The botnet looks down, thks to all.
1. GetUserNameA -> UserName↑ Very important information. Thank you.
2. LookupAccountNameA for UserName -> SID
3. Get "InstallDate" from "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" -> InstallDate
4. Buffer = SID + InstallDate + UserName
5. MD5(Buffer)
Result: 5F1616138920D0313952D7FFC480B759
5F161613 it's first part of MD5