Function at 0x4115ed
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ecx
mov dword [ebp - 4], 0x80
mov edx, dword [ebp - 0x120]
add edx, 0x5730
mov ecx, dword [ebp - 0x120]
call fcn.00410cc8
movzx eax, al
test eax, eax
je 0x4119ac
mov eax, dword [0x434ea8]
or eax, dword [0x434eac]
jne 0x411995
push 0x100
lea eax, [ebp - 0x108]
push eax
call fcn.0040103d
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
push 6
call sub.Secur32.dll_GetComputerObjectNameW
movzx eax, al
test eax, eax
je 0x411724
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jne 0x4116da
push 4
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00402b50
add esp, 0xc
mov eax, dword [ebp - 0x11c]
mov dword [0x434ea8], eax
mov eax, dword [ebp - 0x118]
mov dword [0x434eac], eax
push 0x10
lea edx, [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
call fcn.004158b4
xor ecx, ecx
xor eax, dword [0x434ea8]
xor ecx, dword [0x434eac]
mov dword [0x434ea8], eax
mov dword [0x434eac], ecx
jmp 0x41171f
mov eax, dword [ebp - 0x108]
mov dword [0x434ea8], eax
mov eax, dword [ebp - 0x104]
mov dword [0x434eac], eax
push 0x100
lea edx, [ebp - 0x108]
mov ecx, dword [ebp - 0x120]
call fcn.004158b4
xor ecx, ecx
xor eax, dword [0x434ea8]
xor ecx, dword [0x434eac]
mov dword [0x434ea8], eax
mov dword [0x434eac], ecx
jmp 0x411995
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x11c]
push eax
push str.SerialIID
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov edx, 0x80000001
mov ecx, dword [ebp - 0x120]
call fcn.0041017c
movzx eax, al
test eax, eax
je 0x41179e
mov eax, dword [ebp - 0x11c]
mov dword [0x434ea8], eax
mov eax, dword [ebp - 0x118]
mov dword [0x434eac], eax
push 0x10
lea edx, [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
call fcn.004158b4
xor ecx, ecx
xor eax, dword [0x434ea8]
xor ecx, dword [0x434eac]
mov dword [0x434ea8], eax
mov dword [0x434eac], ecx
jmp 0x411995
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
or edx, 0xffffffff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
movzx eax, ax
xor eax, dword [ebp - 0x11c]
mov dword [ebp - 0x11c], eax
mov edx, 0xffff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
or eax, dword [ebp - 0x11c]
movzx ecx, word [ebp - 0x118]
xor ecx, eax
mov word [ebp - 0x118], cx
movzx eax, word [ebp - 0x116]
xor eax, 0x1234
mov word [ebp - 0x116], ax
mov edx, 0xff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
movzx ecx, byte [ebp - 0x114]
xor ecx, eax
mov byte [ebp - 0x114], cl
mov edx, 0xff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
add eax, 0x64
movzx ecx, byte [ebp - 0x113]
xor ecx, eax
mov byte [ebp - 0x113], cl
mov edx, 0xff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
sub eax, 0x11
movzx ecx, byte [ebp - 0x112]
xor ecx, eax
mov byte [ebp - 0x112], cl
mov edx, 0xff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
imul eax, eax, 0x22
movzx ecx, byte [ebp - 0x111]
xor ecx, eax
mov byte [ebp - 0x111], cl
mov edx, 0xff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
add eax, 0x1d
movzx ecx, byte [ebp - 0x110]
xor ecx, eax
mov byte [ebp - 0x110], cl
mov edx, 0xff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
sub eax, 0x61
movzx ecx, byte [ebp - 0x10f]
xor ecx, eax
mov byte [ebp - 0x10f], cl
mov edx, 0xff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
imul eax, eax, 0x15
movzx ecx, byte [ebp - 0x10e]
xor ecx, eax
mov byte [ebp - 0x10e], cl
mov edx, 0xff
mov ecx, dword [ebp - 0x120]
call fcn.00413729
add eax, 0xb
movzx ecx, byte [ebp - 0x10d]
xor ecx, eax
mov byte [ebp - 0x10d], cl
push 4
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00402b50
add esp, 0xc
mov eax, dword [ebp - 0x11c]
mov dword [0x434ea8], eax
mov eax, dword [ebp - 0x118]
mov dword [0x434eac], eax
push 0x10
lea edx, [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
call fcn.004158b4
xor ecx, ecx
xor eax, dword [0x434ea8]
xor ecx, dword [0x434eac]
mov dword [0x434ea8], eax
mov dword [0x434eac], ecx
mov dword [ebp - 8], 0x10
push dword [ebp - 8]
lea eax, [ebp - 0x11c]
push eax
push 3
push str.SerialIID
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov edx, 0x80000001
mov ecx, dword [ebp - 0x120]
call fcn.004100e9
mov edx, dword [ebp - 0x120]
add edx, 0x5730
mov ecx, dword [ebp - 0x120]
call fcn.00410c93
mov eax, dword [0x434ea8]
mov edx, dword [0x434eac]
leave
ret