Function at 0x4403e4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x240
mov ecx, dword [0x49c3bc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, ebx
push eax
call fcn.0041a570
movzx eax, byte [ebx + 0xb]
mov ecx, dword [ebx + 4]
test al, al
mov esi, eax
cmovs esi, ecx
test esi, esi
je 0x440c82
cmp esi, 1
je 0x44047e
mov edx, dword [ebx]
test al, al
mov edi, ebx
cmovs edi, edx
movzx ebx, word [edi]
cmp bx, 0x27
je 0x440449
cmp bx, 0x22
mov ebx, dword [ebp + 8]
jne 0x44047e
cmp word [edi + esi*2 - 2], 0x22
je 0x440454
jmp 0x44047e
cmp word [edi + esi*2 - 2], 0x27
mov ebx, dword [ebp + 8]
jne 0x44047e
test al, al
js 0x440464
lea ecx, [eax - 1]
lea eax, [ebx + eax*2 - 2]
mov byte [ebx + 0xb], cl
jmp 0x44046e
lea eax, [ecx - 1]
mov dword [ebx + 4], eax
lea eax, [edx + ecx*2 - 2]
mov word [eax], 0
mov ecx, ebx
push 1
push 0
call fcn.0041ae6c
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x24c], eax
je 0x4404a7
push 0x48747a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x238], eax
jmp 0x4404a7
xor eax, eax
mov esi, dword [eax*8 + 0x4874ac]
mov dword [ebp - 0x230], eax
push esi
call fcn.0046ebf8
add esp, 4
movzx edx, byte [ebx + 0xb]
mov ecx, ebx
test dl, dl
jns 0x4404cb
mov ecx, dword [ebx]
test eax, eax
je 0x440565
test dl, dl
mov dword [ebp - 0x22c], ecx
jns 0x4404e0
mov edx, dword [ebx + 4]
lea ecx, [edx + edx]
add eax, eax
sar eax, 1
sar ecx, 1
cmp ecx, eax
jl 0x4406c4
mov edi, dword [ebp - 0x22c]
lea ebx, [eax - 1]
mov dword [ebp - 0x23c], ebx
lea edx, [edi + edx*2]
mov dword [ebp - 0x234], edx
movzx edx, word [esi]
mov ebx, ecx
sub ebx, eax
inc ebx
je 0x4406c4
mov ebx, dword [ebp - 0x23c]
sub ebx, ecx
cmp word [edi], dx
je 0x44052f
add edi, 2
inc ebx
jne 0x44051f
jmp 0x4406c4
test edi, edi
je 0x4406c4
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x440646
movzx ebx, word [edi + ecx*2]
cmp bx, word [esi + ecx*2]
lea ecx, [ecx + 1]
je 0x44053a
mov ecx, dword [ebp - 0x234]
add edi, 2
sub ecx, edi
sar ecx, 1
cmp ecx, eax
jge 0x44050c
jmp 0x4406c4
xor edi, edi
push esi
call fcn.0046ebf8
add esp, 4
mov dword [ebp - 0x22c], eax
xor eax, eax
push eax
mov ecx, dword [ebp - 0x230]
push dword [ecx*8 + 0x4874b0]
lea esi, [ebp - 0x218]
push esi
push eax
call dword [ebp - 0x238]
test eax, eax
jne 0x4405a1
mov word [ebp - 0x218], 0
lea ebx, [ebp - 0x224]
mov ecx, ebx
push esi
call fcn.0040879a
movzx eax, byte [ebp - 0x219]
mov ecx, dword [ebp - 0x220]
test al, al
mov esi, eax
mov dword [ebp - 0x23c], ecx
cmovs esi, ecx
test esi, esi
je 0x440682
mov ecx, dword [ebp - 0x224]
test al, al
mov edx, ebx
cmovs edx, ecx
mov dword [ebp - 0x234], ecx
cmp word [edx + esi*2 - 2], 0x5c
jne 0x440682
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + 0xb]
test cl, cl
mov edx, ecx
jns 0x440603
mov edx, dword [ebp + 8]
mov edx, dword [edx + 4]
mov esi, dword [ebp - 0x22c]
lea ebx, [ebp - 0x224]
add esi, edi
cmp edx, esi
jbe 0x440682
mov ebx, dword [ebp + 8]
test cl, cl
mov edx, ebx
jns 0x440620
mov edx, dword [ebx]
cmp word [edx + esi*2], 0x5c
lea ebx, [ebp - 0x224]
jne 0x440682
test al, al
js 0x440660
lea ecx, [eax - 1]
mov byte [ebp - 0x219], cl
mov word [ebp + eax*2 - 0x226], 0
jmp 0x44067c
cmp dword [ebp - 0x234], edi
je 0x4406c4
sub edi, dword [ebp - 0x22c]
cmp edi, 0xfffffffe
je 0x4406c4
sar edi, 1
jmp 0x440567
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ebp - 0x234]
lea eax, [ecx - 1]
mov dword [ebp - 0x220], eax
mov word [edx + ecx*2 - 2], 0
lea ebx, [ebp - 0x224]
movzx eax, byte [ebp - 0x219]
mov edx, dword [ebp - 0x224]
mov ecx, dword [ebp + 8]
test al, al
cmovs eax, dword [ebp - 0x220]
cmovns edx, ebx
push eax
push edx
push dword [ebp - 0x22c]
push edi
call fcn.0041aef2
xor eax, eax
cmp byte [ebp - 0x219], al
jns 0x4406c4
push dword [ebp - 0x224]
call fcn.004591e8
add esp, 4
mov eax, dword [ebp - 0x230]
mov ebx, dword [ebp + 8]
inc eax
cmp eax, 7
jne 0x4404a9
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x234], eax
je 0x440700
push 0x4874e6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x238], eax
jmp 0x440700
mov dl, byte [ebx + 0xb]
mov esi, dword [ebx + 4]
mov eax, dword [ebx]
movzx ecx, dl
test dl, dl
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], eax
mov edi, ecx
cmovs ebx, eax
cmovs edi, esi
lea esi, [edi + edi]
cmp esi, 0x18
jl 0x440865
lea eax, [ebx + edi*2]
mov edi, ebx
mov dword [ebp - 0x23c], eax
shr esi, 1
add esi, 0xfffffff5
je 0x440865
cmp word [edi], 0x24
je 0x440754
add edi, 2
dec esi
jne 0x440743
jmp 0x440865
test edi, edi
je 0x440865
mov esi, 0xffffffea
test esi, esi
je 0x44078b
movzx eax, word [edi + esi + 0x18]
cmp ax, word [esi + 0x487526]
lea esi, [esi + 2]
je 0x440761
mov esi, dword [ebp - 0x23c]
add edi, 2
sub esi, edi
cmp esi, 0x18
jge 0x440738
jmp 0x440865
cmp dword [ebp - 0x23c], edi
je 0x440865
sub edi, ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x22c]
cmp edi, 0xfffffffe
je 0x44086e
xor eax, eax
lea esi, [ebp - 0x224]
mov dword [ebp - 0x224], eax
push esi
push eax
mov esi, dword [ebp - 0x238]
call esi
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x440852
sar edi, 1
xor ecx, ecx
dec ecx
add eax, eax
cmovb eax, ecx
push eax
call fcn.00459213
add esp, 4
mov ecx, eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x224]
push eax
push ecx
call esi
lea esi, [ebp - 0x218]
mov ecx, esi
push dword [ebp - 0x230]
call fcn.0040879a
movzx eax, byte [ebp - 0x20d]
test al, al
jns 0x440820
mov eax, dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
mov ecx, ebx
push eax
push esi
push 0xc
push edi
call fcn.0041aef2
xor eax, eax
cmp byte [ebp - 0x20d], al
jns 0x440844
push dword [ebp - 0x218]
call fcn.004591e8
add esp, 4
push dword [ebp - 0x230]
call fcn.0045921c
add esp, 4
mov eax, dword [ebx]
mov dl, byte [ebx + 0xb]
mov dword [ebp - 0x230], eax
mov eax, dword [ebx + 4]
movzx ecx, dl
jmp 0x44086e
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x22c]
mov edi, dword [ebp - 0x230]
test dl, dl
cmovs ecx, eax
lea edx, [ecx + ecx]
cmovns edi, ebx
cmp edx, 0x1e
jl 0x440989
lea ecx, [edi + ecx*2]
mov esi, edi
shr edx, 1
add edx, 0xfffffff2
je 0x440989
cmp word [esi], 0x24
je 0x4408a9
add esi, 2
dec edx
jne 0x440898
jmp 0x440989
test esi, esi
je 0x440989
mov edx, 0xffffffe4
test edx, edx
je 0x4408dc
movzx eax, word [esi + edx + 0x1e]
cmp ax, word [edx + 0x487546]
lea edx, [edx + 2]
je 0x4408b6
add esi, 2
mov edx, ecx
sub edx, esi
cmp edx, 0x1e
jge 0x44088d
jmp 0x440989
cmp ecx, esi
je 0x440989
sub esi, edi
cmp esi, 0xfffffffe
je 0x440989
xor eax, eax
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], eax
push ecx
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x440989
sar esi, 1
xor ecx, ecx
dec ecx
add eax, eax
cmovb eax, ecx
push eax
call fcn.00459213
add esp, 4
mov edi, eax
lea eax, [ebp - 0x224]
push eax
push edi
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea ebx, [ebp - 0x218]
mov ecx, ebx
push edi
call fcn.0040879a
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x440958
mov eax, dword [ebp - 0x214]
mov ebx, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push ebx
push 0xf
push esi
call fcn.0041aef2
xor eax, eax
cmp byte [ebp - 0x20d], al
jns 0x44097d
push dword [ebp - 0x218]
call fcn.004591e8
add esp, 4
push edi
call fcn.0045921c
add esp, 4
mov ebx, dword [ebp + 8]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x22c], eax
je 0x4409b2
push 0x48754a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x244], eax
jmp 0x4409b2
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x23c], eax
je 0x4409db
push 0x487582
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x240], eax
jmp 0x4409db
mov dl, byte [ebx + 0xb]
mov esi, dword [ebx + 4]
mov eax, dword [ebx]
mov edi, ebx
movzx ecx, dl
test dl, dl
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x230], eax
mov ebx, ecx
cmovs edi, eax
cmovs ebx, esi
lea esi, [ebx + ebx]
cmp esi, 0x1c
jl 0x440b22
lea eax, [edi + ebx*2]
mov ebx, edi
mov dword [ebp - 0x248], eax
shr esi, 1
add esi, 0xfffffff3
je 0x440b22
cmp word [ebx], 0x24
je 0x440a31
add ebx, 2
dec esi
jne 0x440a20
jmp 0x440b22
test ebx, ebx
je 0x440b22
mov esi, 0xffffffe6
test esi, esi
je 0x440a68
movzx eax, word [ebx + esi + 0x1c]
cmp ax, word [esi + 0x4875ac]
lea esi, [esi + 2]
je 0x440a3e
mov esi, dword [ebp - 0x248]
add ebx, 2
sub esi, ebx
cmp esi, 0x1c
jge 0x440a15
jmp 0x440b22
cmp dword [ebp - 0x248], ebx
je 0x440b22
sub ebx, edi
mov edi, dword [ebp - 0x234]
mov esi, dword [ebp - 0x238]
cmp ebx, 0xfffffffe
je 0x440b2e
xor eax, eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x224], eax
mov dword [ecx], eax
push ecx
lea ecx, [ebp - 0x224]
push ecx
push 0xa
push 0xffffffffffffffff
push eax
call dword [ebp - 0x244]
test eax, eax
je 0x440b0c
lea esi, [ebp - 0x218]
sar ebx, 1
mov ecx, esi
push dword [ebp - 0x224]
call fcn.0040879a
movzx eax, byte [esi + 0xb]
test al, al
jns 0x440adb
mov eax, dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push esi
push 0xe
push ebx
call fcn.0041aef2
push dword [ebp - 0x224]
call dword [ebp - 0x240]
xor eax, eax
cmp byte [ebp - 0x20d], al
jns 0x440b0c
push dword [ebp - 0x218]
call fcn.004591e8
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dl, byte [eax + 0xb]
mov esi, dword [eax + 4]
mov dword [ebp - 0x230], ecx
movzx ecx, dl
jmp 0x440b2e
mov edi, dword [ebp - 0x234]
mov esi, dword [ebp - 0x238]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x230]
test dl, dl
cmovs ecx, esi
lea edx, [ecx + ecx]
cmovns eax, ebx
cmp edx, 0x1e
mov dword [ebp - 0x230], eax
jl 0x440c44
mov esi, dword [ebp - 0x230]
lea ecx, [esi + ecx*2]
shr edx, 1
add edx, 0xfffffff2
je 0x440c44
cmp word [esi], 0x24
je 0x440b76
add esi, 2
dec edx
jne 0x440b65
jmp 0x440c44
test esi, esi
je 0x440c44
mov edx, 0xffffffe4
test edx, edx
je 0x440ba9
movzx eax, word [esi + edx + 0x1e]
cmp ax, word [edx + 0x4875cc]
lea edx, [edx + 2]
je 0x440b83
add esi, 2
mov edx, ecx
sub edx, esi
cmp edx, 0x1e
jge 0x440b5a
jmp 0x440c44
cmp ecx, esi
je 0x440c44
sub esi, dword [ebp - 0x230]
cmp esi, 0xfffffffe
je 0x440c44
xor eax, eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x224], eax
mov dword [ecx], eax
push ecx
lea ecx, [ebp - 0x224]
push ecx
push 6
push 0xffffffffffffffff
push eax
call dword [ebp - 0x244]
test eax, eax
je 0x440c44
lea ebx, [ebp - 0x218]
sar esi, 1
mov ecx, ebx
push dword [ebp - 0x224]
call fcn.0040879a
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x440c10
mov eax, dword [ebp - 0x214]
mov ebx, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push ebx
push 0xf
push esi
call fcn.0041aef2
push dword [ebp - 0x224]
call dword [ebp - 0x240]
xor eax, eax
cmp byte [ebp - 0x20d], al
jns 0x440c41
push dword [ebp - 0x218]
call fcn.004591e8
add esp, 4
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x440c55
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x440c66
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x440c71
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x440c82
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459221
mov eax, ebx
add esp, 0x240
pop esi
pop edi
pop ebx
pop ebp
ret