Function at 0x403d11
Capabilities:
Get hostname
Get session user name
Resolve dns

Disassembly:
mov eax, 0x4277e8
call fcn.00427220
sub esp, 0x6ac
push ebx
push esi
push edi
xor edi, edi
push 0x138
lea eax, [ebp - 0x1b0]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0040198a
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
mov dword [ebp - 4], edi
call fcn.0040198d
test eax, eax
je 0x4044a9
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x3b0]
push str.OS:
push eax
call esi
mov eax, dword [ebp - 0x1a4]
pop ecx
sub eax, edi
pop ecx
je 0x404296
dec eax
je 0x404269
dec eax
je 0x40419a
dec eax
je 0x403daf
dec eax
je 0x403da5
lea eax, [ebp - 0x78]
push str.Unknown_OS
push eax
call esi
jmp 0x4042a7
push str.Windows_CE
jmp 0x40429b
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040279f
test eax, eax
je 0x403e85
lea eax, [ebp - 0x3b0]
push str.Windows_NT
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x1b0]
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00402837
test eax, eax
je 0x403df3
push str.__Workstation_
jmp 0x403e3f
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004027eb
test eax, eax
je 0x403e0d
push str.__Server_
jmp 0x403e3f
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004027bf
test eax, eax
je 0x403e27
push str.__Primary_Domain_Controller_
jmp 0x403e3f
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040280b
test eax, eax
je 0x403e4d
push str.__Backup_Domain_Controller_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004028c6
test eax, eax
jne 0x403f1c
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004028a3
test eax, eax
je 0x404070
push str.___Enterprise_
jmp 0x404062
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004023d3
test eax, eax
je 0x403f47
lea eax, [ebp - 0x3b0]
push str.Windows_2000
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x1b0]
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004028e9
test eax, eax
je 0x403ec9
push str.__Professional_
jmp 0x403efb
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040290c
test eax, eax
je 0x403ee3
push str.__Server_
jmp 0x403efb
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402972
test eax, eax
je 0x403f09
push str.__Domain_Controller_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040294f
test eax, eax
je 0x403f26
push str.___Datacenter_
jmp 0x404062
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040292c
test eax, eax
je 0x404070
push str.___Advanced_Server_
jmp 0x404062
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004023fc
test eax, eax
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
je 0x40403a
call fcn.00402995
test eax, eax
je 0x403f78
push str.Windows_XP__Personal_
jmp 0x403fc4
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004029b8
test eax, eax
je 0x403f92
push str.Windows_XP__Professional_
jmp 0x403fc4
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a0e
test eax, eax
je 0x403fac
push str.Windows_Server_2003
jmp 0x403fc4
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a74
test eax, eax
je 0x403fd2
push str.Windows_Server_2003__Domain_Controller_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a51
test eax, eax
je 0x403fec
push str.___Datacenter_Edition_
jmp 0x404062
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a2e
test eax, eax
je 0x404006
push str.___Enterprise_Edition_
jmp 0x404062
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004029eb
test eax, eax
je 0x404020
push str.___Web_Edition_
jmp 0x404062
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a0e
test eax, eax
je 0x404070
push str.___Standard_Edition_
jmp 0x404062
call fcn.00402425
test eax, eax
je 0x40404a
push str.Windows_Vista:_Warning_UAC_windows_need_to_be_controled_by_local_user__to_view_mouse_during_this_action__select_Let_server_deal_with_mouse__viewer_option_
jmp 0x404062
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040244e
test eax, eax
je 0x404070
push str.Windows_Win7:_Warning_UAC_windows_need_to_be_controled_by_local_user__to_view_mouse_during_this_action__select_Let_server_deal_with_mouse__viewer_option_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040285a
test eax, eax
je 0x404096
lea eax, [ebp - 0x3b0]
push str.___Terminal_Services_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402893
test eax, eax
je 0x4040bc
lea eax, [ebp - 0x3b0]
push str.___BackOffice_Small_Business_Edition_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040286d
test eax, eax
je 0x4040e2
lea eax, [ebp - 0x3b0]
push str.___Embedded_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402880
test eax, eax
je 0x404108
lea eax, [ebp - 0x3b0]
push str.___Terminal_Services_in_Remote_Admin_Mode_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402aaa
test eax, eax
je 0x40412e
lea eax, [ebp - 0x3b0]
push str.___64_Bit_Edition_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a97
test eax, eax
je 0x404154
lea eax, [ebp - 0x3b0]
push str.___Media_Center_Edition_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
mov eax, dword [ebp - 0x84]
test ah, 4
je 0x404169
push str.___Uniprocessor_Free_
jmp 0x40429b
test ah, 8
je 0x404178
push str.___Uniprocessor_Checked_
jmp 0x40429b
test ah, 0x10
je 0x404187
push str.___Multiprocessor_Free_
jmp 0x40429b
test ah, 0x20
je 0x4042a9
push str.___Multiprocessor_Checked_
jmp 0x40429b
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402265
test eax, eax
je 0x4041b7
push str.Windows_95
jmp 0x40425b
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040229a
test eax, eax
je 0x4041d4
push str.Windows_95_SP1
jmp 0x40425b
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004022ce
test eax, eax
je 0x4041ee
push str.Windows_95_OSR2
jmp 0x40425b
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402303
test eax, eax
je 0x404208
push str.Windows_98
jmp 0x40425b
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402338
test eax, eax
je 0x404222
push str.Windows_98_SP1
jmp 0x40425b
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402375
test eax, eax
je 0x40423c
push str.Windows_98_Second_Edition
jmp 0x40425b
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004023aa
test eax, eax
je 0x404256
push str.Windows_Millenium_Edition
jmp 0x40425b
push str.Windows___
lea eax, [ebp - 0x78]
push eax
call esi
pop ecx
lea eax, [ebp - 0x78]
pop ecx
push eax
jmp 0x40429b
lea eax, [ebp - 0x3b0]
push str.Windows
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x1b0]
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040278c
test eax, eax
je 0x4042a9
push str.__Win32s_
jmp 0x40429b
push 0x4316ac
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
mov eax, dword [ebp - 0x1a0]
dec eax
cmp eax, 9
ja case.default.0x4042b5
jmp dword [eax*4 + 0x4045db]
push str.___Intel_Processor_
jmp 0x404307
push str.___MSIL_Processor_
jmp 0x404307
push str.___MIPS_Processor_
jmp 0x404307
push str.___ARM_Processor_
jmp 0x404307
push str.___SHX_Processor_
jmp 0x404307
push str.___Alpha_Processor_
jmp 0x404307
push str.___Alpha64_Processor_
jmp 0x404307
push str.___PPC_Processor_
jmp 0x404307
push str.___IA64_Processor_
jmp 0x404307
push str.___AMD64_Processor_
jmp 0x404307
push str.___Unknown_Processor_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x78]
pop ecx
push dword [ebp - 0x1b0]
push str._v_d.
push eax
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
mov ecx, dword [ebp - 0x1ac]
add esp, 0x14
mov eax, ecx
xor edx, edx
push 0xa
pop ebx
div ebx
test edx, edx
je 0x404359
cmp ecx, 9
push ecx
jbe 0x404363
push str._02d
jmp 0x404368
push 0xa
mov eax, ecx
xor edx, edx
pop ecx
div ecx
push eax
push str._01d
lea eax, [ebp - 0x78]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
cmp dword [ebp - 0x1a8], edi
pop ecx
pop ecx
je 0x4043af
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x78]
push str._Build:_d
push eax
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x14
cmp word [ebp - 0x11c], di
je 0x404477
cmp word [ebp - 0x11a], di
je 0x40444d
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040279f
test eax, eax
je 0x4043f7
cmp word [ebp - 0x11c], 6
jne 0x4043f7
cmp word [ebp - 0x11a], 1
jne 0x4043f7
push str._Service_Pack:_6a
jmp 0x404423
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402477
test eax, eax
je 0x40442d
cmp word [ebp - 0x11c], 1
jne 0x40442d
cmp word [ebp - 0x11a], 1
jne 0x40442d
push str._Service_Pack:_1a
lea eax, [ebp - 0x78]
push eax
call esi
pop ecx
pop ecx
jmp 0x404463
movzx eax, word [ebp - 0x11a]
push eax
movzx eax, word [ebp - 0x11c]
push eax
lea eax, [ebp - 0x78]
push str._Service_Pack:_d._d
push eax
call esi
add esp, 0x10
jmp 0x404463
movzx eax, word [ebp - 0x11c]
push eax
lea eax, [ebp - 0x78]
push str._Service_Pack:_d
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x404496
cmp word [ebp - 0x11a], di
je 0x404496
movzx eax, word [ebp - 0x11a]
push eax
lea eax, [ebp - 0x78]
push str._Service_Pack:0._d
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x3b0]
push 0x43153c
push eax
call sub.MSVCRT.dll_strcat
jmp 0x4044bb
lea eax, [ebp - 0x3b0]
push str.Failed_in_call_to_GetOSVersion_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov al, byte [0x4386b4]
pop ecx
pop ecx
mov byte [ebp - 0x5b8], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x5b7]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x101
push eax
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x40450f
push str.Current_user_:
push ebx
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x5b8]
push eax
push ebx
call sub.MSVCRT.dll_strcat
add esp, 0x10
mov al, byte [0x4386b4]
push 0x40
mov byte [ebp - 0x4b4], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x4b3]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x404557
push str._nComputerName_:
push ebx
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x4b4]
push eax
push ebx
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x6b8]
push 0xff
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x4045a3
lea eax, [ebp - 0x6b8]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x4045a3
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.WSOCK32.dll_inet_ntoa
mov esi, eax
test esi, esi
je 0x4045a3
push str._nIP_:
push ebx
call sub.MSVCRT.dll_strcat
push esi
push ebx
call sub.MSVCRT.dll_strcat
add esp, 0x10
push 0x43153c
push ebx
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x3b0]
push eax
push ebx
call sub.MSVCRT.dll_strcat
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.004275a4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret