Function at 0x432b80
Capabilities:
Get hostname
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServiceslanmanserverparameters
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov byte [ebp - 0x114], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x432c3d
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x200
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push str.srvcomment
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x432c36
push eax
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x314]
push eax
push 0
push 0xfde9
call ebx
test eax, eax
jle 0x432c17
xor eax, eax
jmp 0x432c2a
call esi
test eax, eax
je 0x432c21
call esi
jmp 0x432c26
mov eax, 0xffffe5d4
test eax, eax
jne 0x432c36
mov cl, byte [ebp - 0x114]
test cl, cl
jne 0x432caf
jmp 0x432c3d
mov byte [ebp - 0x114], 0
lea eax, [ebp - 8]
mov dword [ebp - 8], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x314]
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x432c67
call esi
test eax, eax
je 0x432c97
call esi
test eax, eax
jne 0x432ca7
push 0
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x314]
push eax
push 0
push 0xfde9
call ebx
test eax, eax
jg 0x432cb5
call esi
test eax, eax
je 0x432c9e
call esi
jmp 0x432ca3
mov eax, 0xffffe5a8
jmp 0x432ca7
mov eax, 0xffffe5d4
test eax, eax
je 0x432cb5
xor cl, cl
mov byte [ebp - 0x114], cl
test eax, eax
jne 0x432cbf
jmp 0x432cbb
mov cl, byte [ebp - 0x114]
test cl, cl
jne 0x432ce4
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov al, byte [ecx + str.My_Computer]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x115], al
test al, al
jne 0x432cd0
lea ecx, [ebp - 0x114]
mov byte [ebp - 0x15], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432cf1
sub ecx, edx
mov eax, 0x3f
cmp ecx, eax
cmovb eax, ecx
mov byte [edi + 0x18d4], al
movzx eax, al
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [edi + 0x18d5]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x432d32
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi]
xorps xmm0, xmm0
movups xmmword [eax + 0x18], xmm0
movups xmmword [eax + 0x28], xmm0
mov eax, dword [edi]
movups xmmword [eax + 0x38], xmm0
movups xmmword [eax + 0x48], xmm0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x20
push eax
mov eax, dword [edi]
add eax, 0x18
push eax
push 4
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.NETAPI32.dll_NetGetJoinInformation]
test eax, eax
jne 0x432db2
mov eax, dword [ebp - 0x14]
cmp eax, 2
je 0x432d83
cmp eax, 3
jne 0x432da9
mov eax, dword [edi]
push 0
push 0
push 0x20
add eax, 0x38
push eax
push 0xffffffffffffffff
push dword [ebp - 0xc]
push 0
push 0xfde9
call ebx
test eax, eax
jg 0x432da9
call esi
test eax, eax
je 0x432da9
call esi
push dword [ebp - 0xc]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret