Function at 0x468091
Capabilities:
Get hostname
Get session user name

Disassembly:
mov eax, 0x46fe84
call fcn.0046f35c
mov eax, 0x2c48
call fcn.0043cfb0
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
push 0x3ff
lea eax, [ebp - 0x433]
push 0
push eax
mov byte [ebp - 0x434], 0
call fcn.0043cdc0
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 0xc
push edi
push 0x477f58
call esi
test eax, eax
je 0x4685f1
push edi
push str.lang
call esi
test eax, eax
je 0x4685f1
push edi
push str.btag1
call esi
test eax, eax
jne 0x46810b
mov eax, dword [ebp + 0x14]
add eax, 0x41c
jmp 0x4685f9
push edi
push str.btag2
call esi
test eax, eax
jne 0x468124
mov eax, dword [ebp + 0x14]
add eax, 0x61c
jmp 0x4685f9
push edi
push str.btag3
call esi
test eax, eax
jne 0x46813d
mov eax, dword [ebp + 0x14]
add eax, 0x81c
jmp 0x4685f9
push edi
push str.btag4
call esi
test eax, eax
jne 0x468156
mov eax, dword [ebp + 0x14]
add eax, 0xa1c
jmp 0x4685f9
push edi
push str.btag5
call esi
test eax, eax
jne 0x46816f
mov eax, dword [ebp + 0x14]
add eax, 0xc1c
jmp 0x4685f9
push edi
push 0x477f84
call esi
test eax, eax
jne 0x468188
mov eax, dword [ebp + 0x14]
add eax, 0x204
jmp 0x4685f9
push edi
push 0x477f8c
call esi
test eax, eax
jne 0x46819f
mov eax, dword [ebp + 0x14]
add eax, 4
jmp 0x4685f9
push edi
push 0x477f9c
call esi
test eax, eax
jne 0x4681b8
mov eax, dword [ebp + 0x14]
add eax, 0x1328
jmp 0x4685f9
push edi
push str.name
call esi
test eax, eax
jne 0x4681d7
mov eax, dword [ebp + 0x14]
add eax, 0xa8de
push eax
push 0x477fac
jmp 0x4685ff
push edi
push str.local_machinename
call esi
test eax, eax
jne 0x4681ff
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x4682f5
push edi
push str.local_username
call esi
test eax, eax
jne 0x46822b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [ebp - 0x14]
dec eax
jmp 0x46860f
push edi
mov ebx, 0x477fd4
push ebx
call esi
test eax, eax
jne 0x46828e
mov eax, dword [ebp + 0x14]
add eax, 0xa8de
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.0040335a
pop ecx
xor esi, esi
mov edi, eax
push esi
push SysReAllocStringLen
mov ecx, edi
lea eax, [ebp - 0x1844]
call fcn.0045daf3
push esi
xor edx, edx
push ebx
inc edx
mov ecx, 0x476484
mov dword [ebp - 4], esi
call fcn.0045e00f
push eax
lea eax, [ebp - 0x434]
push 0x477fac
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
jmp 0x4682ec
push edi
mov ebx, 0x477780
push ebx
call esi
test eax, eax
jne 0x4682fd
mov eax, dword [ebp + 0x14]
add eax, 0xa8de
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.0040335a
pop ecx
mov esi, eax
push 0
push SysReAllocStringLen
mov ecx, esi
lea eax, [ebp - 0x1844]
call fcn.0045daf3
push ebx
push eax
xor eax, eax
mov dword [ebp - 4], 1
call fcn.0045dfe1
push eax
push 0x476570
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
mov dword [ebp - 0x14], eax
call fcn.00437ff5
pop ecx
mov eax, dword [ebp - 0x14]
jmp 0x46860f
push edi
mov ebx, 0x477748
push ebx
call esi
test eax, eax
je 0x4685be
push edi
push 0x477fe0
call esi
test eax, eax
je 0x4685be
push edi
push str.hddid
call esi
test eax, eax
je 0x468563
push edi
push 0x477fec
call esi
test eax, eax
je 0x468563
push edi
push str.casinoid
call esi
test eax, eax
je 0x468555
push edi
push str.serverid
call esi
test eax, eax
je 0x468555
push edi
push str.pcmversion
call esi
test eax, eax
jne 0x468377
mov eax, dword [ebp + 0x14]
add eax, 0xa458
jmp 0x4681cc
push edi
push str.PCMGUID
call esi
test eax, eax
jne 0x468390
mov eax, dword [ebp + 0x14]
add eax, 0xa358
jmp 0x4681cc
push edi
push str.RegistryPCMGUID
call esi
test eax, eax
jne 0x4683a9
mov eax, dword [ebp + 0x14]
add eax, 0xa3d8
jmp 0x4681cc
push edi
push str.EmbeddedPCMGUID
call esi
test eax, eax
jne 0x4683c4
mov eax, dword [0x49a8cc]
add eax, 0x101c
jmp 0x4685f9
push edi
push str.SerialNumber
call esi
test eax, eax
jne 0x4683dd
mov eax, dword [ebp + 0x14]
add eax, 0xa6da
jmp 0x4681cc
push edi
push str.RunNumber
call esi
test eax, eax
jne 0x4683f6
mov eax, dword [ebp + 0x14]
add eax, 0xa75a
jmp 0x4681cc
push edi
push str.operatorvaultid
call esi
test eax, eax
jne 0x46840f
mov eax, dword [ebp + 0x14]
add eax, 0x10a0c
jmp 0x4681cc
push edi
push str.VaultGroup
call esi
test eax, eax
jne 0x468428
mov eax, dword [ebp + 0x14]
add eax, 0x1130b
jmp 0x4681cc
push edi
push str.VaultName
call esi
test eax, eax
jne 0x468441
mov eax, dword [ebp + 0x14]
add eax, 0x1140a
jmp 0x4681cc
push edi
push str.caps
call esi
test eax, eax
jne 0x46845a
mov eax, dword [ebp + 0x14]
add eax, 0x11509
jmp 0x4681cc
push edi
push str.bytesDownloaded
call esi
test eax, eax
jne 0x46849a
push 0xffffffffffffffff
push dword [0x49a8c0]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46848f
mov esi, dword [0x49a284]
push dword [0x49a8c0]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push 0x476570
jmp 0x4685ff
push edi
push str.percentDownloaded
call esi
test eax, eax
jne 0x4684c8
push 0xffffffffffffffff
push dword [0x49a27c]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46848f
mov esi, dword [0x49a8b8]
push dword [0x49a27c]
jmp 0x468489
push edi
push str.PCMHardwareInfo
call esi
test eax, eax
jne 0x468508
xor esi, esi
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x14], esi
call fcn.00466f71
test eax, eax
je 0x4684f8
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
call fcn.0046576a
add esp, 4
mov esi, eax
push dword [ebp + 0x14]
call fcn.00437ff5
pop ecx
mov eax, esi
jmp 0x468634
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 0xa8de]
push ecx
add eax, 0xa9de
call fcn.0040335a
pop ecx
mov esi, eax
push 0
push SysReAllocStringLen
mov ecx, esi
lea eax, [ebp - 0x2c54]
call fcn.0045daf3
push 0
xor edx, edx
push edi
inc edx
mov ecx, 0x476484
mov dword [ebp - 4], 3
call fcn.0045e00f
push eax
push 0x477fac
jmp 0x4682db
mov eax, dword [ebp + 0x14]
push dword [eax + 0xa7da]
jmp 0x468490
mov byte [ebp - 0x1c], 0
xor eax, eax
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esi, [ebp - 0x1c]
stosb byte es:[edi], al
call fcn.0045e0ec
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov byte [ebp - 0x30], 0
lea edi, [ebp - 0x2f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
lea ebx, [ebp - 0x30]
movzx eax, byte [ebp + edi - 0x1c]
push eax
push str._2.2X
push ebx
call esi
add esp, 0xc
inc edi
add ebx, 2
cmp edi, 8
jl 0x468590
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x434]
push 0x477fac
push eax
call esi
jmp 0x46860c
push 0
push SysReAllocStringLen
mov ecx, str.SoftwareMicrosoftMultimedia
lea eax, [ebp - 0x2c54]
call fcn.0045daf3
push 0
xor edx, edx
push ebx
inc edx
mov ecx, 0x476484
mov dword [ebp - 4], 2
call fcn.0045e00f
jmp 0x4681cc
mov eax, dword [ebp + 0x14]
add eax, 0x1340
push eax
push 0x477764
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test eax, eax
je 0x468632
cmp byte [ebp - 0x434], 0
je 0x468632
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x434]
call fcn.0046576a
add esp, 4
jmp 0x468634
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10