Function at 0x10001e4b
Capabilities:
Get hostname
Get local ipv4 addresses
Get memory capacity
Get session user name
Get socket information
Get system information on windows
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3dc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x10
lea esi, [eax + 0x10]
pop edi
mov dword [eax], 0xf
push edi
lea eax, [ebp - 0x1c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
lea eax, [ebp - 0x18]
push 4
push eax
push esi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ebx, 0x100
lea eax, [ebp - 0x3dc]
push ebx
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x10001f69
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
mov dword [ebp + 8], eax
je 0x10001f69
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
and dword [ebp + 0xc], 0
add ecx, dword [edx]
cmp ecx, dword [eax]
jae 0x10001f69
and byte [ebp - 0xc0], 0
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0xbf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
mov eax, dword [edx + eax*4]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0xc0]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0xc0]
push str.127.0.0.1
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0x10
test eax, eax
jne 0x10001f45
mov eax, dword [ebp + 8]
inc dword [ebp + 0xc]
mov edi, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
movsx ecx, word [eax + 0xa]
mov edi, dword [edx + edi*4]
add edi, ecx
cmp edi, dword [eax]
jb 0x10001ee0
jmp 0x10001f69
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 4
mov eax, dword [eax + 0xc]
mov edi, dword [eax + ecx*4]
push edi
push esi
call sub.MSVCRT.dll_memcpy
push 4
lea eax, [ebp - 0x1c]
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x18
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x3c], 0
push 7
lea edi, [ebp - 0x38]
mov dx, word [eax + 0x204]
pop ecx
xor eax, eax
push edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x1dc]
mov edi, 0x9c
push eax
mov dword [ebp - 0x1dc], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x1dc]
push edi
push eax
lea eax, [esi + 0xc]
push eax
call sub.MSVCRT.dll_memcpy
and dword [ebp - 0x60], 0
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x5c]
push 8
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.10002108
mov dword [esi + 4], eax
mov al, byte [ebp - 0x4c]
mov byte [esi + 8], al
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x78]
and byte [ebp - 0x2dc], 0
push 0x3f
mov dword [esi + 0x1e8], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x2db]
mov dword [ebp - 0xc], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edi, 0x80
lea eax, [ebp - 0x2dc]
push edi
push eax
lea eax, [esi + 0xa8]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x2dc]
push eax
call fcn.10001e25
add esp, 0x10
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], edi
lea eax, [ebp - 4]
lea edi, [esi + 0x128]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push edi
call fcn.10001e25
pop ecx
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x28], eax
lea eax, [esi + 0x210]
push str.____
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + 0x220]
push ebx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
and byte [ebp - 0x140], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x13f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x100020c6
lea eax, [edi + 0x680]
push eax
jmp 0x100020cb
push str.Default
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x140]
add esi, 0x1a8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x3c]
push 0x20
add edi, 0x1e0
push eax
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret