Function at 0x402c40
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
push ebp
push esi
lea eax, [esp + 0x78]
push edi
push eax
mov dword [esp + 0x80], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test al, al
jne 0x402c72
pop edi
pop esi
mov eax, 0x1adbf
pop ebp
add esp, 0x104
ret
mov eax, dword [esp + 0x8c]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
dec eax
je 0x402d43
dec eax
je 0x402c9e
pop edi
pop esi
mov eax, 0x1adbf
pop ebp
add esp, 0x104
ret
mov edx, dword [0x4113d4]
mov ecx, dword [str.Windows_NT]
mov ax, word [0x4113d8]
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
mov cl, byte [0x4113da]
lea edx, [esp + 0xc]
push 0x20
push edx
mov word [esp + 0x40], ax
mov byte [esp + 0x42], cl
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
jne 0x402ce9
lea eax, [esp + 0xc]
push str.NDSRVW95.EXE
push eax
call ebp
jmp 0x402e1b
lea ecx, [esp + 0xc]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x402e1b
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov dl, byte [eax + 1]
mov cl, byte [eax]
and edx, 0xff
and ecx, 0xff
mov esi, edx
mov dl, byte [eax + 2]
mov al, byte [eax + 3]
and edx, 0xff
and eax, 0xff
push eax
push edx
push esi
push ecx
lea eax, [esp + 0x78]
push str.__u._u._u._u_
push eax
call fcn.004074c6
add esp, 0x18
lea ecx, [esp + 0x68]
jmp 0x402e13
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x402d78
mov eax, dword [str.Windows_95]
mov ecx, dword [0x4113a8]
mov dx, word [0x4113ac]
mov dword [esp + 0x30], eax
mov al, byte [0x4113ae]
mov dword [esp + 0x34], ecx
mov word [esp + 0x38], dx
mov byte [esp + 0x3a], al
jmp 0x402da3
jbe 0x402da3
mov ecx, dword [str.Windows_98]
mov edx, dword [0x41139c]
mov ax, word [0x4113a0]
mov dword [esp + 0x30], ecx
mov cl, byte [0x4113a2]
mov dword [esp + 0x34], edx
mov word [esp + 0x38], ax
mov byte [esp + 0x3a], cl
lea edx, [esp + 0xc]
push 0x20
push edx
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
jne 0x402dc2
lea eax, [esp + 0xc]
push str.NDSRVW95.EXE
push eax
call ebp
jmp 0x402e1b
lea ecx, [esp + 0xc]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x402e1b
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov dl, byte [eax + 1]
mov cl, byte [eax]
and edx, 0xff
and ecx, 0xff
mov esi, edx
mov dl, byte [eax + 2]
mov al, byte [eax + 3]
and edx, 0xff
and eax, 0xff
push eax
push edx
push esi
push ecx
lea eax, [esp + 0x78]
push str.__u._u._u._u_
push eax
call fcn.004074c6
add esp, 0x18
lea ecx, [esp + 0x68]
lea edx, [esp + 0xc]
push ecx
push edx
call edi
mov cx, word [esp + 0x84]
mov ax, word [esp + 0x80]
mov dx, word [0x411301]
mov word [esp + 0x46], cx
mov word [esp + 0x44], ax
mov ax, word [0x411303]
lea ecx, [esp + 0x48]
push 0x4147ac
push ecx
mov word [esp + 0x34], dx
mov word [esp + 0x36], ax
call ebp
test byte [0x414794], 4
je 0x402e6d
lea edx, [esp + 0x48]
push str.UDP
push edx
call edi
test byte [0x414794], 8
je 0x402e82
lea eax, [esp + 0x48]
push str.TCP
push eax
call edi
test byte [0x414794], 1
je 0x402e97
lea ecx, [esp + 0x48]
push str.IPX
push ecx
call edi
test byte [0x414794], 0x10
je 0x402eac
lea edx, [esp + 0x48]
push 0x411378
push edx
call edi
mov eax, dword [esp + 0x114]
mov ecx, 0x17
lea esi, [esp + 0xc]
lea edi, [eax + 0x25]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
add esp, 0x104
ret