Function at 0x4a5db0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x93c
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x8f8], esi
mov dword [ebp - 0x90c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x900], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x938], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x934], eax
mov edi, dword [ebp + 0xc]
mov eax, 0x18
mov dword [ebp - 0x908], eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x904], eax
push 0x401
mov al, byte [edi + 4]
and al, 1
mov byte [ebp - 0x8f1], al
lea eax, [ebp - 0x890]
push 0
push eax
mov dword [ebp - 0x920], edi
mov dword [ebp - 0x914], 0
call fcn.005f46f0
add esp, 0xc
mov dword [ebp - 0x910], 0x6e9c8d
xor ebx, ebx
mov dword [ebp - 0x918], ebx
mov dword [ebp - 0x8fc], ebx
push 0x5c
push esi
call fcn.005fa980
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a5e81
push 0x2f
push dword [ebp - 0x8f8]
call fcn.005fa980
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a5e81
mov esi, dword [ebp - 0x8f8]
jmp 0x4a5e98
mov ecx, dword [ebp - 0x8f8]
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x8fc], eax
inc esi
mov dword [ebp - 0x91c], esi
test esi, esi
je 0x4a5eb6
mov ebx, esi
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4a5ea7
sub ebx, ecx
mov dword [ebp - 0x918], ebx
push 0x401
lea eax, [ebp - 0x890]
mov byte [ebp - 0x890], 0
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [ebp - 0x490], 0
test eax, eax
jne 0x4a5f11
lea eax, [ebp - 0x890]
push 0x2e
push eax
call fcn.005fa980
add esp, 8
test eax, eax
je 0x4a5ef2
mov byte [eax], 0
lea ecx, [ebp - 0x890]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a5f00
sub ecx, edx
mov dword [ebp - 0x8f8], ecx
jmp 0x4a5f2e
push str.gethostname___failed__continuing_without__n
push dword [ebp - 0x90c]
call fcn.0046c560
add esp, 8
mov dword [ebp - 0x8f8], 0
cmp dword [edi + 0x14], 0
je 0x4a5fe9
mov ecx, dword [ebp - 0x90c]
lea edx, [ebp - 0xc]
push 8
call fcn.004a9320
add esp, 4
test eax, eax
jne 0x4a6412
mov edx, dword [ebp - 0x900]
lea eax, [ebp - 0x54]
push eax
call fcn.004a7c50
add esp, 4
test eax, eax
jne 0x4a6412
lea eax, [ebp - 0x24]
mov edx, ebx
push eax
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
push dword [ebp - 0x8fc]
push dword [ebp - 0x910]
call fcn.004a7d80
add esp, 0x10
test eax, eax
jne 0x4a6412
lea eax, [ebp - 0x3c]
push eax
lea eax, [edi + 8]
push eax
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x24]
call fcn.004a7f90
add esp, 8
test eax, eax
jne 0x4a6412
lea eax, [ebp - 0x908]
push eax
lea eax, [ebp - 0x914]
push eax
push edi
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x24]
call fcn.004a7e20
add esp, 0xc
test eax, eax
jne 0x4a6412
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x904], eax
jmp 0x4a60eb
test dword [edi + 4], 0x80000
je 0x4a6092
mov ecx, dword [ebp - 0x90c]
lea edx, [ebp - 0xc]
push 8
call fcn.004a9320
add esp, 4
test eax, eax
jne 0x4a6412
mov eax, dword [edi + 8]
xorps xmm0, xmm0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x8f0]
push eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], ecx
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
call fcn.004fe6f0
add esp, 4
lea eax, [ebp - 0x24]
push 0x10
push eax
lea eax, [ebp - 0x8f0]
push eax
call fcn.004fe750
add esp, 0xc
lea eax, [ebp - 0x8f0]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004fe5d0
mov edx, dword [ebp - 0x900]
lea eax, [ebp - 0x6c]
push eax
call fcn.004a7c50
add esp, 0xc
test eax, eax
jne 0x4a6412
lea eax, [ebp - 0x84]
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x6c]
jmp 0x4a60e2
mov esi, dword [ebp - 0x900]
lea eax, [ebp - 0x6c]
push eax
mov edx, esi
call fcn.004a7c50
add esp, 4
test eax, eax
jne 0x4a6412
lea eax, [ebp - 0x84]
push eax
lea edx, [edi + 8]
lea ecx, [ebp - 0x6c]
call fcn.004a7a20
add esp, 4
lea eax, [ebp - 0x24]
mov edx, esi
push eax
call fcn.004a7af0
add esp, 4
test eax, eax
jne 0x4a6412
lea eax, [ebp - 0x3c]
lea edx, [edi + 8]
lea ecx, [ebp - 0x24]
push eax
call fcn.004a7a20
add esp, 4
cmp byte [ebp - 0x8f1], 0
je 0x4a6118
mov eax, dword [ebp - 0x8fc]
add ebx, ebx
add eax, eax
mov dword [ebp - 0x918], ebx
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x8f8]
add eax, eax
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x908]
add eax, 0x58
add eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x900], eax
lea ecx, [ebx + eax]
mov eax, dword [ebp - 0x8f8]
shr eax, 8
movzx edx, al
mov eax, dword [ebp - 0x8f8]
movzx esi, al
mov eax, ebx
shr eax, 8
movzx edi, al
mov eax, dword [ebp - 0x8fc]
shr eax, 8
movzx eax, al
mov dword [ebp - 0x928], eax
movzx ebx, bl
mov dword [ebp - 0x924], ebx
mov ebx, dword [ebp - 0x8fc]
movzx eax, bl
mov ebx, dword [ebp - 0x908]
mov dword [ebp - 0x92c], eax
mov eax, ebx
shr eax, 8
movzx eax, al
mov dword [ebp - 0x930], eax
movzx eax, bl
mov ebx, dword [ebp - 0x920]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 7]
push eax
movzx eax, byte [ebx + 6]
push eax
movzx eax, byte [ebx + 5]
push eax
movzx eax, byte [ebx + 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ebx, dword [ebp - 0x924]
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
mov ecx, dword [ebp - 0x900]
push eax
push edx
push esi
push edx
push esi
push 0
push 0
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
push eax
push edi
push ebx
push edi
push ebx
mov ebx, dword [ebp - 0x908]
push 0
push 0
lea ecx, [ebx + 0x58]
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
mov ecx, dword [ebp - 0x92c]
push eax
mov eax, dword [ebp - 0x928]
push eax
push ecx
push eax
mov eax, dword [ebp - 0x930]
push ecx
mov ecx, dword [ebp - 8]
push 0
push 0
push 0
push 0x58
push eax
push ecx
push eax
push ecx
push 0
push 0
push 0
push 0x40
push 0
push 0x18
push 0
push 0x18
push 0
push 0
push 0
push 0
push str.NTLMSSP_c
lea eax, [ebp - 0x488]
push 0x400
push eax
call sym.hrkill.exe_curl_msnprintf
mov edi, eax
add esp, 0xec
cmp edi, 0x3e8
jae 0x4a628b
movups xmm0, xmmword [ebp - 0x3c]
movups xmmword [ebp + edi - 0x488], xmm0
movq xmm0, qword [ebp - 0x2c]
movq qword [ebp + edi - 0x478], xmm0
add edi, 0x18
mov eax, 0x400
sub eax, ebx
cmp edi, eax
jae 0x4a62b0
push ebx
push dword [ebp - 0x904]
lea eax, [ebp - 0x488]
add eax, edi
push eax
call fcn.005f40c0
add esp, 0xc
add edi, ebx
push dword [ebp - 0x914]
call dword [0x725400]
mov ecx, dword [ebp - 0x8fc]
add esp, 4
mov esi, dword [ebp - 0x918]
mov ebx, dword [ebp - 0x8f8]
lea eax, [edi + ecx]
mov dword [ebp - 0x904], eax
add eax, esi
add eax, ebx
cmp eax, 0x400
jb 0x4a630e
push str.user__domain__host_name_too_big
push dword [ebp - 0x90c]
call fcn.0046c5e0
add esp, 8
mov eax, 0x1b
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x8f1], 0
je 0x4a6332
mov edx, dword [ebp - 0x910]
shr ecx, 1
push ecx
lea ecx, [ebp - 0x488]
add ecx, edi
call fcn.004a5cc0
add esp, 4
jmp 0x4a634a
push ecx
push dword [ebp - 0x910]
lea eax, [ebp - 0x488]
add eax, edi
push eax
call fcn.005f40c0
add esp, 0xc
cmp byte [ebp - 0x8f1], 0
mov edi, dword [ebp - 0x904]
je 0x4a6376
mov edx, dword [ebp - 0x91c]
lea ecx, [ebp - 0x488]
mov eax, esi
add ecx, edi
shr eax, 1
push eax
call fcn.004a5cc0
add esp, 4
jmp 0x4a638e
push esi
push dword [ebp - 0x91c]
lea eax, [ebp - 0x488]
add eax, edi
push eax
call fcn.005f40c0
add esp, 0xc
add edi, esi
cmp byte [ebp - 0x8f1], 0
je 0x4a63c6
lea edx, [ebp - 0x488]
mov esi, ebx
add edx, edi
mov ecx, 0
shr esi, 1
je 0x4a63df
nop dword [eax]
mov al, byte [ebp + ecx - 0x890]
mov byte [edx + ecx*2], al
mov byte [edx + ecx*2 + 1], 0
inc ecx
cmp ecx, esi
jb 0x4a63b0
jmp 0x4a63df
push ebx
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x488]
add eax, edi
push eax
call fcn.005f40c0
add esp, 0xc
push dword [ebp - 0x934]
lea eax, [edi + ebx]
mov ecx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
push dword [ebp - 0x938]
push eax
lea eax, [ebp - 0x488]
push eax
call fcn.004a2870
mov ecx, dword [ebp - 0x920]
add esp, 0x10
mov esi, eax
call fcn.004a6430
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret