Function at 0x406b30
Capabilities:
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x42a739
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x434568]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push edi
mov eax, dword [0x434568]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x264], ebx
mov ebp, dword [esp + 0x26c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], esi
mov dword [esi], ebx
mov dword [esp + 0x264], ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 4
push ebp
mov dword [esp + 0x38], 1
call sub.WINSPOOL.DRV_GetPrinterW
test eax, eax
jne 0x406ddf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x406ddf
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00416539
mov edi, eax
add esp, 4
mov dword [esp + 0x20], edi
cmp edi, ebx
je 0x406ddf
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push eax
push edi
push 4
push ebp
call sub.WINSPOOL.DRV_GetPrinterW
test eax, eax
je 0x406dd6
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x30], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
push eax
lea ecx, [esp + 0x14]
call fcn.004010b0
mov dword [esp + 0x264], 1
lea ecx, [esp + 0x10]
call fcn.00403850
test al, al
jne 0x406db0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [ebx + 6]
lea edx, [esp + 0x14]
call fcn.004028c0
mov byte [esp + 0x264], 2
push str.CSR
push eax
call fcn.004019b0
mov bl, al
mov byte [esp + 0x264], 1
lea ecx, [esp + 0x14]
call fcn.00401220
test bl, bl
je 0x406c8c
lea edx, [esp + 0x14]
push edx
mov edi, 6
lea ecx, [esp + 0x14]
call fcn.00402850
mov byte [esp + 0x264], 3
jmp 0x406ce4
lea eax, [esp + 0x14]
push eax
mov ecx, 2
lea edx, [esp + 0x14]
call fcn.004028c0
mov byte [esp + 0x264], 4
push 0x42efb8
push eax
call fcn.004019b0
mov bl, al
mov byte [esp + 0x264], 1
lea ecx, [esp + 0x14]
call fcn.00401220
test bl, bl
je 0x406d05
lea ecx, [esp + 0x14]
push ecx
mov edi, 2
lea ecx, [esp + 0x14]
call fcn.00402850
mov byte [esp + 0x264], 5
push eax
lea ecx, [esp + 0x14]
call fcn.00401410
mov byte [esp + 0x264], 1
lea ecx, [esp + 0x14]
call fcn.00401220
mov edi, dword [esp + 0x20]
jmp 0x406d25
cmp dword [esp + 0x18], 0
je 0x406d1c
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x14]
call fcn.004015a0
jmp 0x406d25
lea eax, [esp + 0x10]
call fcn.004036a0
lea eax, [esp + 0x10]
push eax
call fcn.00401e40
cmp dword [esp + 0x18], 0
je 0x406db0
lea ecx, [esp + 0x10]
call fcn.004034f0
lea edx, [esp + 0x30]
call fcn.004035b0
test eax, eax
je 0x406db0
lea ecx, [esp + 0x18]
push ecx
push 0x208
lea edx, [esp + 0x58]
push edx
push 0
push str.printerName
push str.DsSpooler
push ebp
mov dword [esp + 0x34], 0x208
call sub.WINSPOOL.DRV_GetPrinterDataExW
test eax, eax
jne 0x406db0
cmp dword [esp + 0x18], 2
jbe 0x406db0
lea eax, [esp + 0x50]
push eax
push 0x42ef7c
lea ecx, [esp + 0x18]
push ecx
push 0x42efb8
mov ecx, esi
call fcn.00403770
mov ecx, eax
call fcn.004016d0
mov ecx, eax
call fcn.00403770
mov ecx, eax
call fcn.004036c0
mov ecx, esi
call fcn.00403850
test al, al
je 0x406dc5
mov edx, dword [edi]
push edx
mov ecx, esi
call fcn.004015a0
mov byte [esp + 0x264], 0
lea ecx, [esp + 0x10]
call fcn.00401220
push edi
call fcn.00416603
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.004158f6
add esp, 0x258
ret 4