Function at 0x10404df
Capabilities:
Get hostname
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x1079e94]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp + 0xc], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x624], eax
mov dword [ebx], eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x20c]
push eax
je 0x10405e7
mov esi, 0x104
mov dword [ebp - 0x620], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1040563
call fcn.0106d6ff
mov esi, eax
push esi
push 0x100cfa8
call fcn.0101c17b
push esi
push 0x496013a
jmp 0x104081e
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
mov dword [ebp - 0x620], esi
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
jne 0x104059f
call fcn.0106d6ff
mov esi, eax
push esi
push 0x100cfa8
call fcn.0101c17b
push esi
push 0x4a0013a
jmp 0x104081e
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x634], eax
push 0x185
push 0
call dword [sym.imp.WLDAP32.dll_Ordinal_145]
mov esi, eax
test esi, esi
pop ecx
pop ecx
mov dword [ebp - 0x630], esi
jne 0x10406bd
call fcn.0106d6ff
mov esi, eax
push esi
push 0x100ce00
call fcn.0101c17b
push esi
push 0x4d7013a
jmp 0x104081e
push 2
mov dword [ebp - 0x620], 0x104
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x1040619
call fcn.0106d6ff
mov esi, eax
push esi
push 0x100cf8c
call fcn.0101c17b
push esi
push 0x4ad013a
jmp 0x104081e
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
jne 0x1040636
lea eax, [ebp - 0x20c]
jmp 0x1040638
inc eax
inc eax
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 2
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x620], 0x104
call sub.Secur32.dll_TranslateNameW
test al, al
jne 0x1040693
call fcn.0106d6ff
mov esi, eax
push esi
push 0x100cf70
call fcn.0101c17b
push esi
push 0x4c6013a
lea eax, [ebp - 0x20c]
push eax
call fcn.0105364b
jmp 0x1040823
test esi, esi
je 0x10405ab
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0106d913
mov esi, eax
test esi, esi
je 0x10405ab
push esi
push 0x4cd013a
jmp 0x104081e
push 0x486
push 0
push 0
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_73]
add esp, 0x10
test eax, eax
je 0x10406fa
lea ecx, [ebp - 0x628]
push ecx
push eax
push esi
call fcn.0106223c
mov esi, eax
push esi
push 0x100cde8
call fcn.0101c17b
push esi
push 0x4df013a
jmp 0x104081e
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x61c]
je 0x1040722
push dword [ebp - 0x634]
push 0x100cf34
push 0x100cf20
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
jmp 0x1040736
push 0x100cef4
push 0x100cee8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
lea eax, [ebp - 0x624]
push eax
push 0
push edi
lea eax, [ebp - 0x61c]
push eax
push 2
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_208_1]
add esp, 0x1c
test eax, eax
je 0x1040784
lea ecx, [ebp - 0x628]
push ecx
push eax
push esi
call fcn.0106223c
mov esi, eax
push esi
push 0x100cd90
call fcn.0101c17b
push esi
push 0x4fe013a
jmp 0x104081e
push dword [ebp - 0x624]
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_36]
test eax, eax
pop ecx
pop ecx
jne 0x10407c3
push dword [edi]
push 0x888
call fcn.01052a94
push eax
call fcn.0105b329
push 0x1003410
call fcn.0105b329
add esp, 0xc
mov esi, 0x80092004
push esi
push 0x506013a
jmp 0x104081e
push dword [ebp - 0x624]
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_26]
test eax, eax
pop ecx
pop ecx
jne 0x10407f0
call fcn.0106d6ff
mov esi, eax
push esi
push 0x100cec4
call fcn.0101c17b
push esi
push 0x510013a
jmp 0x104081e
push dword [edi]
push eax
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_140]
add esp, 0xc
test eax, eax
mov dword [ebp - 0x62c], eax
jne 0x104080b
xor esi, esi
jmp 0x1040823
push ebx
push eax
call fcn.01040436
mov esi, eax
test esi, esi
je 0x1040823
push esi
push 0x525013a
call fcn.01053610
xor edi, edi
cmp dword [ebp - 0x628], edi
je 0x104084b
push dword [ebp - 0x628]
push 0x1001b30
call fcn.0105b329
pop ecx
pop ecx
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x624], edi
je 0x1040860
push dword [ebp - 0x624]
call dword [sym.imp.WLDAP32.dll_Ordinal_41]
pop ecx
cmp dword [ebp - 0x62c], edi
je 0x1040875
push dword [ebp - 0x62c]
call dword [sym.imp.WLDAP32.dll_Ordinal_224]
pop ecx
cmp dword [ebp - 0x630], edi
je 0x104088a
push dword [ebp - 0x630]
call dword [sym.imp.WLDAP32.dll_Ordinal_13_1]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0x10