Function at 0x10002430
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
cmp dword [ebp + 0xc], 0x1000
mov eax, dword [ebp + 0x18]
jne 0x100026da
cmp dword [eax + 8], 1
jne 0x100026e4
mov eax, dword [eax]
cmp word [eax], 8
jne 0x100026d0
mov ebx, dword [eax + 8]
cmp word [ebx], 0
jne 0x100025f8
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov ebx, dword [sym.imp.kernel32.dll_GetComputerNameExA]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 7
call ebx
sub esp, 0xc
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xea
jne 0x100026bd
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x100026bd
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [ebp - 0x34], eax
mov dword [esp], 7
call ebx
mov edx, dword [ebp - 0x34]
sub esp, 0xc
test eax, eax
je 0x100026b4
lea eax, [ebp - 0x30]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sym._getaddrinfo_16
sub esp, 0x10
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
test ebx, ebx
jne 0x100026a3
mov edx, dword [ebp - 0x30]
mov eax, edx
test edx, edx
jne 0x10002533
jmp 0x10002698
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x10002698
cmp dword [eax + 4], 2
jne 0x10002528
mov esi, dword [eax + 0x18]
mov edi, dword [sym.imp.ws2_32.dll_ntohl]
mov eax, dword [esi + 4]
mov dword [esp], eax
call edi
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 4]
sub esp, 4
mov dword [esp], eax
call edi
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 4]
sub esp, 4
mov dword [esp], eax
call edi
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 4]
sub esp, 4
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x3c]
sub esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x38]
movzx edx, dl
shr ecx, 0x18
mov dword [esp + 8], str._u._u._u._u
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x34]
shr eax, 0x10
movzx eax, al
mov dword [esp + 0xc], ecx
movzx esi, dh
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
lea esi, [ebp - 0x2c]
mov dword [esp + 4], 0x10
mov dword [esp], esi
call sym._swprintf.constprop.0
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._freeaddrinfo_4
mov eax, dword [ebp + 0x1c]
mov edx, 8
sub esp, 4
mov word [eax], dx
mov dword [esp], esi
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov ecx, dword [ebp + 0x1c]
sub esp, 4
mov dword [ecx + 8], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x20
mov edx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [ebp - 0x34], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x20
mov edi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x100026bd
mov dword [esp + 0x1c], 0
mov edx, dword [ebp - 0x34]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x20
jmp 0x100024df
mov dword [esp], edx
call sym._freeaddrinfo_4
sub esp, 4
lea esp, [ebp - 0xc]
mov ebx, 1
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x20
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov ebx, 0x8007000e
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x20
mov ebx, 0x80020008
jmp 0x100025e7
mov ebx, 0x80020003
jmp 0x100025e7
mov ebx, 0x8002000e
jmp 0x100025e7