Function at 0x4616fe
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46818b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x182c
call fcn.0043b7f0
and dword [esp + 4], 0
push ebx
push esi
push edi
push 0x3ff
lea eax, [esp + 0x35]
push 0
push eax
mov byte [esp + 0x3c], 0
call fcn.0043b5d0
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 0xc
push edi
push 0x46f2ac
call esi
test eax, eax
je 0x461b99
push edi
push str.lang
call esi
test eax, eax
je 0x461b99
push edi
push str.btag1
call esi
test eax, eax
jne 0x461787
mov eax, dword [ebp + 0x14]
add eax, 0x21c
jmp 0x461ba1
push edi
push str.btag2
call esi
test eax, eax
jne 0x4617a0
mov eax, dword [ebp + 0x14]
add eax, 0x41c
jmp 0x461ba1
push edi
push str.btag3
call esi
test eax, eax
jne 0x4617b9
mov eax, dword [ebp + 0x14]
add eax, 0x61c
jmp 0x461ba1
push edi
push str.btag4
call esi
test eax, eax
jne 0x4617d2
mov eax, dword [ebp + 0x14]
add eax, 0x81c
jmp 0x461ba1
push edi
push str.btag5
call esi
test eax, eax
jne 0x4617eb
mov eax, dword [ebp + 0x14]
add eax, 0xa1c
jmp 0x461ba1
push edi
push str.btagAB
call esi
test eax, eax
jne 0x461802
mov eax, dword [ebp + 0x14]
add eax, 4
jmp 0x461ba1
push edi
push str.region
call esi
test eax, eax
jne 0x46181b
mov eax, dword [ebp + 0x14]
add eax, 0x1128
jmp 0x461ba1
push edi
push str.name
call esi
test eax, eax
jne 0x46183a
mov eax, dword [ebp + 0x14]
add eax, 0x9cdc
push eax
push 0x46f2f0
jmp 0x461ba7
push edi
push str.local_machinename
call esi
test eax, eax
jne 0x461862
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x46192c
push edi
push str.local_username
call esi
test eax, eax
jne 0x46188f
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esp + 0x10]
dec eax
jmp 0x461bb5
push edi
mov ebx, 0x46f318
push ebx
call esi
test eax, eax
jne 0x4618e1
mov eax, dword [ebp + 0x14]
add eax, 0x9cdc
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.00401966
pop ecx
push 0
push ebx
mov esi, eax
push esi
call fcn.00460354
add esp, 0xc
mov edi, eax
push edi
lea eax, [esp + 0x34]
push 0x46f2f0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
mov dword [esp + 0x14], eax
call fcn.0043756e
pop ecx
jmp 0x461925
push edi
mov ebx, 0x46eb98
push ebx
call esi
test eax, eax
jne 0x461935
mov eax, dword [ebp + 0x14]
add eax, 0x9cdc
push eax
mov eax, str.SoftwareMGSThumperCasino
call fcn.00401966
pop ecx
mov esi, eax
push ebx
push esi
xor eax, eax
call fcn.004601f5
push eax
lea eax, [esp + 0x3c]
push 0x46db18
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [esp + 0x10], eax
push esi
call fcn.0043756e
pop ecx
mov eax, dword [esp + 0x10]
jmp 0x461bb5
push edi
mov ebx, str.userguid
push ebx
call esi
test eax, eax
je 0x461b6b
push edi
push 0x46f324
call esi
test eax, eax
je 0x461b6b
push edi
push str.hddid
call esi
test eax, eax
je 0x461b0b
push edi
push 0x46f330
call esi
test eax, eax
je 0x461b0b
push edi
push str.casinoid
call esi
test eax, eax
je 0x461afd
push edi
push str.serverid
call esi
test eax, eax
je 0x461afd
push edi
push str.pcmversion
call esi
test eax, eax
jne 0x4619af
mov eax, dword [ebp + 0x14]
add eax, 0x9a58
jmp 0x46182f
push edi
push str.PCMGUID
call esi
test eax, eax
jne 0x4619c8
mov eax, dword [ebp + 0x14]
add eax, 0x9958
jmp 0x46182f
push edi
push str.RegistryPCMGUID
call esi
test eax, eax
jne 0x4619e1
mov eax, dword [ebp + 0x14]
add eax, 0x99d8
jmp 0x46182f
push edi
push str.EmbeddedPCMGUID
call esi
test eax, eax
jne 0x4619fc
mov eax, dword [0x48e8ec]
add eax, 0xe1c
jmp 0x461ba1
push edi
push str.SerialNumber
call esi
test eax, eax
jne 0x461a15
mov eax, dword [ebp + 0x14]
add eax, 0x9ad8
jmp 0x46182f
push edi
push str.RunNumber
call esi
test eax, eax
jne 0x461a2e
mov eax, dword [ebp + 0x14]
add eax, 0x9b58
jmp 0x46182f
push edi
push str.bytesDownloaded
call esi
test eax, eax
jne 0x461a6e
push 0xffffffffffffffff
push dword [0x48e8e0]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x461a63
mov esi, dword [0x48e2a4]
push dword [0x48e8e0]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push 0x46db18
jmp 0x461ba7
push edi
push str.percentDownloaded
call esi
test eax, eax
jne 0x461a9c
push 0xffffffffffffffff
push dword [0x48e29c]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x461a63
mov esi, dword [0x48e8d8]
push dword [0x48e29c]
jmp 0x461a5d
push edi
push str.PCMHardwareInfo
call esi
test eax, eax
jne 0x461ae0
xor esi, esi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.004603c7
test eax, eax
je 0x461acf
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x18]
call fcn.0045f3fa
add esp, 4
mov esi, eax
push dword [esp + 0x14]
call fcn.0043756e
pop ecx
mov eax, esi
jmp 0x461bd6
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 0x9cdc]
push ecx
add eax, 0x9ddc
call fcn.00401966
pop ecx
push 0
push edi
jmp 0x4618b3
mov eax, dword [ebp + 0x14]
push dword [eax + 0x9bd8]
jmp 0x461a64
mov byte [esp + 0x14], 0
xor eax, eax
lea edi, [esp + 0x15]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esi, [esp + 0x14]
stosb byte es:[edi], al
call fcn.004574d7
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov byte [esp + 0x1c], 0
lea edi, [esp + 0x1d]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
lea ebx, [esp + 0x1c]
movzx eax, byte [esp + edi + 0x14]
push eax
push str._2.2X
push ebx
call esi
add esp, 0xc
inc edi
add ebx, 2
cmp edi, 8
jl 0x461b3e
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push 0x46f2f0
push eax
call esi
jmp 0x461bb2
push SysReAllocStringLen
mov ecx, str.SoftwareMicrosoftMultimedia
lea eax, [esp + 0x434]
call fcn.00457060
and dword [esp + 0x1844], 0
push ebx
mov ecx, 0x46daf4
call fcn.00457483
jmp 0x46182f
mov eax, dword [ebp + 0x14]
add eax, 0x1140
push eax
push 0x46eba0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test eax, eax
je 0x461bd4
cmp byte [esp + 0x30], 0
je 0x461bd4
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x34]
call fcn.0045f3fa
add esp, 4
jmp 0x461bd6
xor eax, eax
mov ecx, dword [esp + 0x183c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10