Function at 0x5113b0
Capabilities:
Get hostname
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c8
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0x6bc], edx
cmp word [edi], 0
je 0x51168b
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll_wcschr]
push esi
mov edi, edi
movzx eax, word [edi]
push eax
push 0x593134
call ebx
add esp, 8
test eax, eax
je 0x511408
movzx eax, word [edi + 2]
add edi, 2
push eax
push 0x593134
call ebx
add esp, 8
test eax, eax
jne 0x5113f2
cmp word [edi], 0
je 0x511689
lea eax, [edi + 2]
push 0x593134
push eax
call dword [sym.imp.MSVCR120.dll_wcscspn]
lea ebx, [eax + 1]
lea esi, [ebx + ebx]
push esi
lea eax, [ebp - 0x2b4]
push edi
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0x14
cmp esi, 0x200
jae 0x51169a
xor eax, eax
add edi, esi
mov word [ebp + esi - 0x2b4], ax
cmp ebx, 1
jbe 0x511679
mov esi, dword [ebp - 0x6bc]
mov eax, esi
mov dword [ebp - 0x6c4], 0xf
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x511470
sub eax, edx
sar eax, 1
add eax, eax
push eax
push esi
push 0
lea eax, [ebp - 0x2b4]
push eax
push 0
call fcn.0054fcdc
test eax, eax
je 0x511679
lea eax, [ebp - 0x6c4]
mov byte [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [ebp - 0x14]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5114b6
sub ecx, edx
lea eax, [ebp - 0x14]
cmp ecx, 0x404
jae 0x5114e2
push eax
lea eax, [ebp - 0x6b8]
push 0x404
push eax
call dword [sym.imp.MSVCR120.dll_strcpy_s]
add esp, 0xc
jmp 0x511504
push 0x403
push eax
lea eax, [ebp - 0x6b8]
push 0x404
push eax
call dword [sym.imp.MSVCR120.dll_strncpy_s]
add esp, 0x10
mov byte [ebp - 0x2b5], 0
lea ecx, [ebp - 0x6b8]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x511510
sub ecx, edx
lea esi, [ebp - 0x6b8]
mov ebx, 0x404
lea eax, [ecx + 1]
sub ebx, eax
mov dword [ebp - 0x6c0], eax
add esi, eax
je 0x511557
test ebx, ebx
je 0x511557
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x2b4]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [ebx + esi - 1], 0
jmp 0x511572
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x2b4]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x511575
sub esi, ecx
mov ecx, dword [ebp - 0x6c0]
inc ecx
add ecx, esi
lea esi, [ebp - 0x6b8]
add esi, ecx
mov dword [ebp - 0x6c0], ecx
test byte [ebp + 8], 1
jne 0x5115b5
mov eax, 0x404
mov edx, esi
sub eax, ecx
mov ecx, dword [ebp - 0x6bc]
push eax
call fcn.00530280
add esp, 4
jmp 0x5115ff
mov ebx, 0x404
sub ebx, ecx
test esi, esi
je 0x5115e4
test ebx, ebx
je 0x5115e4
mov eax, dword [ebp - 0x6bc]
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [ebx + esi - 1], 0
jmp 0x5115ff
mov eax, dword [ebp - 0x6bc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x511602
lea eax, [ebp - 0x2b4]
sub esi, ecx
push eax
push str._smailslotmessngr
push 0xffffffffffffffff
lea eax, [ebp - 0xb4]
push 0x50
push eax
call dword [sym.imp.MSVCR120.dll__snwprintf_s]
add esp, 0x14
lea eax, [ebp - 0xb4]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push eax
call dword [0x5c008c]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x511679
mov ecx, dword [ebp - 0x6c0]
lea eax, [ebp - 0x6c8]
push 0
push eax
inc ecx
lea eax, [ebp - 0x6b8]
add ecx, esi
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [0x5c001c]
cmp word [edi], 0
mov ebx, dword [sym.imp.MSVCR120.dll_wcschr]
jne 0x5113e0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00553510
mov esp, ebp
pop ebp
ret
call fcn.005538fc
int3