Function at 0x49a4e0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ccf9f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4f4fa0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 2
push eax
push 0x10
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
push 0x4d7ed8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00466470
add esp, 0xc
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], 8
push eax
push 0x101
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x2c], 0x101
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x14]
push 1
push 0x4d7ed8
mov dword [ebp - 0x10], 0x18
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
push str.___________________________________________________
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00466470
add esp, 0x20
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x104
mov dword [ebp - 0x10], 0x40
push 0x104
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0047e1f0
add esp, 8
mov esi, eax
mov ecx, esi
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [esi]
mov dword [ebp - 0x10], 0xc0
push dword [eax - 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push 0x4d7ed8
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
push 0x4d7ed8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00466470
add esp, 0x20
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xf
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0x200
push dword [eax - 0xc]
push eax
push dword [ecx - 0xc]
lea eax, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
mov eax, dword [ebp - 0x20]
add esp, 0x14
mov ecx, 0x20
sub ecx, dword [eax - 0xc]
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x10
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004663f0
add esp, 0xc
lea ecx, [ebp - 0x2c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x800
push dword [eax - 0xc]
push eax
push 0xb
lea eax, [ebp - 0x14]
push str.ThisMTimeS_
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
mov esi, dword [ebp + 8]
mov ecx, esi
push eax
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x1800
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax - 0xc]
push eax
push esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret