Function at 0x48ec10
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519c0a
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x584f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], 0
mov eax, dword fs:[0x2c]
mov edx, dword [0x5e2e08]
mov esi, dword [eax + edx*4]
mov eax, dword [0x58ac38]
cmp eax, dword [esi + 4]
jg 0x48f204
push 0x2a5e
push str.Ver98
push 0x538e58
mov ecx, 0x58ac28
call fcn.004e8f20
cmp eax, 0x9830
je 0x48ec98
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x58ac44]
cmp eax, dword [esi + 4]
jg 0x48f26d
mov eax, dword [0x58ac4c]
cmp eax, dword [esi + 4]
jg 0x48f2ac
mov eax, dword [0x58ac54]
cmp eax, dword [esi + 4]
jg 0x48f2e7
mov eax, dword [0x58ac5c]
cmp eax, dword [esi + 4]
jg 0x48f322
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push dword [0x58ac50]
mov esi, dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__16]
lea eax, [ebp - 0x14]
push dword [0x58ac48]
mov dword [ebp - 4], 2
push str._04d__02d
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push dword [0x58ac58]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push str._02d
push eax
call esi
add esp, 0xc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x10]
push 7
push str.Disable
mov dword [ebp - 0x18], 0x10
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x30
push dword [eax - 0xc]
push eax
push 0xb
lea eax, [ebp - 0x20]
push str.HProMICS_R_
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.004efee0
add esp, 0x1c
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0
push str.DeveloperOnly
push 0x538e58
mov ecx, 0x58ac28
call fcn.004e8f20
cmp eax, 0xe59e
jne 0x48f104
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x10]
push 7
push str.Disable
mov dword [ebp - 0x18], 0x40
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0xc0
push dword [eax - 0xc]
push eax
push 0xb
lea eax, [ebp - 0x24]
push str.HProMICS_D_
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call fcn.004efee0
add esp, 0x1c
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 8
push eax
push 0x400
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x2c], 0x400
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 9
push eax
push 0x400
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x2c], 0x400
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
push str.DeveloperName
push str.DeveloperUser
push 0x538e58
lea eax, [ebp - 0x30]
mov ecx, 0x58ac28
push eax
call fcn.004eaee0
push dword [ebp - 0x30]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__25]
test eax, eax
jne 0x48efbc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xb
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x10]
push 7
push str.Disable
mov dword [ebp - 0x18], 0x100
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xc
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x300
push dword [eax - 0xc]
push eax
push 0xb
lea eax, [ebp - 0x28]
push str.HProMICS_U_
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.004efee0
add esp, 0x1c
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x30]
mov dword [ebx + 0x878], 1
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x48f0d2
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 9
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [ebp - 0x20]
xor esi, esi
xor edi, edi
cmp dword [eax - 0xc], esi
jle 0x48efed
push edi
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_1653]
movzx eax, ax
inc edi
add esi, eax
mov eax, dword [ebp - 0x20]
cmp edi, dword [eax - 0xc]
jl 0x48efd5
mov eax, dword [ebp - 0x1c]
xor edi, edi
shl esi, 0x10
cmp dword [eax - 0xc], edi
jle 0x48f018
nop word [eax + eax]
push edi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1653]
movzx eax, ax
inc edi
add esi, eax
mov eax, dword [ebp - 0x1c]
cmp edi, dword [eax - 0xc]
jl 0x48f000
push 0x58585858
push str.Flag
push 0x53db70
mov ecx, 0x58ac28
call fcn.004e8f20
cmp esi, eax
jne 0x48f0ee
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xd
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x10]
push 7
push str.Disable
mov dword [ebp - 0x18], 1
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xe
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 3
push dword [eax - 0xc]
push eax
push 0xb
lea eax, [ebp - 0x30]
push str.HProMICS_C_
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
push dword [ebp - 0x28]
push dword [ebp - 0x30]
call fcn.004efee0
add esp, 0x1c
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebx + 0x878], 1
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esi, 1
jmp 0x48f1de
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x58585858
push str.Transitory
push str.DoNotSave
mov ecx, 0x58ac28
call fcn.004e8f20
mov ebx, eax
mov ecx, 0x58ac28
lea edx, [ebx + 1]
push edx
push str.Transitory
push str.DoNotSave
call fcn.004f8310
test bl, 1
jne 0x48f1dc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xf
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x10]
push 7
push str.Disable
mov dword [ebp - 0x18], 4
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x10
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0xc
push dword [eax - 0xc]
push eax
push 0xb
lea eax, [ebp - 0x30]
push str.HProMICS_T_
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.004efee0
add esp, 0x1c
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x878], 1
xor esi, esi
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x58ac38
call fcn.00506c7e
add esp, 4
cmp dword [0x58ac38], 0xffffffff
jne 0x48ec64
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
call fcn.004ea930
add esp, 4
push dword [eax]
mov ecx, 0x58ac28
mov byte [ebp - 4], 1
call fcn.00485a30
lea ecx, [ebp - 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x52fc30
call fcn.00506bed
push 0x58ac38
mov dword [ebp - 4], 0xffffffff
call fcn.00506c2d
add esp, 8
jmp 0x48ec64
push 0x58ac44
call fcn.00506c7e
add esp, 4
cmp dword [0x58ac44], 0xffffffff
jne 0x48eca9
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push 0x58ac44
mov dword [0x58ac3c], eax
mov dword [0x58ac40], edx
call fcn.00506c2d
add esp, 8
jmp 0x48eca9
push 0x58ac4c
call fcn.00506c7e
add esp, 4
cmp dword [0x58ac4c], 0xffffffff
jne 0x48ecba
mov ecx, 0x58ac3c
call fcn.004b4190
push 0x58ac4c
mov dword [0x58ac48], eax
call fcn.00506c2d
add esp, 4
jmp 0x48ecba
push 0x58ac54
call fcn.00506c7e
add esp, 4
cmp dword [0x58ac54], 0xffffffff
jne 0x48eccb
mov ecx, 0x58ac3c
call fcn.004ab1e0
push 0x58ac54
mov dword [0x58ac50], eax
call fcn.00506c2d
add esp, 4
jmp 0x48eccb
push 0x58ac5c
call fcn.00506c7e
add esp, 4
cmp dword [0x58ac5c], 0xffffffff
jne 0x48ecdc
mov ecx, 0x58ac3c
call fcn.004a12b0
push 0x58ac5c
mov dword [0x58ac58], eax
call fcn.00506c2d
add esp, 4
jmp 0x48ecdc