Function at 0x7592679b
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7594d0ac]
and dword [ebp - 0x28], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], edi
mov dword [esi + 0x28], eax
call fcn.7592aaa8
test eax, eax
je 0x75930c82
and dword [esi + 0x9d4], 0
push 0x10
xor eax, eax
cmp dword [ebp + 0xc], 7
lea edi, [esi + 0x58]
pop ecx
rep stosd dword es:[edi], eax
je 0x75930c92
cmp dword [ebp - 0x28], 0x78
je 0x75930ca7
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.75926ab1
cmp eax, 0x78
mov dword [ebp - 0x28], eax
je 0x759267fe
cmp eax, 0x79
je 0x759267fe
cmp eax, 1
jne 0x75930d8b
mov eax, dword [esi + 0x58]
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [esi + 0x4c8]
mov dword [ebx], eax
mov eax, dword [esi + 0x4cc]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x40]
and dword [eax], 0
lea eax, [esi + 0x498]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
lea edi, [esi + 0x4b0]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x4a4]
lea ebx, [esi + 0x4b8]
mov dword [ebx], eax
mov eax, dword [esi + 0x4a8]
push 0x75926aa8
push dword [esi + 0x4b4]
mov dword [edi], ecx
mov dword [ebx + 4], eax
call dword [sym.imp.msvcrt.dll_wcspbrk]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
jne 0x75930caf
push dword [esi + 0x4bc]
push dword [esi + 0x56c]
call fcn.7592771c
test eax, eax
mov dword [ebp - 0x28], eax
je 0x759268b7
mov eax, dword [eax + 8]
cmp eax, 5
je 0x75926923
cmp eax, 6
je 0x75926923
push dword [esi + 0x58]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x75926923
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.ADVAPI32.dll_LsaGetUserName
test eax, eax
jl 0x7592691d
push dword [ebp - 0x2c]
push edi
call fcn.75927ba6
push dword [ebp - 0x30]
push ebx
call fcn.75927ba6
mov eax, dword [esi + 0x4a0]
cmp word [eax], 0
je 0x75930cb8
mov eax, dword [ebp - 0x2c]
push dword [eax + 4]
call sub.ADVAPI32.dll_LsaFreeMemory
push dword [ebp - 0x2c]
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, dword [ebp - 0x30]
push dword [eax + 4]
call sub.ADVAPI32.dll_LsaFreeMemory
push dword [ebp - 0x30]
call sub.ADVAPI32.dll_LsaFreeMemory
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x75926947
mov eax, dword [eax + 8]
cmp eax, 5
je 0x75926a8a
cmp eax, 6
je 0x75926a8a
push dword [ebp - 0x28]
call fcn.759292d3
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp ecx, dword [eax + 0x1d4]
jne 0x75930d06
push esi
call fcn.7592a5a5
push dword [esi + 0x4b4]
call fcn.75929b3b
mov ebx, dword [ebp - 0x38]
mov dword [ebx], eax
push dword [esi + 0x4bc]
call fcn.75929b3b
lea edi, [esi + 0x4ec]
push edi
mov dword [ebx + 4], eax
call fcn.75927ce7
push dword [esi + 0x4f4]
call fcn.75929b3b
mov dword [ebx + 8], eax
push edi
lea eax, [esi + 0x4c4]
push eax
call fcn.759296e4
cmp byte [esi + 0x4c6], 0
jne 0x75930d1c
and dword [ebx + 0xc], 0
push esi
call fcn.7592a73c
cmp dword [0x7594d118], 0
je 0x75930d48
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x75926a73
mov eax, dword [esi + 0x4e0]
test byte [eax + 0x68], 4
mov dword [ebp - 0x28], 1
jne 0x75926a9a
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x38], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x75926a2d
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x4ac]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x75926a2d
and dword [ebp - 0x28], 0
mov dword [edi], 2
push dword [ebx]
push esi
call fcn.75929955
xor ebx, ebx
cmp dword [ebp - 0x28], ebx
mov dword [edi + 4], eax
jne 0x75930d6a
xor eax, eax
cmp dword [ebp - 0x28], ebx
mov dword [edi + 8], eax
jne 0x75930d75
xor eax, eax
cmp dword [ebp - 0x28], ebx
mov dword [edi + 0xc], eax
jne 0x75930d80
xor eax, eax
push esi
mov dword [edi + 0x10], eax
call fcn.759292f2
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [eax], edi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.75921930
leave
ret 0x20
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x75930cdf
jmp 0x75a368a0
cmp dword [esi + 0x530], 0
jne 0x75926a29
jmp 0x759269fc
mov eax, dword [edi]
and eax, 8
mov dword [esi + 0x9d4], eax
jmp 0x759267ea
push esi
mov dword [esi + 0x9d4], 1
call fcn.7593c2e1
jmp 0x7592681f
push 5
pop eax
jmp 0x7592680b
add eax, 2
push eax
jmp 0x75926898
mov ecx, dword [ebp - 0x2c]
push dword [ecx + 4]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [esi + 0x4a0]
lea eax, [esi + 0x498]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x759268f7
add eax, 2
push eax
push ebx
call fcn.7594006b
mov ebx, dword [ebp - 0x34]
and word [ebx], 0
push dword [esi + 0x49c]
push edi
call fcn.7594006b
mov word [ebx], 0x40
jmp 0x7592693f
push dword [esi + 0x4a0]
push dword [esi + 0x4ac]
call sub.WINSTA.dll__WinStationUpdateClientCachedCredentials
jmp 0x75926962
lea edi, [esi + 0x4f8]
push edi
call fcn.75927ce7
push dword [esi + 0x500]
call fcn.75929b3b
mov dword [ebx + 0xc], eax
push edi
lea eax, [esi + 0x4c5]
push eax
call fcn.759296e4
jmp 0x759269be
push dword [esi + 0x58]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x759269d1
push esi
call fcn.75938ac7
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x759269d1
push esi
call fcn.7593875d
jmp 0x75926a4b
push esi
call fcn.759387ff
jmp 0x75926a59
push esi
call fcn.759388a3
jmp 0x75926a67
mov ecx, eax
and ecx, 0xffff01ff
cmp ecx, 0x71
je 0x75930d9d
cmp ecx, 0x73
jne 0x75930dda
test ah, 0xde
je 0x75930dda
test ah, 0x40
je 0x75930dab
push 0xb
jmp 0x75930dfd
test ah, 0x10
je 0x75930db4
push 0xa
jmp 0x75930dfd
test ah, 8
je 0x75930dbd
push 0xc
jmp 0x75930dfd
test ah, 4
je 0x75930dc6
push 0xd
jmp 0x75930dfd
and eax, 0x200
neg eax
sbb eax, eax
and eax, 9
add eax, 5
jmp 0x75926a7b
cmp eax, 0x71
jne 0x75930de3
push 4
jmp 0x75930dfd
cmp eax, 0x76
jne 0x75930dec
push 0x11
jmp 0x75930dfd
cmp dword [esi + 0x9bc], 0
je 0x75930dfb
push esi
call fcn.7593d5e5
push 2
pop eax
jmp 0x75926a7b