Function at 0x1001b4d0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x100
mov ax, word [0x10039c68]
mov word [ebp - 0x50], ax
push 0x3e
push 0
lea ecx, [ebp - 0x4e]
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
push str.83271x
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x1001b550
mov dword [ebp - 0x5c], 0
push 1
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x102
je 0x1001b546
mov eax, 0xfffffff6
jmp 0x1001b7d6
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
push 0x271d
push 0x1003da70
call fcn.10019b80
add esp, 8
mov dword [0x100500ec], eax
cmp dword [0x100500ec], 0
jne 0x1001b581
or eax, 0xffffffff
jmp 0x1001b7d6
mov edx, dword [ebp - 0xc]
and edx, 3
je 0x1001b6dd
mov eax, dword [0x1003da68]
mov dword [ebp - 0xf8], eax
mov ecx, dword [0x1003da6c]
mov dword [ebp - 0xf4], ecx
mov edx, dword [0x1003da60]
mov dword [ebp - 0x68], edx
mov eax, dword [0x1003da64]
mov dword [ebp - 0x64], eax
mov ecx, dword [0x1003da58]
mov dword [ebp - 0xf0], ecx
mov dx, word [0x1003da5c]
mov word [ebp - 0xec], dx
mov al, byte [0x1003da5e]
mov byte [ebp - 0xea], al
xor ecx, ecx
mov byte [ebp - 0xe9], cl
mov dl, byte [0x10033426]
mov byte [ebp - 0xe8], dl
push 0x7f
push 0
lea eax, [ebp - 0xe7]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x17c], 0x80
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x17c]
push ecx
lea edx, [ebp - 0xe8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x17c], 0x80
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x178]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov dword [ebp - 0x60], 0
jmp 0x1001b658
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
cmp dword [ebp - 0x60], 7
jae 0x1001b686
mov eax, dword [ebp - 0x60]
movsx ecx, byte [ebp + eax - 0xe8]
mov edx, dword [ebp - 0x60]
movzx eax, byte [ebp + edx - 0xf8]
xor ecx, eax
mov edx, dword [ebp - 0x60]
movzx eax, byte [ebp + edx - 0x68]
cmp ecx, eax
je 0x1001b684
jmp 0x1001b686
jmp 0x1001b64f
cmp dword [ebp - 0x60], 7
jne 0x1001b6dd
mov dword [ebp - 0x60], 0
jmp 0x1001b69e
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], 6
jae 0x1001b6cf
mov edx, dword [ebp - 0x60]
movsx eax, byte [ebp + edx - 0x178]
mov ecx, dword [ebp - 0x60]
movzx edx, byte [ebp + ecx - 0xf8]
xor eax, edx
mov ecx, dword [ebp - 0x60]
movzx edx, byte [ebp + ecx - 0xf0]
cmp eax, edx
je 0x1001b6cd
jmp 0x1001b6cf
jmp 0x1001b695
cmp dword [ebp - 0x60], 6
jne 0x1001b6dd
or eax, 0xffffffff
jmp 0x1001b7d6
mov dword [0x100500e8], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x54], 1
jmp 0x1001b700
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x271c
jae 0x1001b76b
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x40
div ecx
movsx edx, byte [edx + 0x1004daf8]
mov eax, dword [0x100500ec]
add eax, dword [ebp - 8]
movsx ecx, byte [eax]
xor ecx, edx
mov edx, dword [0x100500ec]
add edx, dword [ebp - 8]
mov byte [edx], cl
mov eax, dword [0x100500ec]
add eax, dword [ebp - 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x1001b769
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [0x100500ec]
lea edx, [ecx + eax + 1]
mov eax, dword [ebp - 0x54]
mov dword [eax*4 + 0x10052380], edx
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x54], ecx
jmp 0x1001b6f7
mov edx, dword [0x100500ec]
mov dword [0x10052380], edx
mov dword [ebp - 0x54], 0
jmp 0x1001b789
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x100
jae 0x1001b7bd
cmp dword [ebp - 0x54], 0x41
jb 0x1001b7af
cmp dword [ebp - 0x54], 0x5a
ja 0x1001b7af
mov ecx, dword [ebp - 0x54]
add ecx, 0x20
mov edx, dword [ebp - 0x54]
mov byte [edx + 0x10052a60], cl
jmp 0x1001b7bb
mov eax, dword [ebp - 0x54]
mov cl, byte [ebp - 0x54]
mov byte [eax + 0x10052a60], cl
jmp 0x1001b780
mov edx, dword [ebp + 8]
push edx
call fcn.1001cf80
add esp, 4
test eax, eax
jge 0x1001b7d4
mov eax, 0xfffffffe
jmp 0x1001b7d6
xor eax, eax
mov esp, ebp
pop ebp
ret