Function at 0x408f40
Capabilities:
Get hostname
Get session user name
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40d98a
mov eax, dword fs:[0]
push eax
mov eax, 0x1304
call fcn.0040d1a0
mov eax, dword [0x41404c]
xor eax, esp
mov dword [esp + 0x1300], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41404c]
xor eax, esp
push eax
lea eax, [esp + 0x1318]
mov dword fs:[0], eax
xor esi, esi
push 0x1f0
lea eax, [esp + 0x30c]
push esi
push eax
mov dword [esp + 0x310], esi
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x410a64
call dword [sym.imp.MSVCR90.dll__wgetenv]
add esp, 4
lea edx, [esp + 0x304]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
cmp cx, si
jne 0x408fb3
push 0xfde9
lea edx, [esp + 0x308]
lea ecx, [esp + 0x58]
push edx
lea eax, [esp + 0x58]
mov dword [esp + 0x58], ecx
call fcn.0040b650
lea eax, [esp + 0x1c]
mov dword [esp + 0x1320], esi
mov ecx, dword [esp + 0x50]
push eax
call fcn.0040b4c0
mov byte [esp + 0x1320], 2
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x54]
cmp eax, ecx
je 0x409015
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov edx, dword [esp + 0x1c]
push edx
lea ecx, [esp + 0x27c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov byte [esp + 0x1320], 3
mov eax, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, dword [eax]
push ecx
push 0x410a7c
lea ecx, [esp + 0x280]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_last_of_char_const___unsigned_int_const]
mov edx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp dword [edx], eax
je 0x409063
inc eax
push eax
push esi
lea ecx, [esp + 0x280]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_]
cmp dword [esp + 0x290], 0x10
mov eax, dword [esp + 0x27c]
jae 0x40907b
lea eax, [esp + 0x27c]
push 0xfde9
lea ecx, [esp + 0x160]
push eax
lea eax, [esp + 0x160]
mov dword [esp + 0x160], ecx
call fcn.0040b710
lea edx, [esp + 0x18]
mov byte [esp + 0x1320], 4
mov ecx, dword [esp + 0x158]
push edx
call fcn.0040b580
mov byte [esp + 0x1320], 6
mov eax, dword [esp + 0x158]
lea ecx, [esp + 0x15c]
cmp eax, ecx
je 0x4090d8
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
push 0x7fc
lea edx, [esp + 0xb1c]
push esi
push edx
mov dword [esp + 0xb20], esi
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x204
lea eax, [esp + 0x914]
push esi
push eax
mov dword [esp + 0x918], esi
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x204
lea ecx, [esp + 0x504]
push esi
push ecx
mov dword [esp + 0x508], esi
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0xb18]
mov esi, 0x104
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x910]
push edx
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x410a80
mov dword [esp + 0x48], esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea ecx, [esp + 0x2e8]
call fcn.00409930
mov byte [esp + 0x133c], 7
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x410ab0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea ecx, [esp + 0x304]
call fcn.00409930
add esp, 0x1c
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2d0]
mov byte [esp + 0x1324], 8
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::end_void_]
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x2d0]
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::begin_void_]
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
push 0
push 0
lea ecx, [esp + 0x2b8]
call dword [sym.imp.MSVCP90.dll_protected:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Tidy_bool__unsigned_int_]
mov edx, dword [esp + 0x14]
push edi
push esi
push ebx
push ebp
push edx
lea eax, [esp + 0x2c4]
push eax
call fcn.0040bed0
mov byte [esp + 0x1320], 9
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x2ec]
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::end_void_]
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x2ec]
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::begin_void_]
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
push 0
push 0
lea ecx, [esp + 0x29c]
call dword [sym.imp.MSVCP90.dll_protected:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Tidy_bool__unsigned_int_]
mov eax, dword [esp + 0x14]
push edi
push esi
push ebx
push ebp
push eax
lea ecx, [esp + 0x2a8]
push ecx
call fcn.0040bed0
mov byte [esp + 0x1320], 0xa
mov ecx, dword [esp + 0x298]
mov eax, 8
cmp dword [esp + 0x2ac], eax
jae 0x40928c
lea ecx, [esp + 0x298]
cmp dword [esp + 0x2c8], eax
mov eax, dword [esp + 0x2b4]
jae 0x4092a3
lea eax, [esp + 0x2b4]
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x500]
push edx
push 0
push 0xffff
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea edi, [esp + 0xb14]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4092d0
mov eax, dword [0x410abc]
mov dword [edi], eax
lea eax, [esp + 0x90c]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4092f0
lea edi, [esp + 0xb14]
sub eax, edx
add edi, 0xfffffffe
jmp 0x409310
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x409310
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0xb14]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x409336
mov ebx, dword [0x410ac0]
mov ebp, dword [0x410ac4]
mov dword [eax], ebx
mov dword [eax + 4], ebp
mov eax, dword [esp + 0x18]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409360
lea edi, [esp + 0xb14]
sub eax, edx
add edi, 0xfffffffe
jmp 0x409380
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x409380
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0xb14]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4093a6
mov dword [eax], ebx
mov dword [eax + 4], ebp
lea eax, [esp + 0x4fc]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4093c0
lea edi, [esp + 0xb14]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4093e0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4093e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb14]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x409406
mov ecx, dword [0x410abc]
mov eax, 0x416648
mov dword [edi], ecx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409421
lea edi, [esp + 0xb14]
sub eax, edx
add edi, 0xfffffffe
jmp 0x409440
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x409440
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0xb14]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x409466
mov edx, dword [0x410ac8]
mov cx, word [0x410acc]
mov dword [eax], edx
push 0x204
lea edx, [esp + 0x70c]
push 0
push edx
mov word [eax + 4], cx
mov dword [esp + 0x710], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea eax, [esp + 0x708]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x704]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4094c5
lea edi, [esp + 0xb14]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4094e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0xb14]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x409506
mov ecx, dword [0x410ac8]
mov dx, word [0x410acc]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 0xd8]
push 0xfde9
lea ecx, [esp + 0xb18]
mov dword [esp + 0xd8], eax
push ecx
lea eax, [esp + 0xdc]
call fcn.0040b650
lea edx, [esp + 0x20]
mov byte [esp + 0x1320], 0xb
mov ecx, dword [esp + 0xd4]
push edx
call fcn.0040b4c0
mov bl, 0xd
mov byte [esp + 0x1320], bl
mov eax, dword [esp + 0xd4]
lea ecx, [esp + 0xd8]
cmp eax, ecx
je 0x40958a
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
push 0x416644
lea ecx, [esp + 0x260]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push str.___:
lea ecx, [esp + 0x260]
mov byte [esp + 0x1324], 0xe
call dword [0x4101d8]
push 0x416710
lea ecx, [esp + 0x260]
call dword [0x4101d8]
push str.___:
lea ecx, [esp + 0x260]
call dword [0x4101d8]
mov edx, dword [esp + 0x20]
push edx
lea ecx, [esp + 0x260]
call dword [0x4101d8]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4106f0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea esi, [esp + 0x278]
call fcn.00407ec0
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x410714
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
call fcn.00407ec0
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x410ad4
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
call fcn.00407ec0
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x410ad8
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
call fcn.00407ec0
add esp, 0x1c
push 0
sub esp, 0x1c
mov eax, esi
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
call fcn.004082c0
add esp, 0x20
mov ecx, esi
mov byte [esp + 0x1320], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov byte [esp + 0x1320], 0xa
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x294]
mov byte [esp + 0x1320], 9
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x2b0]
mov byte [esp + 0x1320], 8
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x2e8]
mov byte [esp + 0x1320], 7
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x2cc]
mov byte [esp + 0x1320], 6
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov byte [esp + 0x1320], 3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409720
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x278]
mov byte [esp + 0x1320], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov dword [esp + 0x1320], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409760
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1318]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1300]
xor ecx, esp
call fcn.0040c7c6
add esp, 0x1310
ret