Function at 0x417cc4
Capabilities:
Get common file path
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x417ccc
push ebx
push esi
push edi
mov eax, 0x417c3c
call fcn.004051ec
mov edi, dword [0x41d64c]
xor eax, eax
push ebp
push 0x41836a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402808
mov edx, dword [ebp - 0x14]
mov eax, 0x418384
call fcn.00407070
mov edx, dword [0x41d55c]
mov dword [edx], eax
mov eax, dword [0x41d6ac]
push eax
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402808
mov eax, dword [ebp - 0x18]
mov edx, dword [0x41d55c]
mov edx, dword [edx]
inc edx
mov ecx, 0x3e8
call fcn.00404218
mov eax, dword [0x41d644]
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402808
mov eax, dword [ebp - 0x1c]
mov ecx, dword [0x41d55c]
mov ecx, dword [ecx]
dec ecx
mov edx, 1
call fcn.00404218
lea ecx, [ebp - 0x20]
xor edx, edx
mov eax, 0x418390
call fcn.00405ad4
mov edx, dword [ebp - 0x20]
mov eax, dword [0x41d5e0]
call fcn.00403e64
lea edx, [ebp - 0x24]
mov eax, dword [0x41d6ac]
mov eax, dword [eax]
call fcn.00407100
mov eax, dword [ebp - 0x24]
mov edx, 0x4183a4
call fcn.00404104
je 0x417dae
push 0
push 0x4183b0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x417dae
call fcn.00403ca4
mov eax, edi
mov edx, 0x4183c0
call fcn.00403e64
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [edi]
mov ecx, 0x2710
mov edx, 5
call fcn.00404218
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
xor edx, edx
call fcn.00405ad4
mov edx, dword [ebp - 0x28]
mov eax, edi
call fcn.00403e64
xor ebx, ebx
mov esi, dword [0x41d590]
lea eax, [ebp - 0x30]
mov dl, 0xff
sub dl, bl
call fcn.00403f30
mov eax, dword [ebp - 0x30]
mov edx, dword [edi]
call fcn.004042a0
mov edx, dword [0x41d55c]
mov dword [edx], eax
push esi
mov edx, dword [edi]
mov eax, 0x419ea0
call fcn.004042a0
mov ecx, eax
dec ecx
mov eax, dword [edi]
mov edx, 1
call fcn.00404218
push edi
mov edx, dword [0x41d55c]
mov edx, dword [edx]
inc edx
mov eax, dword [edi]
mov ecx, 0x2710
call fcn.00404218
inc ebx
add esi, 4
cmp bl, 0x16
jne 0x417dee
mov eax, dword [0x41d614]
mov dword [eax], 0x94
mov eax, dword [0x41d614]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x417e7f
mov eax, dword [0x41d614]
cmp dword [eax + 0x10], 2
jne 0x417e7f
mov eax, dword [0x41d5d0]
mov byte [eax], 1
call fcn.004072f8
mov eax, 0x104
call fcn.00402548
mov edx, dword [0x41d6a0]
mov dword [edx], eax
push 0x104
mov eax, dword [0x41d6a0]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x34]
mov edx, dword [0x41d6a0]
mov edx, dword [edx]
call fcn.00403f40
mov edx, dword [ebp - 0x34]
mov eax, dword [0x41d570]
mov ecx, 0x418384
call fcn.00404004
mov eax, dword [0x41d6a0]
mov eax, dword [eax]
call fcn.00402568
mov eax, 0x104
call fcn.00402548
mov edx, dword [0x41d6d0]
mov dword [edx], eax
push 0x104
mov eax, dword [0x41d6d0]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea eax, [ebp - 0x38]
mov edx, dword [0x41d6d0]
mov edx, dword [edx]
call fcn.00403f40
mov edx, dword [ebp - 0x38]
mov eax, dword [0x41d5a0]
mov ecx, 0x418384
call fcn.00404004
mov eax, dword [0x41d6d0]
mov eax, dword [eax]
call fcn.00402568
lea edx, [ebp - 0x3c]
mov eax, 1
call fcn.00402808
mov eax, dword [ebp - 0x3c]
mov edx, 0x419eac
call fcn.00404104
jne 0x417fa9
lea edx, [ebp - 0x40]
mov eax, 3
call fcn.00402808
mov eax, dword [ebp - 0x40]
mov edx, 0x419eb8
call fcn.00404104
jne 0x417f6f
mov eax, dword [0x41d61c]
mov edx, dword [0x41d5a0]
mov edx, dword [edx]
call fcn.00403e64
jmp 0x417f81
mov eax, dword [0x41d61c]
mov edx, dword [0x41d570]
mov edx, dword [edx]
call fcn.00403e64
lea edx, [ebp - 0x48]
mov eax, 2
call fcn.00402808
mov ecx, dword [ebp - 0x48]
mov edx, dword [0x41d61c]
mov edx, dword [edx]
lea eax, [ebp - 0x44]
call fcn.00404004
mov eax, dword [ebp - 0x44]
call fcn.004079d4
mov eax, 0x104
call fcn.00402548
mov edx, dword [0x41d594]
mov dword [edx], eax
mov eax, dword [0x41d594]
mov eax, dword [eax]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov eax, dword [0x41d5d4]
mov edx, dword [0x41d594]
mov edx, dword [edx]
call fcn.00403f40
mov eax, dword [0x41d624]
mov edx, 0x419ec4
call fcn.00403e64
mov eax, dword [0x41d588]
mov edx, 0x419ee8
call fcn.00403e64
mov eax, dword [0x41d554]
mov byte [eax], 1
mov eax, dword [0x41d554]
mov byte [eax + 1], 2
lea ecx, [ebp - 0x4c]
xor edx, edx
mov eax, 0x419f00
call fcn.00405ad4
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x41d6c0]
add eax, 0x10
call fcn.00403e64
mov eax, dword [0x41d5a0]
push dword [eax]
lea ecx, [ebp - 0x50]
xor edx, edx
mov eax, 0x419f14
call fcn.00405ad4
push dword [ebp - 0x50]
push 0x418384
mov eax, dword [0x41d590]
push dword [eax + 0x40]
mov eax, dword [0x41d6c0]
add eax, 0x14
mov edx, 4
call fcn.00404078
lea ecx, [ebp - 0x54]
xor edx, edx
mov eax, 0x419f24
call fcn.00405ad4
mov ecx, dword [ebp - 0x54]
mov eax, dword [0x41d6c0]
mov edx, 0x419f54
call fcn.00404004
mov eax, dword [0x41d6c0]
add eax, 4
mov edx, 0x419f94
call fcn.00403e64
mov ecx, dword [0x41d590]
mov ecx, dword [ecx + 0x3c]
mov edx, dword [0x41d570]
mov edx, dword [edx]
mov eax, dword [0x41d6c0]
add eax, 8
call fcn.00404004
mov eax, dword [0x41d5d0]
cmp byte [eax], 0
je 0x418149
mov eax, dword [0x41d624]
push dword [eax]
push 0x419fa8
mov eax, dword [0x41d588]
push dword [eax]
mov eax, dword [0x41d61c]
mov edx, 3
call fcn.00404078
mov eax, dword [0x41d624]
push dword [eax]
mov eax, dword [0x41d588]
push dword [eax]
lea ecx, [ebp - 0x58]
xor edx, edx
mov eax, 0x419fb4
call fcn.00405ad4
push dword [ebp - 0x58]
mov eax, dword [0x41d6c0]
add eax, 0xc
mov edx, 3
call fcn.00404078
mov eax, dword [0x41d6c0]
add eax, 0x18
mov edx, dword [0x41d6c0]
mov edx, dword [edx + 0xc]
call fcn.00403e64
mov eax, dword [0x41d6c0]
add eax, 0x1c
mov edx, dword [0x41d6c0]
mov edx, dword [edx + 0x10]
call fcn.00403e64
jmp 0x4181ec
mov ecx, dword [0x41d588]
mov ecx, dword [ecx]
mov edx, dword [0x41d624]
mov edx, dword [edx]
mov eax, dword [0x41d61c]
call fcn.00404004
mov eax, dword [0x41d624]
push dword [eax]
mov eax, dword [0x41d588]
push dword [eax]
push 0x419fd4
mov eax, dword [0x41d6c0]
add eax, 0xc
mov edx, 3
call fcn.00404078
mov eax, dword [0x41d5a0]
push dword [eax]
lea ecx, [ebp - 0x5c]
xor edx, edx
mov eax, 0x419fe4
call fcn.00405ad4
push dword [ebp - 0x5c]
push 0x418384
mov eax, dword [0x41d590]
push dword [eax + 0x40]
mov eax, dword [0x41d6c0]
add eax, 0x14
mov edx, 4
call fcn.00404078
mov eax, dword [0x41d6c0]
add eax, 0x18
mov edx, dword [0x41d6c0]
mov edx, dword [edx + 0xc]
call fcn.00403e64
mov eax, dword [0x41d6c0]
add eax, 0x1c
mov edx, dword [0x41d6c0]
mov edx, dword [edx + 0x10]
call fcn.00403e64
mov eax, dword [0x41d6c0]
add eax, 0x20
mov edx, dword [0x41d6c0]
mov edx, dword [edx + 0x14]
call fcn.00403e64
lea eax, [ebp - 0x60]
push eax
mov edx, dword [0x41d61c]
mov edx, dword [edx]
mov ecx, 0x419ff4
mov eax, 2
call fcn.00407f7c
mov edx, dword [ebp - 0x60]
mov eax, dword [0x41d584]
call fcn.00403e64
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [0x41d588]
mov eax, dword [eax]
mov ecx, 0xf
mov edx, 2
call fcn.00404218
mov ecx, dword [ebp - 0x68]
mov edx, dword [0x41d61c]
mov edx, dword [edx]
mov eax, 2
call fcn.00407f7c
mov edx, dword [ebp - 0x64]
mov eax, dword [0x41d61c]
call fcn.00403e64
lea eax, [ebp - 0x6c]
push eax
mov edx, dword [0x41d61c]
mov edx, dword [edx]
mov ecx, 0x41a008
mov eax, 2
call fcn.00407f7c
mov edx, dword [ebp - 0x6c]
mov eax, dword [0x41d630]
call fcn.00403e64
mov eax, dword [0x41d584]
push dword [eax]
push 0x41a024
mov eax, dword [0x41d61c]
push dword [eax]
push 0x41a024
mov eax, dword [0x41d630]
push dword [eax]
mov eax, dword [0x41d584]
mov edx, 5
call fcn.00404078
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x41a030
mov edx, 0x41a04c
mov eax, 2
call fcn.00407f7c
mov edx, dword [ebp - 0x70]
mov eax, dword [0x41d560]
call fcn.00403e64
mov eax, dword [0x41d618]
mov dword [eax], 0x64
mov eax, 0x104
call fcn.00402548
mov edx, dword [0x41d688]
mov dword [edx], eax
mov eax, dword [0x41d618]
push eax
mov eax, dword [0x41d688]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [0x41d618]
mov dword [eax], 0x64
mov eax, 0x104
call fcn.00402548
mov edx, dword [0x41d654]
mov dword [edx], eax
mov eax, dword [0x41d618]
push eax
mov eax, dword [0x41d654]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
call fcn.00405d68
call fcn.004143cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418371
lea eax, [ebp - 0x70]
mov edx, 0x18
call fcn.00403e34
ret