0BnLkFGd
push eax
call fcn.00411c3b
add esp, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x4131b6
mov eax, dword [eax + 4]
jmp 0x4131b9
add eax, 4
push eax
push esi
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00409968
lea eax, [ebp - 0x50]
push str.gKg5XIBmKgL0NmLkFGd
push eax
call fcn.00411c3b
pop ecx
pop ecx
push 0x10
pop esi
cmp dword [eax + 0x18], esi
jb 0x4131ea
mov eax, dword [eax + 4]
jmp 0x4131ed
add eax, 4
push eax
push edi
call fcn.0042dbe0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.00409968
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov esi, 0x45999c
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x413225
push str.UNKNOWN
push esi
call fcn.0042dbd0
pop ecx
pop ecx
push esi
call fcn.0042d620
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionProductName
mov byte [eax + 0x45999c], bl
call fcn.0040d800
push 0x4560e8
call fcn.0040ed07
mov ecx, dword [ebp - 0xc]
add esp, 0x20
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret