Function at 0x10001850
Capabilities:
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x1002ffbb
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1003a2dc]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003a2dc]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa4]
push 2
xor ebx, ebx
push ebx
mov dword [esp + 0x64], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
and dword [esp + 0x2c], 0xfffffe00
mov ebp, 0x10
mov dword [esp + 0x58], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x9c], 1
mov ecx, dword [esp + 0x1c]
and ecx, 0xffffff04
or ecx, 0x104
push str.online
mov edi, 6
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push 0x10033a48
lea edx, [esp + 0x28]
push edx
mov ecx, 0x10033a4a
mov byte [esp + 0xa4], 2
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 1
call fcn.10008030
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x1c]
and ecx, 0xfffffe01
cdq
or ecx, 1
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
push 0x10033a54
lea edx, [esp + 0x28]
push edx
mov ecx, 0x10033a57
mov byte [esp + 0xa4], 3
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 1
call fcn.10008030
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x70], esp
mov edi, 7
push edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.Caption
mov word [esi + 4], bx
call fcn.10007370
sub esp, 0x1c
mov byte [esp + 0xd4], 4
mov esi, esp
mov dword [esp + 0x88], esp
push 0x15
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.Win32_OperatingSystem
mov word [esi + 4], bx
call fcn.10007370
lea eax, [esp + 0x6c]
push eax
mov byte [esp + 0xd8], 1
call fcn.100013e0
add esp, 0x3c
mov byte [esp + 0x9c], 5
mov ecx, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
and ecx, 0xffffff04
or ecx, 0x104
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebx
jb 0x10001a0f
mov eax, dword [eax + 4]
jmp 0x10001a12
add eax, 4
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push str.system
lea edx, [esp + 0x28]
push edx
mov ecx, 0x10033a5e
mov byte [esp + 0xa4], 6
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 5
call fcn.10008030
mov byte [esp + 0x9c], 1
cmp dword [esp + 0x4c], ebp
jb 0x10001a72
mov eax, dword [esp + 0x38]
push eax
call fcn.1001c079
add esp, 4
lea ecx, [esp + 0x34]
push ecx
call fcn.1000ba90
add esp, 4
mov byte [esp + 0x9c], 7
mov edx, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
and edx, 0xffffff04
or edx, 0x104
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
jb 0x10001aac
mov eax, dword [eax + 4]
jmp 0x10001aaf
add eax, 4
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push 0x10033a9c
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10033a9f
mov byte [esp + 0xa4], 8
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 7
call fcn.10008030
mov byte [esp + 0x9c], 1
cmp dword [esp + 0x4c], ebp
jb 0x10001b0f
mov ecx, dword [esp + 0x38]
push ecx
call fcn.1001c079
add esp, 4
call fcn.1000bee0
sub esp, 8
fstp qword [esp]
call fcn.1001c080
mov edx, dword [esp + 0x24]
fstp qword [esp + 0x1c]
and edx, 0xfffffe03
or edx, 3
add esp, 8
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
push 0x10033aa0
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10033aa3
mov byte [esp + 0xa4], 9
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 1
call fcn.10008030
lea esi, [esp + 0x34]
call fcn.1000bf60
mov byte [esp + 0x9c], 0xa
mov ecx, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
and ecx, 0xffffff04
or ecx, 0x104
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebx
jb 0x10001ba9
mov eax, dword [eax + 4]
jmp 0x10001bac
add eax, 4
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push 0x10033aa4
lea edx, [esp + 0x28]
push edx
mov ecx, 0x10033aa7
mov byte [esp + 0xa4], 0xb
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 0xa
call fcn.10008030
mov byte [esp + 0x9c], 1
cmp dword [esp + 0x4c], ebp
jb 0x10001c0c
mov eax, dword [esp + 0x38]
push eax
call fcn.1001c079
add esp, 4
lea esi, [esp + 0x34]
call fcn.1000c380
mov byte [esp + 0x9c], 0xc
mov ecx, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
and ecx, 0xffffff04
or ecx, 0x104
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebx
jb 0x10001c42
mov eax, dword [eax + 4]
jmp 0x10001c45
add eax, 4
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push str.name
lea edx, [esp + 0x28]
push edx
mov ecx, 0x10033aac
mov byte [esp + 0xa4], 0xd
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 0xc
call fcn.10008030
mov byte [esp + 0x9c], 1
cmp dword [esp + 0x4c], ebp
jb 0x10001ca5
mov eax, dword [esp + 0x38]
push eax
call fcn.1001c079
add esp, 4
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x10001d70
mov eax, dword [esp + 0x58]
push eax
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.100071a0
mov byte [esp + 0x9c], 0xe
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
and edx, 0xffffff04
or edx, 0x104
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
jae 0x10001d14
lea eax, [esp + 0x38]
mov edi, dword [esp + 0x48]
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push str.computer
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10033ab8
mov byte [esp + 0xa4], 0xf
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 0xe
call fcn.10008030
cmp dword [esp + 0x4c], ebp
jb 0x10001d70
mov ecx, dword [esp + 0x38]
push ecx
call fcn.1001c079
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esp + 0x1c]
and edx, 0xfffffe01
or edx, 1
mov dword [esp + 0x1c], edx
cdq
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
push 0x10033abc
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10033abf
mov byte [esp + 0xa4], 0x10
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 1
call fcn.10008030
lea ecx, [esp + 0x34]
call fcn.100011d0
mov byte [esp + 0x9c], 0x11
mov ecx, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
and ecx, 0xffffff04
or ecx, 0x104
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebx
jb 0x10001e02
mov eax, dword [eax + 4]
jmp 0x10001e05
add eax, 4
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push str.path
lea edx, [esp + 0x28]
push edx
mov ecx, 0x10033ac4
mov byte [esp + 0xa4], 0x12
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 0x11
call fcn.10008030
mov byte [esp + 0x9c], 1
cmp dword [esp + 0x4c], ebp
jb 0x10001e65
mov eax, dword [esp + 0x38]
push eax
call fcn.1001c079
add esp, 4
lea ecx, [esp + 0x34]
push ecx
call fcn.1000c020
add esp, 4
mov byte [esp + 0x9c], 0x13
mov edx, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
and edx, 0xffffff04
or edx, 0x104
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
jb 0x10001e9f
mov eax, dword [eax + 4]
jmp 0x10001ea2
add eax, 4
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push 0x10033ac8
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10033acb
mov byte [esp + 0xa4], 0x14
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 0x13
call fcn.10008030
cmp dword [esp + 0x4c], ebp
jb 0x10001efa
mov ecx, dword [esp + 0x38]
push ecx
call fcn.1001c079
add esp, 4
mov edx, dword [esp + 0x1c]
fld qword [0x10036368]
and edx, 0xfffffe03
fstp qword [esp + 0x14]
or edx, 3
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
push 0x10033acc
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10033acf
mov byte [esp + 0xa4], 0x15
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 1
call fcn.10008030
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x6c], esp
push 4
mov edi, 7
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.UUID
mov word [esi + 4], bx
call fcn.10007370
sub esp, 0x1c
mov byte [esp + 0xd4], 0x16
mov esi, esp
mov dword [esp + 0x8c], esp
push 0x1b
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.Win32_ComputerSystemProduct
mov word [esi + 4], bx
call fcn.10007370
lea ecx, [esp + 0x6c]
push ecx
mov byte [esp + 0xd8], 1
call fcn.100013e0
add esp, 0x3c
mov byte [esp + 0x9c], 0x17
mov edx, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
and edx, 0xffffff04
or edx, 0x104
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
jb 0x10001fe1
mov eax, dword [eax + 4]
jmp 0x10001fe4
add eax, 4
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push str.bios
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10033ad4
mov byte [esp + 0xa4], 0x18
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 0x17
call fcn.10008030
mov byte [esp + 0x9c], 1
cmp dword [esp + 0x4c], ebp
jb 0x10002044
mov ecx, dword [esp + 0x38]
push ecx
call fcn.1001c079
add esp, 4
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x6c], esp
push 0x16
mov edi, 7
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.OA3xOriginalProductKey
mov word [esi + 4], bx
call fcn.10007370
sub esp, 0x1c
mov byte [esp + 0xd4], 0x19
mov esi, esp
mov dword [esp + 0x8c], esp
push 0x18
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.SoftwareLicensingService
mov word [esi + 4], bx
call fcn.10007370
lea edx, [esp + 0x6c]
push edx
mov byte [esp + 0xd8], 1
call fcn.100013e0
add esp, 0x3c
mov byte [esp + 0x9c], 0x1a
mov ecx, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
and ecx, 0xffffff04
or ecx, 0x104
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebx
jb 0x100020d4
mov eax, dword [eax + 4]
jmp 0x100020d7
add eax, 4
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push str.Product
lea edx, [esp + 0x28]
push edx
mov ecx, 0x10033b17
mov byte [esp + 0xa4], 0x1b
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 0x1a
call fcn.10008030
mov byte [esp + 0x9c], 1
cmp dword [esp + 0x4c], ebp
jb 0x10002137
mov eax, dword [esp + 0x38]
push eax
call fcn.1001c079
add esp, 4
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x6c], esp
push 0xc
mov edi, 7
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.SerialNumber
mov word [esi + 4], bx
call fcn.10007370
sub esp, 0x1c
mov byte [esp + 0xd4], 0x1c
mov esi, esp
mov dword [esp + 0x8c], esp
push 0x15
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.Win32_OperatingSystem
mov word [esi + 4], bx
call fcn.10007370
lea ecx, [esp + 0x6c]
push ecx
mov byte [esp + 0xd8], 1
call fcn.100013e0
add esp, 0x3c
mov byte [esp + 0x9c], 0x1d
mov edx, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
and edx, 0xffffff04
or edx, 0x104
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
jb 0x100021c7
mov eax, dword [eax + 4]
jmp 0x100021ca
add eax, 4
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push 0x10033b7c
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10033b88
mov byte [esp + 0xa4], 0x1e
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 0x1d
call fcn.10008030
mov byte [esp + 0x9c], 1
cmp dword [esp + 0x4c], ebp
jb 0x1000222a
mov ecx, dword [esp + 0x38]
push ecx
call fcn.1001c079
add esp, 4
mov edx, dword [esp + 0x1c]
mov eax, dword [0x1003b658]
and edx, 0xffffff04
or edx, 0x104
cmp dword [0x1003b66c], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
jae 0x10002254
mov eax, 0x1003b658
mov edi, dword [0x1003b668]
push eax
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push 0x10033ba8
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10033bab
mov byte [esp + 0xa4], 0x1f
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 1
call fcn.10008030
mov ecx, dword [esp + 0x1c]
and ecx, 0xffffff04
or ecx, 0x104
push 0x10033bb4
mov edi, 3
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
call fcn.10007760
add esp, 4
mov dword [esp + 0x14], eax
push str.arch
lea edx, [esp + 0x28]
push edx
mov ecx, 0x10033bb0
mov byte [esp + 0xa4], 0x20
call fcn.10008a30
mov esi, eax
lea eax, [esp + 0x14]
call fcn.100080a0
lea eax, [esp + 0x14]
mov byte [esp + 0x9c], 1
call fcn.10008030
lea esi, [esp + 0x60]
lea ecx, [esp + 0x24]
call fcn.10009150
mov byte [esp + 0x9c], 0x21
cmp dword [esp + 0x78], ebp
mov eax, dword [esp + 0x64]
jae 0x10002328
lea eax, [esp + 0x64]
push ebx
push 2
push eax
mov eax, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0x6c]
push str.ONLINE
call fcn.10014630
add esp, 0x14
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x78], ebp
jb 0x1000235e
mov ecx, dword [esp + 0x64]
push ecx
call fcn.1001c079
add esp, 4
lea eax, [esp + 0x24]
mov dword [esp + 0x78], 0xf
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
mov dword [esp + 0x9c], 0xffffffff
call fcn.10008030
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1001b9a0
add esp, 0x8c
ret