Function at 0x41c6d3
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push ebx
push esi
mov esi, ecx
push edi
push str.TEST
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x34], esi
call fcn.0040182e
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x5c]
push 0
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4f
call ebx
push 0x4d
mov edi, eax
call ebx
add edi, eax
push edi
push 0x4e
call ebx
push 0x4c
mov edi, eax
call ebx
add edi, eax
push edi
push 0x4d
call ebx
push eax
push 0x4c
call ebx
push eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.USER32.dll_SetRect]
cmp dword [esi + 0xa80], 1
jne 0x41c770
push 1
call ebx
mov esi, eax
xor eax, eax
push eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
call ebx
mov dword [ebp - 0x20], esi
lea esi, [ebp - 0x2c]
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x24], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0xa80]
cmp eax, 2
jne 0x41c788
lea esi, [ebp - 0x6c]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp eax, 4
jne 0x41c7c1
lea eax, [ebp - 0x158]
xor esi, esi
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x28], esi
lea esi, [ebp - 0x2c]
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x20], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fld1
lea eax, [ebp - 0x44]
fstp qword [ebp - 0x4c]
push eax
lea eax, [ebp - 0x4c]
fld1
push eax
fstp qword [ebp - 0x44]
call fcn.00416f2e
fld qword [ebp - 0x44]
pop ecx
lea eax, [ebp - 0x5c]
pop ecx
push eax
push ecx
push ecx
fstp qword [esp]
fld qword [ebp - 0x4c]
push ecx
push ecx
fstp qword [esp]
call fcn.0041c3b8
mov eax, dword [ebp - 0x50]
add esp, 0x14
sub eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x1c]
push str._dx_d
push eax
call fcn.00408f2b
mov eax, dword [ebp - 0x34]
add esp, 0x10
cmp dword [eax + 0xa80], 3
jne 0x41cc12
mov eax, dword [0x4c9e98]
cmp dword [eax - 0xc], 0
jl 0x41c83f
mov dword [ebp - 8], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x41c851
mov ecx, dword [0x4581d0]
push eax
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
call fcn.00401988
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, 0x45b720
lea ecx, [ebp - 4]
push edi
call fcn.0040182e
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
sub esi, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041c37f
pop ecx
pop ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0041c37f
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004019f3
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004019f3
push dword [eax]
lea ecx, [ebp - 8]
push str._WA_
call fcn.00401c3b
lea ecx, [ebp - 0x14]
call fcn.00401802
lea ecx, [ebp - 0x18]
call fcn.00401802
lea ecx, [ebp - 0x10]
call fcn.00401802
lea ecx, [ebp - 0xc]
call fcn.00401802
lea ecx, [ebp - 4]
call fcn.00401802
fld qword [ebp - 0x44]
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
fstp qword [esp]
fld qword [ebp - 0x4c]
push ecx
push ecx
fstp qword [esp]
call fcn.0041c3b8
add esp, 0x14
lea eax, [ebp - 0x2c]
push 0
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push edi
lea ecx, [ebp - 4]
call fcn.0040182e
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
sub esi, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041c37f
pop ecx
pop ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0041c37f
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004019f3
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004019f3
push dword [eax]
lea ecx, [ebp - 8]
push str._RS_
call fcn.00401c3b
lea ecx, [ebp - 0xc]
call fcn.00401802
lea ecx, [ebp - 0x10]
call fcn.00401802
lea ecx, [ebp - 0x18]
call fcn.00401802
lea ecx, [ebp - 0x14]
call fcn.00401802
lea ecx, [ebp - 4]
call fcn.00401802
fld qword [ebp - 0x44]
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
fstp qword [esp]
fld qword [ebp - 0x4c]
push ecx
push ecx
fstp qword [esp]
call fcn.0041c3b8
add esp, 0x14
push 0x4f
call ebx
push 0x4d
mov esi, eax
call ebx
add esi, eax
push esi
push 0x4e
call ebx
push 0x4c
mov esi, eax
call ebx
add esi, eax
push esi
push 0x4d
call ebx
push eax
push 0x4c
call ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push edi
lea ecx, [ebp - 4]
call fcn.0040182e
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
sub esi, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041c37f
pop ecx
pop ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0041c37f
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004019f3
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004019f3
push dword [eax]
lea ecx, [ebp - 8]
push str._NR_
call fcn.00401c3b
lea ecx, [ebp - 0xc]
call fcn.00401802
lea ecx, [ebp - 0x10]
call fcn.00401802
lea ecx, [ebp - 0x18]
call fcn.00401802
lea ecx, [ebp - 0x14]
call fcn.00401802
lea ecx, [ebp - 4]
call fcn.00401802
fld qword [ebp - 0x44]
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
fstp qword [esp]
fld qword [ebp - 0x4c]
push ecx
push ecx
fstp qword [esp]
call fcn.0041c3b8
add esp, 0x14
lea ecx, [ebp - 4]
push edi
call fcn.0040182e
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
sub esi, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041c37f
pop ecx
pop ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0041c37f
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004019f3
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004019f3
push dword [eax]
lea ecx, [ebp - 8]
push str._VD_
call fcn.00401c3b
lea ecx, [ebp - 0xc]
call fcn.00401802
lea ecx, [ebp - 0x10]
call fcn.00401802
lea ecx, [ebp - 0x18]
call fcn.00401802
lea ecx, [ebp - 0x14]
call fcn.00401802
lea ecx, [ebp - 4]
call fcn.00401802
mov eax, dword [0x4581d0]
push 0x7f
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], eax
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x356]
mov word [ebp - 0x358], bx
mov esi, 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], esi
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x358]
lea ecx, [ebp - 0x30]
push eax
call fcn.00401988
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], esi
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x358]
lea ecx, [ebp - 0x3c]
push eax
call fcn.00401988
push dword [0x4c9fe4]
lea ecx, [ebp - 8]
push str._OS_
call fcn.00401c3b
push dword [ebp - 0x3c]
lea ecx, [ebp - 8]
push str._HOST_
call fcn.00401c3b
push dword [ebp - 0x30]
lea ecx, [ebp - 8]
push str._USER_
call fcn.00401c3b
mov esi, 0x45b724
push ebx
push esi
lea ecx, [ebp - 8]
call fcn.00408ef9
test eax, eax
jl 0x41cbee
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x4581d0]
push dword [ebp - 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 0x458790
push eax
call fcn.00408f2b
add esp, 0xc
lea ecx, [ebp - 8]
push dword [ebp - 4]
push esi
call fcn.00401c3b
lea ecx, [ebp - 4]
call fcn.00401802
lea eax, [ebp - 8]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0040711b
lea ecx, [ebp - 0x3c]
call fcn.00401802
lea ecx, [ebp - 0x30]
call fcn.00401802
lea ecx, [ebp - 8]
call fcn.00401802
cmp dword [ebp + 0xc], 0
pop edi
pop esi
pop ebx
je 0x41cc38
mov ecx, dword [ebp - 0x34]
lea eax, [ebp + 0xc]
push eax
call fcn.0041c3f8
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401b5d
lea ecx, [ebp + 0xc]
call fcn.00401802
lea ecx, [ebp - 0x1c]
call fcn.0040930c
lea ecx, [ebp - 0x1c]
call fcn.004092bc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004017bc
lea ecx, [ebp - 0x1c]
call fcn.00401802
mov eax, dword [ebp + 8]
leave
ret 8