Function at 0x426ffb
Capabilities:
Get hostname
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9e4
mov eax, dword [0x518764]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x9cc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x9e4], ebx
push 0x9c6
push edi
push eax
mov dword [ebp - 0x9d0], edi
call fcn.004a7f20
add esp, 0xc
mov dword [ebp - 0x9dc], edi
test esi, esi
je 0x42732f
test ebx, ebx
je 0x42732f
push 0x4dfc50
push ebx
call fcn.004afdb4
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x427083
call fcn.004abdc7
push str.Failed_to_open_the_initialization_file.
push dword [eax]
push 3
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffffc
jmp 0x427331
push 2
push edi
push ebx
call fcn.004aefc8
push ebx
call fcn.004b61bd
push edi
push edi
push ebx
mov dword [ebp - 0x9d4], eax
call fcn.004aefc8
mov eax, dword [ebp - 0x9d4]
add esp, 0x1c
cmp eax, 1
jge 0x4270d1
push ebx
call fcn.004ae483
mov dword [esp], str.Invalid_initialization_file.
push 0xfffffffffffffff6
push 3
push 3
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffff6
jmp 0x427331
add eax, 0xa
push eax
mov dword [ebp - 0x9e0], eax
call fcn.004ac04c
mov dword [ebp - 0x9d8], eax
pop ecx
test eax, eax
jne 0x42710e
push ebx
call fcn.004ae483
mov dword [esp], str.Memory_allocation_error_during_the_reading_of_the_intialization_fie.
push 0xfffffffffffffff3
push 3
push 3
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffff3
jmp 0x427331
push dword [ebp - 0x9e0]
push edi
push eax
call fcn.004a7f20
mov eax, dword [ebp - 0x9d4]
push ebx
push eax
push 1
push dword [ebp - 0x9d8]
call fcn.004aeb87
push ebx
mov dword [ebp - 0x9d4], eax
call fcn.004ae483
push dword [ebp - 0x9d4]
lea eax, [ebp - 0x9d0]
push dword [ebp - 0x9d8]
push eax
push str.Password
call fcn.00421594
add esp, 0x30
test eax, eax
jne 0x4271bf
mov ecx, dword [ebp - 0x9d0]
test ecx, ecx
je 0x4271bf
movsx eax, byte [ecx]
mov ebx, edi
jmp 0x42718e
cmp ebx, 0x9c5
jae 0x427199
mov ecx, dword [ebp - 0x9d0]
mov al, byte [ebx + ecx]
mov byte [ebp + ebx - 0x9cc], al
inc ebx
movsx eax, byte [ebx + ecx]
push eax
call fcn.004b6356
pop ecx
test eax, eax
jne 0x427171
push 0xf
lea eax, [ebp - 0x9cc]
push str.NewKaseyaAgent
push eax
call fcn.004af8b0
add esp, 0xc
test eax, eax
jne 0x4271d2
mov dword [esi + 0x23c], 1
jmp 0x4271d2
push str.Failed_to_determine_if_initialization_file_may_be_updated.
push eax
push 3
push 3
push esi
call fcn.00429952
add esp, 0x14
push dword [ebp - 0x9d4]
lea eax, [ebp - 0x9d0]
push dword [ebp - 0x9d8]
push eax
push str.User_Name
call fcn.00421594
add esp, 0x10
test eax, eax
je 0x42720e
push str.Failed_to_determine_groupid_from_initialization_file.
push eax
push 1
push 3
push esi
call fcn.00429952
add esp, 0x14
jmp 0x4272bc
mov ebx, dword [ebp - 0x9d0]
test ebx, ebx
je 0x4272bc
push 0x9c6
lea eax, [ebp - 0x9cc]
push edi
push eax
call fcn.004a7f20
add esp, 0xc
cmp byte [ebx], 0x2e
jne 0x4272bc
inc ebx
mov dword [ebp - 0x9d0], ebx
movsx eax, byte [ebx]
jmp 0x427278
mov eax, dword [ebp - 0x9d0]
movsx eax, byte [edi + eax]
push eax
call fcn.004b640c
pop ecx
test eax, eax
jne 0x427283
cmp edi, 0x9c5
jae 0x427283
mov ecx, dword [ebp - 0x9d0]
mov al, byte [edi + ecx]
mov byte [ebp + edi - 0x9cc], al
inc edi
movsx eax, byte [edi + ecx]
push eax
call fcn.004b6385
pop ecx
test eax, eax
je 0x427246
lea ecx, [ebp - 0x9cc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42728c
sub ecx, edx
cmp ecx, 1
jbe 0x4272bc
push 0x50
lea eax, [ebp - 0x9cc]
push eax
lea eax, [esi + 0x2c4]
push eax
call fcn.004af750
add esp, 0xc
mov dword [esi + 0x2c0], 5
push dword [ebp - 0x9d8]
call fcn.004ac047
lea ebx, [esi + 0x102]
push ebx
lea eax, [esi + 0xcf]
push eax
lea eax, [esi + 0x9c]
push eax
push dword [ebp - 0x9e4]
call fcn.004211bb
mov edi, eax
add esp, 0x14
test edi, edi
je 0x427305
push str.Failed_to_get_Adminstrator_credentials.
push edi
push 3
push 3
push esi
call fcn.00429952
add esp, 0x14
jmp 0x42732b
cmp byte [ebx], 0
jne 0x427322
lea eax, [ebp - 0x9dc]
mov dword [ebp - 0x9dc], 0x33
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push esi
call fcn.00426f99
pop ecx
mov edi, eax
mov eax, edi
jmp 0x427332
push 0xfffffffffffffff8
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a50d6
leave
ret