Function at 0x445ed4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x244
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x57ffac]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, esi
push eax
call fcn.0041cab2
movzx eax, byte [esi + 0xb]
test al, al
js 0x445f28
test al, al
je 0x446401
cmp al, 1
je 0x445f9d
movzx ecx, word [esi]
cmp cx, 0x22
jne 0x445f4c
mov cx, 0x22
cmp word [esi + eax*2 - 2], 0x22
jne 0x445f4c
jmp 0x445f6f
mov edx, dword [esi + 4]
test edx, edx
je 0x446401
cmp edx, 1
je 0x445f9d
mov ecx, dword [esi]
cmp word [ecx], 0x22
jne 0x445f58
cmp word [ecx + edx*2 - 2], 0x22
je 0x445f6b
test al, al
js 0x445f58
cmp cx, 0x27
jne 0x445f9d
mov ecx, esi
mov edx, eax
jmp 0x445f63
mov ecx, dword [esi]
cmp word [ecx], 0x27
jne 0x445f9d
mov edx, dword [esi + 4]
cmp word [ecx + edx*2 - 2], 0x27
jne 0x445f9d
test al, al
js 0x445f7d
lea ecx, [eax - 1]
mov byte [esi + 0xb], cl
lea eax, [esi + eax*2]
add eax, 0xfffffffe
jmp 0x445f8d
mov eax, dword [esi + 4]
lea ecx, [eax - 1]
mov dword [esi + 4], ecx
add eax, eax
add eax, 0xfffffffe
add eax, dword [esi]
mov word [eax], 0
mov ecx, esi
push 1
push 0
call fcn.0041d3c4
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x250], eax
je 0x445fc6
push 0x532fda
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x22c], eax
jmp 0x445fc6
xor edi, edi
mov eax, dword [edi*8 + 0x532ff4]
mov dword [ebp - 0x238], eax
push eax
call fcn.00516c94
add esp, 4
movzx ebx, byte [esi + 0xb]
mov edx, esi
test bl, bl
jns 0x445fea
mov edx, dword [esi]
test eax, eax
mov dword [ebp - 0x240], edi
je 0x446083
test bl, bl
jns 0x445fff
mov ebx, dword [esi + 4]
cmp ebx, eax
jl 0x4461c6
lea ecx, [edx + ebx*2]
mov dword [ebp - 0x234], ecx
mov ecx, dword [ebp - 0x238]
movzx ecx, word [ecx]
mov edi, edx
mov dword [ebp - 0x230], edx
mov edx, ebx
sub edx, eax
inc edx
je 0x4461c6
inc ebx
cmp word [edi], cx
je 0x44603f
add edi, 2
dec ebx
cmp eax, ebx
jne 0x44602d
jmp 0x4461c6
mov word [ebp - 0x23c], cx
xor edx, edx
inc edx
cmp eax, edx
je 0x44611a
movzx ebx, word [edi + edx*2]
lea esi, [edx + 1]
mov ecx, dword [ebp - 0x238]
cmp bx, word [ecx + edx*2]
mov edx, esi
je 0x446049
add edi, 2
mov ebx, dword [ebp - 0x234]
sub ebx, edi
sar ebx, 1
cmp ebx, eax
movzx ecx, word [ebp - 0x23c]
jge 0x446021
jmp 0x4461c6
xor edi, edi
push dword [ebp - 0x238]
call fcn.00516c94
add esp, 4
mov esi, eax
xor eax, eax
push eax
mov ecx, dword [ebp - 0x240]
push dword [ecx*8 + 0x532ff8]
lea ebx, [ebp - 0x218]
push ebx
push eax
call dword [ebp - 0x22c]
test eax, eax
jne 0x4460c0
mov word [ebp - 0x218], 0
lea ecx, [ebp - 0x224]
push ebx
call fcn.0040241c
movzx eax, byte [ebp - 0x219]
test al, al
js 0x4460e9
test al, al
je 0x446184
lea edx, [ebp - 0x224]
mov ecx, eax
jmp 0x4460fd
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x446184
mov edx, dword [ebp - 0x224]
cmp word [edx + ecx*2 - 2], 0x5c
jne 0x446184
mov ebx, dword [ebp + 8]
movzx edx, byte [ebx + 0xb]
mov ecx, esi
add ecx, edi
test dl, dl
js 0x44613e
cmp ecx, edx
jb 0x446148
jmp 0x446184
cmp dword [ebp - 0x234], edi
mov eax, dword [ebp - 0x230]
je 0x4461c6
sub edi, eax
cmp edi, 0xfffffffe
je 0x4461c6
sar edi, 1
jmp 0x446085
cmp dword [ebx + 4], ecx
jbe 0x446184
mov edx, dword [ebp + 8]
mov ebx, dword [edx]
cmp word [ebx + ecx*2], 0x5c
jne 0x446184
test al, al
js 0x446168
lea ecx, [eax - 1]
mov byte [ebp - 0x219], cl
mov word [ebp + eax*2 - 0x226], 0
jmp 0x446184
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x220]
lea edx, [ecx - 1]
mov dword [ebp - 0x220], edx
mov word [eax + ecx*2 - 2], 0
movzx eax, byte [ebp - 0x219]
test al, al
cmovs eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x224]
lea ecx, [ebp - 0x224]
cmovns edx, ecx
mov ecx, dword [ebp + 8]
push eax
push edx
push esi
push edi
call fcn.0041d44a
cmp byte [ebp - 0x219], 0
jns 0x4461c6
push dword [ebp - 0x224]
call fcn.004fe838
add esp, 4
mov edi, dword [ebp - 0x240]
inc edi
cmp edi, 7
mov esi, dword [ebp + 8]
jne 0x445fc8
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x240], eax
je 0x4461fc
push 0x53302e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x4461fc
mov cl, byte [esi + 0xb]
test cl, cl
mov edi, dword [esi]
mov edx, dword [esi + 4]
mov dword [ebp - 0x238], edi
cmovs esi, edi
mov edi, esi
mov byte [ebp - 0x234], cl
movzx esi, cl
mov ecx, esi
mov dword [ebp - 0x22c], edx
cmovs ecx, edx
cmp ecx, 0xc
jge 0x446286
mov cl, byte [ebp - 0x234]
mov edx, dword [ebp - 0x22c]
test cl, cl
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x238]
cmovns ecx, edi
mov dword [ebp - 0x238], ecx
cmovs esi, edx
cmp esi, 0xf
jge 0x4462e3
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x238], eax
je 0x44633b
push 0x533092
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x248], eax
jmp 0x44633b
mov dword [ebp - 0x23c], eax
lea eax, [edi + ecx*2]
mov dword [ebp - 0x230], eax
mov eax, edi
add ecx, 0xfffffff5
je 0x44622a
cmp word [edi], 0x24
je 0x4462aa
add edi, 2
dec ecx
jne 0x44629c
jmp 0x44622a
mov ecx, 0xffffffea
test ecx, ecx
je 0x4464ca
movzx ebx, word [edi + ecx + 0x18]
lea edx, [ecx + 2]
cmp bx, word [ecx + 0x53306e]
mov ecx, edx
je 0x4462af
add edi, 2
mov edx, dword [ebp - 0x230]
sub edx, edi
mov ecx, edx
sar ecx, 1
cmp edx, 0x18
jge 0x446297
jmp 0x44622a
mov ebx, dword [ebp - 0x238]
lea edx, [ebx + esi*2]
add esi, 0xfffffff2
je 0x446256
cmp word [ebx], 0x24
je 0x446306
add ebx, 2
dec esi
jne 0x4462f5
jmp 0x446256
mov eax, 0xffffffe4
test eax, eax
je 0x446591
movzx ecx, word [ebx + eax + 0x1e]
lea esi, [eax + 2]
cmp cx, word [eax + 0x53308e]
mov eax, esi
je 0x44630b
add ebx, 2
mov ecx, edx
sub ecx, ebx
mov esi, ecx
sar esi, 1
cmp ecx, 0x1e
jge 0x4462ec
jmp 0x446256
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x234], eax
je 0x446364
push 0x5330ca
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x244], eax
jmp 0x446364
mov cl, byte [edi + 0xb]
test cl, cl
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov ebx, edi
mov dword [ebp - 0x22c], eax
cmovs ebx, eax
mov byte [ebp - 0x230], cl
movzx esi, cl
mov ecx, esi
mov dword [ebp - 0x23c], edx
cmovs ecx, edx
cmp ecx, 0xe
jge 0x446418
mov ebx, dword [ebp - 0x22c]
mov dl, byte [ebp - 0x230]
mov eax, dword [ebp - 0x23c]
test dl, dl
cmovns ebx, dword [ebp + 8]
cmovs esi, eax
cmp esi, 0xf
jge 0x446476
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x4463cb
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x4463dc
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x240]
test eax, eax
mov esi, dword [ebp + 8]
je 0x4463f0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x446401
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe871
mov eax, esi
add esp, 0x244
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebx + ecx*2]
mov dword [ebp - 0x24c], eax
mov edi, ebx
add ecx, 0xfffffff3
je 0x446396
cmp word [edi], 0x24
je 0x44643d
add edi, 2
dec ecx
jne 0x44642c
jmp 0x446396
mov ecx, 0xffffffe6
test ecx, ecx
je 0x446638
movzx eax, word [edi + ecx + 0x1c]
lea edx, [ecx + 2]
cmp ax, word [ecx + 0x5330f4]
mov ecx, edx
je 0x446442
add edi, 2
mov eax, dword [ebp - 0x24c]
sub eax, edi
mov ecx, eax
sar ecx, 1
cmp eax, 0x1c
jge 0x446423
jmp 0x446396
lea edx, [ebx + esi*2]
mov edi, ebx
add esi, 0xfffffff2
je 0x4463ba
cmp word [edi], 0x24
je 0x446495
add edi, 2
dec esi
jne 0x446484
jmp 0x4463ba
mov ecx, 0xffffffe4
test ecx, ecx
je 0x4466f0
movzx eax, word [edi + ecx + 0x1e]
lea esi, [ecx + 2]
cmp ax, word [ecx + 0x533114]
mov ecx, esi
je 0x44649a
add edi, 2
mov eax, edx
sub eax, edi
mov esi, eax
sar esi, 1
cmp eax, 0x1e
jge 0x44647b
jmp 0x4463ba
cmp dword [ebp - 0x230], edi
je 0x44622a
sub edi, eax
cmp edi, 0xfffffffe
mov cl, byte [ebp - 0x234]
mov edx, dword [ebp - 0x22c]
je 0x446236
xor ecx, ecx
lea esi, [ebp - 0x224]
mov dword [esi], ecx
push esi
push ecx
mov ebx, dword [ebp - 0x23c]
call ebx
mov eax, dword [esi]
test eax, eax
je 0x446576
sar edi, 1
xor ecx, ecx
dec ecx
add eax, eax
cmovb eax, ecx
push eax
call fcn.004fe863
add esp, 4
mov ecx, esi
mov esi, eax
push ecx
push eax
call ebx
mov ebx, esi
lea esi, [ebp - 0x218]
mov ecx, esi
push ebx
call fcn.0040241c
movzx eax, byte [ebp - 0x20d]
test al, al
jns 0x446549
mov eax, dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push esi
push 0xc
push edi
call fcn.0041d44a
cmp byte [ebp - 0x20d], 0
jns 0x44656d
push dword [ebp - 0x218]
call fcn.004fe838
add esp, 4
push ebx
call fcn.004fe86c
add esp, 4
mov eax, dword [ebp + 8]
mov dl, byte [eax + 0xb]
mov ecx, dword [eax]
mov dword [ebp - 0x238], ecx
mov ecx, edx
mov edx, dword [eax + 4]
movzx esi, cl
jmp 0x446236
cmp edx, ebx
je 0x446256
sub ebx, dword [ebp - 0x238]
cmp ebx, 0xfffffffe
je 0x446256
xor eax, eax
lea edi, [ebp - 0x224]
mov dword [edi], eax
push edi
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov eax, dword [edi]
test eax, eax
je 0x446630
sar ebx, 1
xor ecx, ecx
dec ecx
add eax, eax
cmovb eax, ecx
push eax
call fcn.004fe863
add esp, 4
mov esi, eax
push edi
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea edi, [ebp - 0x218]
mov ecx, edi
push esi
call fcn.0040241c
movzx eax, byte [edi + 0xb]
test al, al
jns 0x446603
mov eax, dword [ebp - 0x214]
mov edi, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push edi
push 0xf
push ebx
call fcn.0041d44a
cmp byte [ebp - 0x20d], 0
jns 0x446627
push dword [ebp - 0x218]
call fcn.004fe838
add esp, 4
push esi
call fcn.004fe86c
add esp, 4
mov edi, dword [ebp + 8]
jmp 0x446256
cmp dword [ebp - 0x24c], edi
je 0x446396
sub edi, ebx
cmp edi, 0xfffffffe
mov ebx, dword [ebp - 0x22c]
mov dl, byte [ebp - 0x230]
mov eax, dword [ebp - 0x23c]
je 0x4463a8
xor eax, eax
lea ecx, [ebp - 0x224]
mov dword [ecx], eax
lea edx, [ebp - 0x228]
mov dword [edx], eax
push edx
push ecx
push 0xa
push 0xffffffffffffffff
push eax
call dword [ebp - 0x248]
test eax, eax
je 0x4466dd
sar edi, 1
lea esi, [ebp - 0x218]
mov ecx, esi
push dword [ebp - 0x224]
call fcn.0040241c
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4466ad
mov eax, dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push esi
push 0xe
push edi
call fcn.0041d44a
push dword [ebp - 0x224]
call dword [ebp - 0x244]
cmp byte [ebp - 0x20d], 0
jns 0x4466dd
push dword [ebp - 0x218]
call fcn.004fe838
add esp, 4
mov eax, dword [ebp + 8]
mov dl, byte [eax + 0xb]
mov ebx, dword [eax]
mov eax, dword [eax + 4]
movzx esi, dl
jmp 0x4463a8
cmp edx, edi
je 0x4463ba
sub edi, ebx
cmp edi, 0xfffffffe
je 0x4463ba
xor eax, eax
lea ecx, [ebp - 0x224]
mov dword [ecx], eax
lea edx, [ebp - 0x228]
mov dword [edx], eax
push edx
push ecx
push 6
push 0xffffffffffffffff
push eax
call dword [ebp - 0x248]
test eax, eax
je 0x4463ba
sar edi, 1
lea esi, [ebp - 0x218]
mov ecx, esi
push dword [ebp - 0x224]
call fcn.0040241c
movzx eax, byte [esi + 0xb]
test al, al
jns 0x446753
mov eax, dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push esi
push 0xf
push edi
call fcn.0041d44a
push dword [ebp - 0x224]
call dword [ebp - 0x244]
cmp byte [ebp - 0x20d], 0
jns 0x4463ba
push dword [ebp - 0x218]
call fcn.004fe838
add esp, 4
jmp 0x4463ba