Function at 0x46cde8
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49a9b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x182c
call fcn.00433a00
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [esp + 0x31]
push 0x3ff
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x3c], bl
call fcn.0042a910
mov esi, dword [ebp + 8]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push esi
push 0x4a7cd4
call edi
test eax, eax
je 0x46d233
push esi
push str.lang
call edi
test eax, eax
je 0x46d233
push esi
push str.btag1
call edi
test eax, eax
jne 0x46ce6e
mov eax, dword [ebp + 0x14]
add eax, 0x1c
jmp 0x46d23b
push esi
push str.btag2
call edi
test eax, eax
jne 0x46ce87
mov eax, dword [ebp + 0x14]
add eax, 0x21c
jmp 0x46d23b
push esi
push str.btag3
call edi
test eax, eax
jne 0x46cea0
mov eax, dword [ebp + 0x14]
add eax, 0x41c
jmp 0x46d23b
push esi
push str.btag4
call edi
test eax, eax
jne 0x46ceb9
mov eax, dword [ebp + 0x14]
add eax, 0x61c
jmp 0x46d23b
push esi
push str.btag5
call edi
test eax, eax
jne 0x46ced2
mov eax, dword [ebp + 0x14]
add eax, 0x81c
jmp 0x46d23b
push esi
push str.region
call edi
test eax, eax
jne 0x46ceeb
mov eax, dword [ebp + 0x14]
add eax, 0xf28
jmp 0x46d23b
push esi
push str.name
call edi
test eax, eax
jne 0x46cf0a
mov eax, dword [ebp + 0x14]
add eax, 0x89dc
push eax
push 0x4a7d10
jmp 0x46d241
push esi
push str.local_machinename
call edi
test eax, eax
jne 0x46cf36
mov ebx, dword [ebp + 0x10]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x14], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [esp + 0x10]
jmp 0x46d252
push esi
push str.local_username
call edi
test eax, eax
jne 0x46cf63
mov ebx, dword [ebp + 0x10]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x14], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esp + 0x10]
dec eax
jmp 0x46d252
push esi
push str.username
call edi
test eax, eax
jne 0x46cfc3
mov edx, dword [ebp + 0x14]
mov ecx, str.SoftwareMGSThumperCasino
lea edx, [edx + 0x89dc]
call fcn.00406c7d
mov edx, str.username
mov edi, eax
push ebx
mov ecx, edi
call fcn.0046ed18
pop ecx
mov esi, eax
lea eax, [esp + 0x30]
push esi
push 0x4a7d10
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.0042490f
pop ecx
push edi
call fcn.0042490f
mov eax, dword [esp + 0x14]
pop ecx
jmp 0x46d24f
push esi
push str.level
call edi
test eax, eax
jne 0x46d00d
mov edx, dword [ebp + 0x14]
mov ecx, str.SoftwareMGSThumperCasino
lea edx, [edx + 0x89dc]
call fcn.00406c7d
mov esi, eax
mov edx, str.level
push ebx
mov ecx, esi
call fcn.0046ebb6
pop ecx
push eax
lea eax, [esp + 0x34]
push 0x4a5574
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
jmp 0x46cfb4
push esi
push str.userguid
call edi
test eax, eax
je 0x46d202
push esi
push 0x4a5738
call edi
test eax, eax
je 0x46d202
push esi
push str.hddid
call edi
test eax, eax
je 0x46d1a6
push esi
push 0x4a5754
call edi
test eax, eax
je 0x46d1a6
push esi
push str.casinoid
call edi
test eax, eax
je 0x46d198
push esi
push str.serverid
call edi
test eax, eax
je 0x46d198
push esi
push str.pcmversion
call edi
test eax, eax
jne 0x46d086
mov eax, dword [ebp + 0x14]
add eax, 0x8858
jmp 0x46ceff
push esi
push str.PCMGUID
call edi
test eax, eax
jne 0x46d09f
mov eax, dword [ebp + 0x14]
add eax, 0x8758
jmp 0x46ceff
push esi
push str.RegistryPCMGUID
call edi
test eax, eax
jne 0x46d0b8
mov eax, dword [ebp + 0x14]
add eax, 0x87d8
jmp 0x46ceff
push esi
push str.EmbeddedPCMGUID
call edi
test eax, eax
jne 0x46d0d3
mov eax, dword [0x4ca9e8]
add eax, 0xc1c
jmp 0x46d23b
push esi
push str.bytesDownloaded
call edi
test eax, eax
jne 0x46d111
push 0xffffffffffffffff
push dword [0x4cb038]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46d106
mov ebx, dword [0x4cb030]
push dword [0x4cb038]
shr ebx, 0xa
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
push 0x4a5574
jmp 0x46d241
push esi
push str.percentDownloaded
call edi
test eax, eax
jne 0x46d13d
push 0xffffffffffffffff
push dword [0x4cb048]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46d106
mov ebx, dword [0x4cb034]
push dword [0x4cb048]
jmp 0x46d100
push esi
push str.PCMHardwareInfo
call edi
test eax, eax
jne 0x46d17d
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
call fcn.0046ef5c
test eax, eax
je 0x46d16c
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0x18]
call fcn.0046d371
pop ecx
mov ebx, eax
push dword [esp + 0x14]
call fcn.00406283
pop ecx
mov eax, ebx
jmp 0x46d26f
mov eax, dword [ebp + 0x14]
lea edx, [eax + 0x89dc]
lea ecx, [eax + 0x8adc]
call fcn.00406c7d
mov edx, esi
jmp 0x46cf87
mov eax, dword [ebp + 0x14]
push dword [eax + 0x88d8]
jmp 0x46d107
mov byte [esp + 0x14], bl
lea edi, [esp + 0x15]
xor eax, eax
lea ecx, [esp + 0x14]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0045ab90
mov byte [esp + 0x1c], bl
lea edi, [esp + 0x1d]
xor eax, eax
lea esi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
movzx eax, byte [esp + ebx + 0x14]
push eax
push str._2.2X
push esi
call edi
add esp, 0xc
add esi, 2
inc ebx
cmp ebx, 8
jl 0x46d1d5
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push 0x4a7d10
push eax
call edi
jmp 0x46d24c
push SysReAllocStringLen
push str.SoftwareMicrosoftMultimedia
lea ecx, [esp + 0x438]
call fcn.00460acf
push 0x4a513e
push str.userguid
mov dword [esp + 0x184c], ebx
call fcn.00460a39
jmp 0x46ceff
mov eax, dword [ebp + 0x14]
add eax, 0xf40
push eax
push 0x4a5c80
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x46d26d
cmp byte [esp + 0x30], 0
je 0x46d26d
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x30]
push ebx
call fcn.0046d371
pop ecx
jmp 0x46d26f
xor eax, eax
mov ecx, dword [esp + 0x183c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10