Function at 0x11077e3a
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111de3d1
mov eax, dword fs:[0]
push eax
sub esp, 0x7fc
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1127aa58]
push 8
mov dword [ebp - 0x7d0], eax
call fcn.111709c0
add esp, 4
mov dword [ebp - 0x7a4], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp eax, ecx
je 0x11077cb8
mov ecx, dword [0x1127aa44]
push ecx
mov ecx, eax
call fcn.111b82f0
mov dword [ebp - 0x7bc], eax
jmp 0x11077cbe
mov dword [ebp - 0x7bc], ecx
xor edi, edi
push edi
push 0x11247f3c
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov dword [ebp - 0x7b8], edi
call fcn.111b7990
mov ebx, eax
xor edx, edx
add esp, 8
mov dword [ebp - 0x7d4], ebx
mov word [ebp - 0x79c], dx
call fcn.111babb0
test al, al
je 0x11077dcb
mov eax, dword [0x1127aa68]
push eax
call fcn.11070720
add esp, 4
lea ecx, [ebp - 0x7a0]
call fcn.11143200
push 0x20119
push str.SoftwarePoliciesNetSupportclassroom.cloud
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x7a0]
mov dword [ebp - 4], 1
call fcn.111435f0
push edi
push str.StartupWithOU
lea ecx, [ebp - 0x7a0]
call fcn.111436a0
test eax, eax
je 0x11077d4d
lea esi, [edi + 1]
push 0
push str.StartupWithGroups
lea ecx, [ebp - 0x7a0]
call fcn.111436a0
test eax, eax
je 0x11077d66
or esi, 2
lea ecx, [ebp - 0x19c]
call fcn.1106faa0
lea ecx, [ebp - 0x19c]
push esi
push ecx
mov byte [ebp - 4], 2
call fcn.11073640
mov eax, dword [0x1127aa68]
lea edx, [ebp - 0x19c]
push edx
push eax
call fcn.11073ef0
mov ecx, dword [0x1127aa68]
push 0
push ecx
mov esi, 1
call fcn.11069350
add esp, 0x18
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 1
call fcn.1106fbb0
lea ecx, [ebp - 0x7a0]
mov dword [ebp - 4], 0xffffffff
call fcn.11143c00
mov ecx, dword [ebp - 0x7bc]
push 0x100
lea edx, [ebp - 0x39c]
push edx
mov dword [ebp - 0x7a4], 0xb
call fcn.111b8360
test eax, eax
je 0x11077f73
cmp eax, 0xffffffff
jne 0x11077e1d
xor eax, eax
jmp 0x11077e00
movzx ecx, word [ebp + eax - 0x39c]
mov word [ebp + eax - 0x79c], cx
add eax, 2
test cx, cx
jne 0x11077e00
jmp case.0x11077e33.69
and eax, 0xffffffdf
add eax, 0xffffffbd
cmp eax, 0x12
ja case.0x11077e33.69
movzx eax, byte [eax + 0x11078bc0]
jmp dword [eax*4 + 0x11078b98]
test esi, esi
jne case.0x11077e33.69
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
lea ecx, [ebp - 0x39c]
push esi
push ecx
call fcn.111b7990
lea edx, [ebp - 0x39c]
push 0xb
push edx
xor ecx, ecx
mov edx, ebx
mov edi, eax
call fcn.1106cc30
add esp, 0x14
mov esi, eax
jmp case.0x11077e33.69
cmp word [ebp - 0x39c], 0
je 0x11077e97
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
add esp, 4
mov dword [0x1127b210], eax
jmp case.0x11077e33.69
mov dword [0x1127b210], 1
jmp case.0x11077e33.69
mov dword [0x1127b880], 1
jmp case.0x11077e33.69
mov dword [0x1127aa4c], 1
jmp case.0x11077e33.69
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
lea ecx, [ebp - 0x39c]
push 0
push ecx
call fcn.111b7990
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
mov ebx, eax
mov eax, dword [edx + 0xac]
add esp, 0xc
push ebx
call eax
jmp case.0x11077e33.69
mov dword [0x1127ac2c], 1
jmp case.0x11077e33.69
push 0x1f
lea ecx, [ebp - 0x39c]
push ecx
push 0x1127ac64
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
jmp case.0x11077e33.69
lea edx, [ebp - 0x39a]
push edx
call dword [sym.imp.MSVCR100.dll__wtoi]
add esp, 4
inc eax
mov dword [0x1127ad10], eax
jmp case.0x11077e33.69
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
dec eax
add esp, 4
neg eax
sbb eax, eax
inc eax
mov dword [0x11276070], eax
push 0x100
lea ecx, [ebp - 0x39c]
push ecx
mov ecx, dword [ebp - 0x7bc]
call fcn.111b8360
test eax, eax
jne 0x11077df4
mov dword [ebp - 0x7d4], ebx
mov dword [ebp - 0x7b8], edi
test esi, esi
jne 0x110784c6
cmp byte [0x1127ad8d], 0
je 0x110783a3
mov edx, dword [0x1127aa68]
mov ecx, dword [edx + 0x2c]
push 3
push 0x1124b64c
push str.Usernames
push str.Client
call fcn.110bbcf0
mov eax, dword [0x1127aa68]
mov ecx, dword [eax + 0x2c]
push 3
push 1
push str.DisableChatMenu
push str.Client
call fcn.110bbd40
mov ecx, dword [0x1127aa68]
mov ecx, dword [ecx + 0x2c]
push 3
push 1
push str.DisableRequestHelp
push str.Client
call fcn.110bbd40
mov edx, dword [0x1127aa68]
mov ecx, dword [edx + 0x2c]
push 3
push esi
push str.SysTray
push str.Client
call fcn.110bbd40
mov eax, dword [0x1127aa68]
mov ecx, dword [eax + 0x2c]
push 3
push 1
push str.DisableAudioFilter
push str.Audio
call fcn.110bbd40
mov ecx, dword [0x1127aa68]
mov ecx, dword [ecx + 0x2c]
push 3
push 1
push str.NoAckWhenLoggedOff
push str.Client
call fcn.110bbd40
mov edx, dword [0x1127aa68]
mov ecx, dword [edx + 0x2c]
push 3
push 1
push str.DisableAudio
push str.Client
call fcn.110bbd40
mov eax, dword [0x1127aa68]
mov ecx, dword [eax + 0x2c]
push 3
push 1
push str.DisableRunplugin
push str.Client
call fcn.110bbd40
mov ecx, dword [0x1127aa68]
mov ecx, dword [ecx + 0x2c]
push 3
push 1
push 0x1120a004
push str.Client
call fcn.110bbd40
mov edx, dword [0x1127aa68]
mov ecx, dword [edx + 0x2c]
push 3
push esi
push str.MinimumEncryption
push str.Client
call fcn.110bbd40
mov eax, dword [0x1127aa68]
mov ecx, dword [eax + 0x2c]
push 3
push esi
push str.DisableCloseApps
push str.Client
call fcn.110bbd40
push 3
push esi
push str.DisableManageServices
push str.Client
mov ecx, dword [0x1127aa68]
mov ecx, dword [ecx + 0x2c]
call fcn.110bbd40
mov edx, dword [0x1127aa68]
mov ecx, dword [edx + 0x2c]
push 3
push 1
push str.Shared
push str.Client
call fcn.110bbd40
mov eax, dword [0x1127aa68]
mov ecx, dword [eax + 0x2c]
push 3
push 1
push 0x11207700
push str._License
call fcn.110bbd40
mov ecx, dword [0x1127aa68]
mov ecx, dword [ecx + 0x2c]
push 3
push 1
push str.Silent
push str.Client
call fcn.110bbd40
push 3
push 2
push str.trace
push str._debug
mov ecx, 0x1127aa10
call fcn.11065190
push 3
push 2
push str.tracefile
push str._debug
mov ecx, 0x1127aa10
call fcn.11065190
lea ecx, [ebp - 0x7a0]
mov esi, 0x1777
call fcn.11143200
push 0x20019
push str.SOFTWARENetSupport_LtdNetSupport_DNAClientRemoteControl
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x7a0]
mov dword [ebp - 4], 3
call fcn.111435f0
test eax, eax
jne 0x11078207
lea ecx, [ebp - 0x7cc]
call fcn.1113dd30
lea edx, [ebp - 0x7cc]
push edx
push str.Port
lea ecx, [ebp - 0x7a0]
mov byte [ebp - 4], 4
call fcn.11143880
test eax, eax
jne 0x110781df
lea ecx, [ebp - 0x7cc]
call fcn.11058100
test eax, eax
je 0x110781df
lea ecx, [ebp - 0x7cc]
call fcn.1102f630
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x7a0]
call fcn.111435b0
push esi
push str.Use_port__d_for_DNA_r_c
call fcn.111bd7b0
add esp, 8
lea ecx, [ebp - 0x7cc]
mov byte [ebp - 4], 3
call fcn.1113cd80
push 0x20019
push str.SOFTWARENetSupport_LtdNetSupport_DNAClient
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x7a0]
call fcn.111435f0
test eax, eax
jne 0x110782e0
lea eax, [ebp - 0x7a4]
push eax
push str.ServerKey
lea ecx, [ebp - 0x7a0]
call fcn.11143790
test eax, eax
jne 0x110782d5
push str.Setting_security_key_for_DNA_r_c
call fcn.111bd7b0
add esp, 4
lea ecx, [ebp - 0x7cc]
call fcn.1113dd30
mov ecx, dword [ebp - 0x7a4]
push ecx
lea edx, [ebp - 0x7cc]
push 0x1120b470
push edx
mov byte [ebp - 4], 5
call fcn.1113d940
add esp, 0xc
lea ecx, [ebp - 0x7cc]
call fcn.1102f630
push 0xfde9
push 0x100
lea ecx, [ebp - 0x59c]
push ecx
push eax
push 0
call fcn.11144ee0
mov eax, dword [0x1127aa68]
mov ecx, dword [eax + 0x2c]
add esp, 0x14
push 3
lea edx, [ebp - 0x59c]
push edx
push str.SecurityKey
push str.Client
call fcn.110bbcf0
lea ecx, [ebp - 0x7cc]
mov byte [ebp - 4], 3
call fcn.1113cd80
lea ecx, [ebp - 0x7a0]
call fcn.111435b0
push 0x20019
push str.SoftwarepoliciesNetSupportNetSupport_DNA
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x7a0]
mov edi, 0x4e20
call fcn.111435f0
test eax, eax
jne 0x1107832a
lea ecx, [ebp - 0x7a4]
push ecx
push str.RemoteControlBaseTSPort
lea ecx, [ebp - 0x7a0]
call fcn.11143790
test eax, eax
jne 0x1107832a
mov eax, dword [ebp - 0x7a4]
test eax, eax
je 0x1107832a
mov edi, eax
mov edx, dword [0x1127aa68]
mov ecx, dword [edx + 0x2c]
push 3
push esi
push str.Port
push str.TCPIP
call fcn.110bbd40
mov eax, dword [0x1127aa68]
mov ecx, dword [eax + 0x2c]
push 3
push edi
push str.BasePort
push 0x11218928
call fcn.110bbd40
mov ecx, dword [0x1127aa68]
push 0
push ecx
call fcn.11069350
mov edx, dword [0x1127aa68]
mov ecx, dword [edx + 0x30]
add esp, 8
push 3
push 0x17
push 0x111fb860
push str._License
call fcn.110bbd40
lea ecx, [ebp - 0x7a0]
mov dword [ebp - 4], 0xffffffff
call fcn.11143c00
jmp 0x110784c6
test edi, edi
jne 0x110783be
push 1
push str.client32u.ini
call fcn.111bb700
mov edi, eax
add esp, 8
mov dword [ebp - 0x7b8], edi
push 0
push edi
call fcn.111be4e0
add esp, 8
test eax, eax
jne 0x110783ea
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
push 1
push str.client32.ini
call fcn.111bb700
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x7b8], edi
cmp dword [0x1127ace4], 0
mov dword [ebp - 0x7a0], 0xffffffff
mov eax, 0xf
jne 0x11078408
mov eax, dword [ebp - 0x7a4]
push eax
push edi
lea ecx, [ebp - 0x7a0]
mov edx, ebx
call fcn.1106cc30
add esp, 8
test eax, eax
jne 0x110784c6
call fcn.11123260
push eax
mov eax, dword [ebp - 0x7a0]
push edi
push eax
push str.Error_x_x_reading__s__sesh_d_n
call fcn.111bd7b0
add esp, 0x10
cmp dword [ebp - 0x7a0], 0x91
jne 0x11078452
mov byte [0x1127ad28], 1
jmp 0x110784c6
cmp dword [0x1127ad00], 0
jne 0x110784bc
call fcn.11065670
test al, al
jne 0x110784bc
mov eax, dword [ebp - 0x7a0]
mov ecx, dword [ebp - 0x7d0]
mov edx, dword [ecx]
xor ebx, ebx
cmp eax, 0x82
push eax
mov eax, dword [edx + 4]
sete bl
push edi
push 0
lea ebx, [ebx*8 + 0x1f41]
push ebx
push ecx
call eax
add esp, 0x14
cmp dword [0x1127acfc], 0
jne 0x110784a3
cmp dword [0x1127ad10], 0
je 0x110784b5
push 0x7d0
push 0x1127ae98
call fcn.1114d3c0
add esp, 8
push 1
call fcn.110773b0
mov dword [0x1127ad04], 1
push str.nsmtrace.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x110784e9
mov ecx, dword [0x1127aa68]
push ecx
push 0x11063bd0
call fcn.111bd6b0
add esp, 8
cmp dword [0x1127aa4c], 0
jne 0x11078548
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.DisableConsoleClient
push 0x11218928
call fcn.110bbc00
test eax, eax
je 0x11078548
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x154]
call eax
test al, al
je 0x11078548
mov dword [0x1127aa4c], 3
mov eax, dword [0x1127ad10]
test eax, eax
je 0x11078754
cmp eax, 1
jne 0x1107856e
call fcn.11123260
mov esi, eax
jmp 0x11078571
push 1
call fcn.11069ec0
add esp, 4
test al, al
je 0x1107852d
mov eax, dword [0x1127ad10]
test eax, eax
jne 0x1107853a
mov dword [0x1127aa4c], 3
jmp 0x11078754
lea esi, [eax - 1]
push 3
push 1
push str.TSMode
push str.Client
mov ecx, 0x1127aa10
call fcn.11065190
push esi
call fcn.110654e0
add esp, 4
push 3
push eax
push 0x1120b310
push str.TCPIP
mov ecx, 0x1127aa10
call fcn.11065190
cmp dword [0x1127aa48], 0x180003
jge 0x110785cd
push 3
push 1
push str.screenscrape
push str.Client
mov ecx, 0x1127aa10
call fcn.11065190
push str.Wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edi, edi
mov dword [ebp - 0x808], eax
mov dword [ebp - 0x804], edi
mov dword [ebp - 0x800], edi
mov dword [ebp - 0x7fc], edi
mov dword [ebp - 0x7f8], edi
mov dword [ebp - 0x7f4], edi
mov dword [ebp - 0x7f0], edi
mov dword [ebp - 0x7e8], edi
mov dword [ebp - 0x7ec], edi
mov dword [ebp - 0x7e4], edi
mov dword [ebp - 0x7e0], edi
mov dword [ebp - 0x7dc], edi
lea ecx, [ebp - 0x808]
mov dword [ebp - 4], 6
mov dword [ebp - 0x7a8], ecx
mov dword [ebp - 0x7b0], edi
mov dword [ebp - 0x7ac], edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSQuerySessionInformationW
push eax
mov byte [ebp - 4], 7
call ebx
mov dword [ebp - 0x7e8], eax
cmp eax, edi
je 0x1107871e
lea edx, [ebp - 0x7ac]
push edx
lea ecx, [ebp - 0x7b0]
push ecx
push 0xe
push 0xffffffffffffffff
push edi
call eax
cmp eax, edi
je 0x110786e8
mov esi, dword [ebp - 0x7b0]
cmp dword [esi], 2
jne 0x110786e8
movzx edx, byte [esi + 9]
movzx eax, byte [esi + 8]
movzx ecx, byte [esi + 7]
push edx
movzx edx, byte [esi + 6]
push eax
push ecx
push edx
push str.Trying_to_get_mac_addr_for__u._u._u._u_n
call fcn.111bd7b0
movzx ecx, byte [esi + 6]
push 0x11247f3c
lea eax, [ebp - 0x2c]
push eax
push ecx
call fcn.1119c4b0
add esp, 0x20
test eax, eax
je 0x110786e8
lea edx, [ebp - 0x2c]
push edx
push str.ts_macaddr_s_n
call fcn.111bd7b0
add esp, 8
push 3
lea eax, [ebp - 0x2c]
push eax
push 0x1120a9a0
push str.Client
mov ecx, 0x1127aa10
call fcn.110651d0
mov eax, dword [ebp - 0x7b0]
mov byte [ebp - 4], 6
cmp eax, edi
je 0x1107873c
mov edi, eax
mov eax, dword [ebp - 0x7a8]
cmp dword [eax + 0x14], 0
lea esi, [eax + 0x14]
jne 0x11078713
mov ecx, dword [eax]
push str.WTSFreeMemory
push ecx
call ebx
mov dword [esi], eax
mov esi, dword [esi]
test esi, esi
je 0x11078728
push edi
call esi
jmp 0x11078730
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x110786e8
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x7b0], 0
xor edi, edi
mov eax, dword [ebp - 0x808]
mov dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x11078754
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x7d8]
push edx
lea eax, [ebp - 0xac]
push eax
push 5
mov dword [ebp - 0x7d8], 0x40
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
cmp dword [0x1127ad10], 0
je 0x110787b5
mov ecx, dword [0x1127aa68]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push 0
push 0x200
lea eax, [ebp - 0x79c]
push eax
push str.ClientName
push 0x11218928
call edx
mov eax, 0xf
call fcn.11065530
cmp dword [0x1127ad10], 0
jne 0x1107881b
cmp word [ebp - 0x79c], 0
je 0x110787ff
mov ecx, 0x1124b64c
lea eax, [ebp - 0x79c]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x110787f6
test dx, dx
je 0x110787f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x110787f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x110787d0
xor eax, eax
jmp 0x110787fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1107881b
push 0x3f
lea eax, [ebp - 0xac]
push eax
push 0x1127aa8c
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
jmp 0x11078a24
mov esi, dword [sym.imp.MSVCR100.dll_wcschr]
xor ecx, ecx
mov word [ebp - 0x59c], cx
cmp word [ebp - 0x79c], cx
jne 0x1107884a
call fcn.11123260
push eax
lea edx, [ebp - 0x59c]
push edx
call fcn.11067960
add esp, 8
jmp 0x110788a8
lea eax, [ebp - 0x79c]
push 0x25
push eax
call esi
add esp, 8
test eax, eax
je 0x11078881
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xf4]
push 0x100
lea eax, [ebp - 0x59c]
push eax
lea eax, [ebp - 0x79c]
push eax
call edx
jmp 0x110788a8
xor eax, eax
jmp 0x11078890
movzx ecx, word [ebp + eax - 0x79c]
mov word [ebp + eax - 0x59c], cx
add eax, 2
test cx, cx
jne 0x11078890
lea eax, [ebp - 0x59c]
push 0x25
push eax
call esi
add esp, 8
test eax, eax
je 0x11078a02
lea ecx, [ebp - 0x59c]
push ecx
push str.Warning:_Unexpanded_clientname__s__n
call fcn.111bd7b0
add esp, 8
push 0x100
lea ecx, [ebp - 0x7b4]
call fcn.1113c0e0
lea edx, [ebp - 0x59c]
push edx
lea ecx, [ebp - 0x7b4]
mov dword [ebp - 4], 8
call fcn.1113dbf0
call fcn.11123260
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea eax, [ebp - 0x28]
push str._02d
push eax
call esi
call fcn.11123260
push eax
lea ecx, [ebp - 0xac]
push ecx
lea edx, [ebp - 0x12c]
push str._s._02d
push edx
call esi
mov eax, dword [ebp - 0x7b4]
mov edx, dword [eax]
add esp, 0x1c
lea ecx, [ebp - 0x7b4]
call edx
test al, al
jne 0x11078958
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
mov eax, dword [ebp - 0x7a8]
push str._sessionname_
push eax
call fcn.11198bf0
add esp, 8
test eax, eax
je 0x11078987
lea ecx, [ebp - 0x12c]
push ecx
push str._sessionname_
lea ecx, [ebp - 0x7b4]
call fcn.1113d1c0
lea edx, [ebp - 0x28]
push edx
push str._session_
lea ecx, [ebp - 0x7b4]
call fcn.1113d1c0
lea eax, [ebp - 0x28]
push eax
push 0x1120b1d4
lea ecx, [ebp - 0x7b4]
call fcn.1113d1c0
mov edx, dword [ebp - 0x7b4]
mov eax, dword [edx]
lea ecx, [ebp - 0x7b4]
call eax
test al, al
jne 0x110789d7
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
mov ecx, dword [ebp - 0x7a8]
push 0x3f
push ecx
push 0x1127aa8c
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
lea ecx, [ebp - 0x7b4]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
jmp 0x11078a19
push 0x3f
lea edx, [ebp - 0x59c]
push edx
push 0x1127aa8c
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
push 0x1127aa8c
call dword [sym.imp.USER32.dll_CharUpperW]
mov edi, dword [ebp - 0x7b8]
mov eax, dword [0x1127aa58]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push edi
push 0
push 0x416
push eax
call edx
add esp, 0x10
cmp dword [0x1127aa4c], 0
jne 0x11078a74
cmp word [0x1127aa8c], 0
jne 0x11078a74
mov eax, dword [ebp - 0x7d0]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push 0
push 0x415
push eax
call edx
add esp, 0xc
push 1
call fcn.110773b0
mov esi, dword [ebp - 0x7bc]
test esi, esi
je 0x11078a8e
mov ecx, esi
call fcn.11062fa0
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0x7d4]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
push 0x111fa851
push str.client32_dbi__hs_n
call fcn.111bd7b0
mov ecx, dword [0x1127ad00]
mov edx, dword [0x1127acfc]
mov eax, dword [0x1127ad10]
push ecx
push edx
push eax
push 0x1127aa8c
lea ecx, [ebp - 0xac]
push ecx
push str.computername_s__clientname_s__tsmode_d__vui_d__vsvc_d_n
call fcn.111bd7b0
add esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.11144250
movzx edx, al
push edx
call fcn.11065590
movzx eax, al
push eax
push str.multipoint_d__softxpand_d__pid_d_n
call fcn.111bd7b0
add esp, 0x10
call fcn.111babb0
test al, al
je 0x11078b7a
lea ecx, [ebp - 0x7cc]
call fcn.1113dd30
lea ecx, [ebp - 0x7cc]
push ecx
mov dword [ebp - 4], 9
call fcn.1106b050
mov edx, dword [ebp - 0x7cc]
mov eax, dword [edx]
add esp, 4
lea ecx, [ebp - 0x7cc]
call eax
test al, al
jne 0x11078b54
push 0x261
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
mov ecx, dword [ebp - 0x7c0]
push ecx
push str.cicVer_s_n
call fcn.111bd7b0
add esp, 8
lea ecx, [ebp - 0x7cc]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret