Function at 0x44ffb0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x80
push edi
xor edi, edi
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x20c], edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x224], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x45028c
push str.KERNEL32.DLL
call fcn.0044e639
pop ecx
mov dword [ebp - 0x218], eax
cmp eax, edi
je 0x45028c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSGetActiveConsoleSessionId
push eax
call esi
mov dword [ebp - 0x238], eax
cmp eax, edi
je 0x45028c
push str.WTSAPI32.dll
call fcn.0044e639
pop ecx
mov dword [ebp - 0x210], eax
cmp eax, edi
je 0x45028c
push str.WTSOpenServerW
push eax
call esi
push str.WTSQuerySessionInformationW
push dword [ebp - 0x210]
mov ebx, eax
call esi
mov dword [ebp - 0x23c], eax
cmp ebx, edi
je 0x45028c
cmp eax, edi
je 0x45028c
call dword [ebp - 0x238]
mov esi, eax
lea eax, [ebp - 0x104]
push eax
call ebx
cmp eax, edi
je 0x45028c
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x234]
push ecx
push 5
push esi
push eax
call dword [ebp - 0x23c]
test eax, eax
je 0x45028c
lea eax, [ebp - 0x224]
push eax
push 1
call fcn.0045125f
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x21c], esi
cmp esi, edi
je 0x4502c9
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [ebp - 0x220], edi
jne 0x45028c
push dword [esi + 8]
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20c], eax
cmp eax, edi
je 0x45028c
lea eax, [ebp - 0x22c]
push eax
push 8
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45028c
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push 1
push dword [ebp - 0x22c]
mov dword [ebp - 0x214], edi
call ebx
test eax, eax
jne 0x45017d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x224], eax
cmp eax, 0x7a
jne 0x45028c
push dword [ebp - 0x214]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x208], eax
cmp eax, edi
je 0x45028c
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x214]
push dword [ebp - 0x208]
push 1
push dword [ebp - 0x22c]
call ebx
test eax, eax
je 0x45028c
xor eax, eax
mov word [ebp - 0x104], ax
mov word [ebp - 0x204], ax
mov eax, 0x80
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x208]
push dword [eax]
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x45023c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x224], eax
cmp eax, 0x534
jne 0x45028c
lea eax, [ebp - 0x104]
push str.NONE_MAPPED
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp - 0x234]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCR100.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x45025e
mov eax, dword [esi + 8]
mov dword [ebp - 0x220], eax
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x20c]
mov dword [ebp - 0x208], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi]
mov dword [ebp - 0x20c], edi
cmp esi, edi
jne 0x450105
cmp dword [ebp - 0x21c], edi
je 0x4502a1
lea eax, [ebp - 0x21c]
push eax
call fcn.00451235
pop ecx
cmp dword [ebp - 0x208], edi
je 0x4502b5
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x20c], edi
je 0x4502c9
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x218], edi
je 0x4502df
push dword [ebp - 0x218]
call esi
cmp dword [ebp - 0x210], edi
je 0x4502ef
push dword [ebp - 0x210]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004534b8
leave
ret