Function at 0x4a9220
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55aa30
mov eax, dword fs:[0]
push eax
mov eax, 0x1340
call fcn.0051fbc0
mov eax, dword [0x5b706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1304], edi
mov dword [ebp - 0x1304], edi
mov dword [ebp - 0x1330], 0
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x5c1c14]
cmp eax, dword [esi + 4]
jle 0x4a92c6
push 0x5c1c14
call fcn.0051eddf
add esp, 4
cmp dword [0x5c1c14], 0xffffffff
jne 0x4a92c6
push 0x55ffd0
mov dword [0x5c1bec], 0
mov dword [0x5c1bf0], 0xf
mov byte [0x5c1bdc], 0
call fcn.0051f13c
push 0x5c1c14
call fcn.0051ed95
add esp, 8
cmp dword [0x5c1bec], 0
je 0x4a92e0
push 0x5c1bdc
mov ecx, edi
call fcn.00409180
jmp 0x4a9ddc
mov eax, dword [0x5c1c48]
mov byte [ebp - 0x12fd], 0x63
cmp eax, dword [esi + 4]
jle 0x4a933e
push 0x5c1c48
call fcn.0051eddf
add esp, 4
cmp dword [0x5c1c48], 0xffffffff
jne 0x4a933e
push 0x594148
mov ecx, 0x5c1bfc
mov dword [ebp - 4], 0
call fcn.00403900
push 0x55ffc0
call fcn.0051f13c
push 0x5c1c48
mov dword [ebp - 4], 0xffffffff
call fcn.0051ed95
add esp, 8
mov eax, dword [0x5c1bf8]
cmp eax, dword [esi + 4]
jle 0x4a9395
push 0x5c1bf8
call fcn.0051eddf
add esp, 4
cmp dword [0x5c1bf8], 0xffffffff
jne 0x4a9395
push 0x594154
mov ecx, 0x5c1c30
mov dword [ebp - 4], 1
call fcn.00403900
push 0x55ffb0
call fcn.0051f13c
push 0x5c1bf8
mov dword [ebp - 4], 0xffffffff
call fcn.0051ed95
add esp, 8
push 0x1000
lea eax, [ebp - 0x1218]
push 0
push eax
call fcn.00525340
add esp, 0xc
lea eax, [ebp - 0x1218]
push 0x800
push eax
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 3
jbe 0x4a94ac
xor ecx, ecx
mov dword [ebp - 0x1220], 0
push eax
lea eax, [ebp - 0x1218]
mov word [ebp - 0x1230], cx
push eax
lea ecx, [ebp - 0x1230]
mov dword [ebp - 0x121c], 7
call fcn.00403df0
mov edx, 0x5c1bfc
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x1230]
call fcn.004a2e90
lea ecx, [ebp - 0x1230]
test al, al
je 0x4a942a
mov eax, dword [0x5c1c0c]
jmp 0x4a9443
mov edx, 0x5c1c30
call fcn.004a2e90
test al, al
je 0x4a9475
mov eax, dword [0x5c1c40]
lea ecx, [ebp - 0x1230]
cmp dword [ebp - 0x121c], 8
cmovae ecx, dword [ebp - 0x1230]
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x1230]
cmovae ecx, dword [ebp - 0x1230]
lea eax, [ebp - 0x1304]
push ecx
push eax
lea ecx, [ebp - 0x1230]
call fcn.0041f3c0
cmp dword [ebp - 0x1220], 0
je 0x4a949a
cmp dword [ebp - 0x121c], 8
lea eax, [ebp - 0x1230]
cmovae eax, dword [ebp - 0x1230]
mov al, byte [eax]
mov byte [ebp - 0x12fd], al
lea ecx, [ebp - 0x1230]
mov dword [ebp - 4], 0xffffffff
call fcn.00403d90
mov cl, byte [ebp - 0x12fd]
call fcn.004b0c90
mov dword [ebp - 0x1304], eax
mov dword [ebp - 0x1320], 0
mov dword [ebp - 0x1238], 0
mov dword [ebp - 0x1234], 0xf
mov byte [ebp - 0x1248], 0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 3
push 0
push eax
call fcn.00525340
add esp, 0xc
mov dword [ebp - 0x124c], 0x104
lea eax, [ebp - 0x124c]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4a9680
xor eax, eax
mov dword [ebp - 0x130c], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x1308], 7
mov word [ebp - 0x131c], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a9550
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x131c]
call fcn.00403df0
lea edx, [ebp - 0x131c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1230]
call fcn.004ad250
mov esi, eax
lea eax, [ebp - 0x1248]
cmp eax, esi
je 0x4a95c2
mov ecx, eax
call fcn.00403b20
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x1248], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x1238], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov edx, dword [ebp - 0x121c]
cmp edx, 0x10
jb 0x4a95fc
mov ecx, dword [ebp - 0x1230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a95f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9df9
push edx
push ecx
call fcn.0051ec14
add esp, 8
lea ecx, [ebp - 0x131c]
mov dword [ebp - 0x1220], 0
mov dword [ebp - 0x121c], 0xf
mov byte [ebp - 0x1230], 0
mov byte [ebp - 4], 3
call fcn.00403d90
mov eax, dword [ebp - 0x1234]
lea edx, [ebp - 0x1248]
mov esi, dword [ebp - 0x1248]
cmp eax, 0x10
jb 0x4a964b
mov edx, esi
test edx, edx
jne 0x4a964b
mov dword [ebp - 0x1320], esi
jmp 0x4a9667
push dword [ebp - 0x1238]
xor ecx, ecx
call fcn.004dc2c0
mov dword [ebp - 0x1320], eax
add esp, 4
mov eax, dword [ebp - 0x1234]
cmp eax, 0x10
mov dword [ebp - 0x1238], 0
lea ecx, [ebp - 0x1248]
cmovae ecx, esi
mov byte [ecx], 0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x124c], 0x104
push 0
push eax
call fcn.00525340
add esp, 0xc
lea eax, [ebp - 0x124c]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x4a97a3
push 1
push 0x589b00
lea ecx, [ebp - 0x1248]
call fcn.00403f90
xor eax, eax
mov dword [ebp - 0x1220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x121c], 7
mov word [ebp - 0x1230], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a96f4
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1230]
call fcn.00403df0
lea edx, [ebp - 0x1230]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x131c]
call fcn.004ad250
push eax
lea ecx, [ebp - 0x1248]
mov byte [ebp - 4], 6
call fcn.0040c900
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1308]
cmp edx, 0x10
jb 0x4a9779
mov ecx, dword [ebp - 0x131c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a976f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9dfe
push edx
push ecx
call fcn.0051ec14
add esp, 8
lea ecx, [ebp - 0x1230]
mov dword [ebp - 0x130c], 0
mov dword [ebp - 0x1308], 0xf
mov byte [ebp - 0x131c], 0
mov byte [ebp - 4], 3
call fcn.00403d90
lea ecx, [ebp - 0x1230]
call fcn.004a80c0
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x131c]
call fcn.004ad250
mov byte [ebp - 4], 8
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x4a97cd
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
push ecx
lea ecx, [ebp - 0x1248]
call fcn.00415960
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1308]
cmp edx, 0x10
jb 0x4a981b
mov ecx, dword [ebp - 0x131c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a9811
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9e03
push edx
push ecx
call fcn.0051ec14
add esp, 8
lea ecx, [ebp - 0x1230]
mov dword [ebp - 0x130c], 0
mov dword [ebp - 0x1308], 0xf
mov byte [ebp - 0x131c], 0
mov byte [ebp - 4], 3
call fcn.00403d90
mov eax, dword [ebp - 0x1234]
lea edx, [ebp - 0x1248]
mov esi, dword [ebp - 0x1248]
cmp eax, 0x10
jb 0x4a986a
mov edx, esi
test edx, edx
jne 0x4a986a
mov dword [ebp - 0x132c], esi
jmp 0x4a9886
push dword [ebp - 0x1238]
xor ecx, ecx
call fcn.004dc2c0
mov dword [ebp - 0x132c], eax
add esp, 4
mov eax, dword [ebp - 0x1234]
cmp eax, 0x10
mov dword [ebp - 0x1238], 0
lea ecx, [ebp - 0x1248]
mov dword [ebp - 0x1220], 0
cmovae ecx, esi
mov dword [ebp - 0x121c], 7
push 0xb
xor eax, eax
push 0x594ac4
mov byte [ecx], 0
lea ecx, [ebp - 0x1230]
mov word [ebp - 0x1230], ax
call fcn.00403df0
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
xor eax, eax
push 0x24
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.HKLMSoftwareMicrosoftCryptography
mov word [ecx], ax
call fcn.00403df0
lea edx, [ebp - 0x1230]
lea ecx, [ebp - 0x134c]
call fcn.004b1650
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x131c]
call fcn.004ad250
mov esi, eax
lea eax, [ebp - 0x1248]
cmp eax, esi
je 0x4a9956
mov ecx, eax
call fcn.00403b20
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x1248], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x1238], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov edx, dword [ebp - 0x1308]
cmp edx, 0x10
jb 0x4a9990
mov ecx, dword [ebp - 0x131c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a9986
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9e08
push edx
push ecx
call fcn.0051ec14
add esp, 8
lea ecx, [ebp - 0x134c]
mov dword [ebp - 0x130c], 0
mov dword [ebp - 0x1308], 0xf
mov byte [ebp - 0x131c], 0
call fcn.00403d90
lea ecx, [ebp - 0x1230]
mov byte [ebp - 4], 3
call fcn.00403d90
mov eax, dword [ebp - 0x1234]
lea edx, [ebp - 0x1248]
mov esi, dword [ebp - 0x1248]
cmp eax, 0x10
jb 0x4a99ea
mov edx, esi
test edx, edx
jne 0x4a99ea
mov dword [ebp - 0x1328], esi
jmp 0x4a9a06
push dword [ebp - 0x1238]
xor ecx, ecx
call fcn.004dc2c0
mov dword [ebp - 0x1328], eax
add esp, 4
mov eax, dword [ebp - 0x1234]
cmp eax, 0x10
mov dword [ebp - 0x1238], 0
lea ecx, [ebp - 0x1248]
cmovae ecx, esi
mov byte [ecx], 0
lea ecx, [ebp - 0x131c]
call fcn.004a8770
mov esi, eax
lea eax, [ebp - 0x1248]
cmp eax, esi
je 0x4a9a65
mov ecx, eax
call fcn.00403b20
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x1248], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x1238], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov edx, dword [ebp - 0x1308]
cmp edx, 0x10
jb 0x4a9a9f
mov ecx, dword [ebp - 0x131c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a9a95
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9e0d
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov eax, dword [ebp - 0x1234]
lea edx, [ebp - 0x1248]
mov esi, dword [ebp - 0x1248]
cmp eax, 0x10
jb 0x4a9ac4
mov edx, esi
test edx, edx
jne 0x4a9ac4
mov dword [ebp - 0x1324], esi
jmp 0x4a9ae0
push dword [ebp - 0x1238]
xor ecx, ecx
call fcn.004dc2c0
mov dword [ebp - 0x1324], eax
add esp, 4
mov eax, dword [ebp - 0x1234]
cmp eax, 0x10
mov dword [ebp - 0x1238], 0
lea ecx, [ebp - 0x1248]
cmovae ecx, esi
lea eax, [ebp - 0x12fc]
push 0xb0
push 0
push eax
mov byte [ecx], 0
call fcn.00525340
mov dword [ebp - 0x12fc], 0x58482c
mov dword [ebp - 0x12ec], 0x594af8
add esp, 8
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x12e4]
mov dword [ebp - 0x1330], 2
xorps xmm0, xmm0
mov dword [ebp - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
lea ecx, [ebp - 0x1294]
mov dword [ebp - 0x1298], 0x50
push eax
movlpd qword [ebp - 0x12f4], xmm0
call fcn.0040e510
lea eax, [ebp - 0x12ec]
mov dword [ebp - 0x1334], eax
mov eax, dword [ebp - 0x12ec]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x12ec]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x12f0], eax
mov eax, dword [ebp - 0x12fc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_iostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x12fc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ebp + ecx - 0x1300], eax
mov dword [ebp - 4], 0x10
mov eax, dword [ebp - 0x12fc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x12fc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x1300], eax
lea ecx, [ebp - 0x12e4]
call fcn.0040e450
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0x12ac], 0
mov dword [ebp - 0x12a8], 0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x12ec]
push 0
push 8
mov eax, dword [eax + 4]
mov byte [ebp + eax - 0x12ac], 0x30
lea eax, [ebp - 0x1228]
push eax
call fcn.0050a92a
mov ecx, dword [ebp - 0x12ec]
lea edx, [ebp - 0x12ec]
push dword [eax + 0xc]
mov ecx, dword [ecx + 4]
push dword [eax + 8]
mov eax, dword [eax]
add ecx, edx
push ecx
call eax
mov eax, dword [ebp - 0x12ec]
lea ecx, [ebp - 0x12d8]
add esp, 0x18
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx]
and eax, 0xfffff9ff
push dword [ebp - 0x1328]
or eax, 0x800
push dword [ebp - 0x1324]
mov dword [ecx], eax
lea ecx, [ebp - 0x12ec]
push dword [ebp - 0x1320]
push dword [ebp - 0x132c]
push dword [ebp - 0x1304]
call fcn.004aa550
mov ecx, eax
call fcn.004abe50
mov ecx, eax
call fcn.004aa550
mov ecx, eax
call fcn.004abe50
mov ecx, eax
call fcn.004aa550
mov ecx, eax
call fcn.004abe50
mov ecx, eax
call fcn.004aa550
mov ecx, eax
call fcn.004abe50
mov ecx, eax
call fcn.004aa550
mov byte [ebp - 4], 0x12
mov cl, byte [ebp - 0x12a8]
mov dword [ebp - 0x1220], 0
mov dword [ebp - 0x121c], 0xf
mov byte [ebp - 0x1230], 0
mov dword [ebp - 0x1330], 0x42
test cl, 2
jne 0x4a9d30
mov eax, dword [ebp - 0x12c4]
mov edx, dword [eax]
test edx, edx
je 0x4a9d30
mov eax, dword [ebp - 0x12d4]
cmp edx, dword [ebp - 0x12ac]
cmovb edx, dword [ebp - 0x12ac]
mov ecx, dword [eax]
sub edx, ecx
jmp 0x4a9d53
test cl, 4
jne 0x4a9d60
mov eax, dword [ebp - 0x12c8]
mov edx, dword [eax]
test edx, edx
je 0x4a9d60
mov eax, dword [ebp - 0x12d8]
mov ecx, dword [eax]
sub edx, ecx
mov eax, dword [ebp - 0x12b8]
add edx, dword [eax]
push edx
push ecx
lea ecx, [ebp - 0x1230]
call fcn.00403f90
mov ecx, 0x5c1bdc
mov dword [ebp - 4], 0x11
call fcn.00403b20
movups xmm0, xmmword [ebp - 0x1230]
push 0x5c1bdc
mov ecx, edi
movups xmmword [0x5c1bdc], xmm0
movq xmm0, qword [ebp - 0x1220]
movq qword [0x5c1bec], xmm0
call fcn.00409180
lea ecx, [ebp - 0x12fc]
call fcn.004a9e20
mov edx, dword [ebp - 0x1234]
cmp edx, 0x10
jb 0x4a9ddc
mov ecx, dword [ebp - 0x1248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a9dd2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9e12
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
int3