Function at 0x1010180
Capabilities:
Get hostname
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x710
mov rax, qword [0x010667f0]
xor rax, rsp
mov qword [rsp + 0x708], rax
call fcn.01011030
movzx eax, word [0x01001c50]
mov word [rsp + 0x60], ax
lea rax, [rsp + 0x62]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x5e0], ax
lea rax, [rsp + 0x5e2]
mov rdi, rax
xor eax, eax
mov ecx, 0x106
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x460], ax
lea rax, [rsp + 0x462]
mov rdi, rax
xor eax, eax
mov ecx, 0x106
rep stosb byte [rdi], al
mov dword [rsp + 0x598], 0
mov dword [rsp + 0x570], 0
mov qword [rsp + 0x50], 0
lea rax, [0x01001c30]
mov qword [rsp + 0x578], rax
lea rax, [0x0103e8d0]
mov qword [rsp + 0x580], rax
mov qword [rsp + 0x588], 0
mov qword [rsp + 0x590], 0
mov dword [rsp + 0x5a0], 0
call fcn.0105a2a0
test eax, eax
jne 0x101027b
xor eax, eax
jmp 0x1010b89
mov r8d, 0x1b30
xor edx, edx
lea rcx, [0x01066e00]
call sub.MSVCR80.dll_memset
mov dword [0x010689c0], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x01069048], rax
mov rcx, qword [0x01069048]
call sub.SqlResourceLoader.dll_LoadResourceLibrary
mov qword [0x01069158], rax
cmp qword [0x01069158], 0
jne 0x10102cc
xor eax, eax
jmp 0x1010b89
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x59c], eax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rsp + 0x59c], eax
lea rcx, [fcn.01057570]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [rsp + 0x570], 0x10
lea rdx, [rsp + 0x570]
lea rcx, [0x01068bf8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [0x010689c0], 0
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, 0x12
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r8, [0x01001c10]
lea rdx, [0x01001c30]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01066bf0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066bc8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066ba0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066b78]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066b50]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066b28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066b00]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066ad8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066ab0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066a88]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066a60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066a38]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066a10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x010669e8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01066968]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [rsp + 0x5a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x5c8]
mov dword [0x010689ec], eax
mov edx, 1
lea rcx, [0x01066870]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x10104e9
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [0x01066870]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x10104dd
mov dword [0x01066898], 0x18
lea rax, [0x01066870]
mov qword [0x010668a0], rax
mov dword [0x010668a8], 0
lea rax, [0x01066898]
mov qword [0x010668b0], rax
jmp 0x10104e7
jmp 0x10109a6
jmp 0x10104f3
jmp 0x10109a6
call qword [sym.imp.SQLSVC.dll_SQLSvcInit]
test eax, eax
jne 0x1010507
jmp 0x10109a6
xor r8d, r8d
lea rdx, [0x01001bf0]
mov ecx, 3
call fcn.01010bb0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1010555
lea rdx, [0x01001bd8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01069178], rax
cmp qword [0x01069178], 0
jne 0x1010555
jmp 0x10109a6
mov ecx, 1
call fcn.01014f70
mov qword [0x010693a8], rax
cmp dword [0x010693a0], 2
jne 0x10105b2
cmp qword [0x010693a8], 0
jne 0x10105b2
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, 0x78
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [rsp + 0x60]
lea rcx, [0x01001bcc]
call qword [sym.imp.MSVCR80.dll_wprintf]
jmp 0x10109a6
lea rax, [rsp + 0x460]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5e0]
lea r8, [0x010689e8]
mov rdx, qword [rsp + 0x728]
mov ecx, dword [rsp + 0x720]
call fcn.01011510
test eax, eax
jne 0x10105f0
jmp 0x10109a6
mov eax, dword [0x010689e8]
and eax, 0x20
cmp eax, 0x20
jne 0x1010614
cmp dword [0x010689c0], 0
jne 0x1010614
mov dword [rsp + 0x6f4], 0
jmp 0x101061f
mov dword [rsp + 0x6f4], 1
mov eax, dword [rsp + 0x6f4]
mov dword [0x010689c8], eax
movzx eax, word [rsp + 0x460]
test eax, eax
je 0x101064a
lea rax, [rsp + 0x460]
mov qword [rsp + 0x6f8], rax
jmp 0x1010656
mov qword [rsp + 0x6f8], 0
movzx eax, word [rsp + 0x5e0]
test eax, eax
je 0x1010674
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x700], rax
jmp 0x1010680
mov qword [rsp + 0x700], 0
mov r8, qword [rsp + 0x6f8]
mov rdx, qword [rsp + 0x700]
lea rcx, [0x01066e00]
call fcn.01037640
mov eax, dword [0x010689e8]
and eax, 1
test eax, eax
jne 0x10106b6
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov dword [rsp + 0x598], eax
xor edx, edx
mov ecx, 0x3ff
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [rsp + 0x598], eax
mov r8d, 0x104
lea rdx, [0x010689f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov word [0x01068bf6], 0
lea rcx, [0x010689f0]
call fcn.01036830
mov r8d, 0xa
mov edx, 0xeb0
lea rcx, [0x01066dc8]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x148
lea rcx, [0x01066d98]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x28
lea rcx, [0x01066d68]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x1020
lea rcx, [0x01066d38]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 8
mov edx, 0x588
lea rcx, [0x01066d08]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x20
lea rcx, [0x01066cd8]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x40
lea rcx, [0x01066ca8]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 5
mov edx, gethostbyname
lea rcx, [0x01066c78]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x104
lea rcx, [0x01066c48]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x8b0
lea rcx, [0x01066c18]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov eax, dword [0x010689e8]
and eax, 1
test eax, eax
jne 0x1010922
lea rcx, str.MSSQLSERVER
call sub.instapi10.dll_IsDefaultInstanceName
test eax, eax
je 0x1010816
lea rax, [0x01001c30]
mov qword [rsp + 0x578], rax
jmp 0x1010850
mov dword [rsp + 0x6f0], 0x84
lea r9, [rsp + 0x6f0]
lea r8, [0x01068e30]
mov edx, 1
lea rcx, str.MSSQLSERVER
call sub.instapi10.dll_GetSQLServiceByName
lea rax, [0x01068e30]
mov qword [rsp + 0x578], rax
lea rcx, [rsp + 0x578]
call fcn.0103e880
test eax, eax
je 0x101087b
mov dword [rsp + 0x5a0], 1
mov dword [0x01065108], 0
jmp 0x101091d
cmp dword [rsp + 0x720], 1
jne 0x10108b6
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, SQLFreeStmt
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [0x01001c30]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wprintf]
jmp 0x101091d
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
mov edx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wprintf]
call qword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
mov r9d, 2
mov r8d, 0xc0000064
mov edx, 1
mov ecx, 1
call fcn.010341e0
jmp 0x10109a6
call fcn.01011b40
test eax, eax
jne 0x101092f
jmp 0x10109a6
lea r9, [0x01001c30]
mov r8d, 0x5e
xor edx, edx
mov ecx, 4
call fcn.01034b80
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov edx, 1
lea rcx, [0x01013a20]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.010122e0
test eax, eax
je 0x10109a6
call fcn.010134d0
test eax, eax
je 0x10109a6
mov edx, 0xffffffff
mov rcx, qword [0x01068930]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.01019040
mov ecx, SQLFreeStmt
call fcn.0102fd70
mov dword [0x01065108], 0
call fcn.01011190
cmp dword [rsp + 0x5a0], 0
jne 0x10109b5
call fcn.01011220
call qword [sym.imp.SQLSVC.dll_SQLSvcExit]
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, 0xf2
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x01001c30]
mov r8d, 0x62
xor edx, edx
mov ecx, 4
call fcn.01034b80
call fcn.01031a70
mov rcx, qword [0x010693a8]
call fcn.01015920
lea rcx, [0x01066bc8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066ba0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066b78]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066b50]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066b28]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066b00]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066ad8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066ab0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066a88]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066a60]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066a38]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x010669e8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066968]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01066a10]
call qword [0x01069178]
test eax, eax
jne 0x1010af9
cmp dword [0x010689c0], 0
je 0x1010aec
cmp dword [0x01068484], 0
je 0x1010aec
lea rdx, [0x01001bc0]
lea rcx, [0x01001b80]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01066a10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x010689c0], 0
je 0x1010b1f
cmp dword [0x01068484], 0
je 0x1010b1f
lea rdx, [0x01001bc0]
lea rcx, [0x01001b48]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01066a10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x010689c0], 0
je 0x1010b52
cmp dword [0x01068484], 0
je 0x1010b52
lea rdx, [0x01001bc0]
lea rcx, [0x01001b10]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01066a10]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [0x01069158]
call sub.SqlResourceLoader.dll_FreeResourceLibrary
cmp qword [rsp + 0x50], 0
je 0x1010b7e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.010574b0
mov eax, dword [0x01065108]
mov rcx, qword [rsp + 0x708]
xor rcx, rsp
call fcn.01059ab0
add rsp, 0x710
pop rdi
ret