Function at 0x4010b0
Capabilities:
Check for peb beingdebugged flag
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d2f0
push 0x41a750
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x164
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
movsx ax, byte [0x422afd]
neg eax
mov word [0x422b0e], ax
movsx ecx, word [0x422b06]
add ecx, 0x1519ffff
mov dword [0x422b34], ecx
movsx edx, byte [0x422afa]
add edx, 0x3fd3ffff
mov dword [0x422b28], edx
xor ebx, ebx
mov word [0x422b06], bx
mov eax, dword [0x422ad0]
cmp eax, ebx
jne 0x40190d
mov dword [ebp - 4], ebx
mov al, byte [0x422ad4]
mov byte [ebp - 0x124], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
mov dword [ebp - 0x20], esi
mov cx, word [0x422b08]
mov dl, byte [0x422af8]
and ecx, edx
mov byte [0x422afc], cl
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x124]
push ecx
call dword [0x422f74]
mov dl, byte [0x422af9]
sub edx, 0x18180001
mov byte [0x422afd], dl
lea ecx, [ebp - 0x124]
call fcn.00401990
neg al
sbb eax, eax
and eax, 5
mov dword [ebp - 0x1c], eax
jne 0x40124f
xor eax, eax
cmp word [0x422b0e], bx
setne al
mov dword [0x422b38], eax
mov al, byte [0x422afb]
imul eax, eax, 0xd9a1ffff
mov byte [0x422aff], al
mov dword [ebp - 0x20], esi
cmp dword [0x422b20], ebx
je 0x4011db
cmp byte [0x422afe], bl
je 0x4011db
mov eax, 1
jmp 0x4011dd
xor eax, eax
mov dword [0x422b38], eax
mov word [0x422b12], 1
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
mov eax, dword [0x422b20]
imul eax, eax, 0xe131ffff
mov word [0x422b08], ax
mov word [0x422b0c], 0xffff
mov cx, word [0x422b0a]
and ecx, dword [0x422b18]
mov byte [0x422af8], cl
lea ecx, [ebp - 0x124]
call fcn.00401990
neg al
sbb eax, eax
and eax, 6
mov dword [ebp - 0x1c], eax
mov al, byte [0x422af8]
add eax, 0x1d880001
mov byte [0x422afc], al
jmp 0x401254
mov al, byte [0x422afc]
movsx ecx, byte [0x422b00]
mov dx, word [0x422b0a]
imul edx, ecx
mov word [0x422b0a], dx
movsx edx, byte [0x422af8]
sub edx, ecx
mov word [0x422b04], dx
cmp dword [ebp - 0x1c], ebx
jne 0x4018fa
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x174], ebx
mov ecx, 1
mov dword [ebp - 4], ecx
movsx eax, al
or eax, 0xbc5bffff
mov word [0x422b02], ax
mov byte [0x422afa], cl
call dword [sym.imp.KERNEL32.DLL_GetVersion]
test eax, 0x80000000
je 0x40130f
mov ecx, dword [0x422b18]
or ecx, 0x79ebffff
mov word [0x422b12], cx
mov edx, dword [0x422b28]
add edx, 0x1fc7ffff
mov dword [0x422b30], edx
mov dword [0x422b20], 0xbdcc0000
mov eax, dword fs:[0x20]
mov dword [ebp - 0x174], eax
mov al, byte [0x422b0e]
mov byte [0x422b00], al
add eax, 0x5cd1ffff
mov byte [0x422af8], al
mov dword [ebp - 4], ebx
jmp 0x401376
mov dword [0x422b38], 0xf6160000
movsx eax, word [0x422b06]
mov dword [0x422b20], eax
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
movzx eax, al
mov dword [ebp - 0x174], eax
movsx ecx, word [0x422b12]
movsx edx, byte [0x422afa]
add ecx, edx
mov dword [0x422b18], ecx
mov dword [ebp - 4], ebx
jmp 0x401376
mov edx, dword [0x422b2c]
and edx, 0x4169ffff
mov dword [0x422b34], edx
xor ebx, ebx
cmp dword [ebp - 0x174], ebx
jne 0x4018fa
mov dword [ebp - 0x1c], 0xa
mov word [0x422b0c], 1
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
lea edx, [ebp - 0x168]
mov ecx, 0x41d290
call fcn.00401960
push eax
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileA]
call esi
mov dword [ebp - 0x170], eax
cmp eax, 0xffffffff
jne 0x4018aa
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
lea edx, [ebp - 0x168]
mov ecx, 0x41d29c
call fcn.00401960
push eax
call esi
mov dword [ebp - 0x170], eax
cmp eax, 0xffffffff
jne 0x4018aa
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
lea edx, [ebp - 0x168]
mov ecx, 0x41d2a8
call fcn.00401960
push eax
call esi
mov dword [ebp - 0x170], eax
cmp eax, 0xffffffff
jne 0x4018aa
movsx eax, byte [0x422afa]
or eax, 0xd6f9ffff
mov dword [0x422b18], eax
cmp byte [0x422afd], bl
je 0x40146a
cmp dword [0x422b20], ebx
je 0x40146a
mov eax, 1
jmp 0x40146c
xor eax, eax
mov word [0x422b12], ax
mov eax, dword [0x422b2c]
cmp eax, ebx
je 0x40148a
cmp dword [0x422b30], ebx
je 0x40148a
mov ecx, 1
jmp 0x40148c
xor ecx, ecx
mov dword [0x422b38], ecx
mov dword [ebp - 0x1c], 8
and eax, 0x7a09ffff
mov dword [0x422b30], eax
lea edx, [ebp - 0x168]
mov ecx, 0x41d2b8
call fcn.00401960
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
mov dword [ebp - 0x16c], esi
xor eax, eax
cmp dword [0x422b20], ebx
setne al
mov dword [0x422b38], eax
lea edx, [ebp - 0x168]
mov ecx, 0x41d2c4
call fcn.00401960
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xffffffcc
jne 0x401504
mov dl, byte [0x422af8]
mov byte [0x422af8], dl
jmp 0x4018fa
mov byte [0x422afe], bl
mov al, byte [0x422afc]
and eax, dword [0x422b1c]
mov byte [0x422afd], al
mov dword [ebp - 0x1c], 9
mov dword [ebp - 4], 2
mov eax, 0x4f
int 0x41
cmp ax, 0xf386
sete al
movzx eax, al
mov dword [ebp - 0x174], eax
mov cx, word [0x422b04]
imul ecx, ecx, 0x6ddbffff
mov byte [0x422afa], cl
mov dx, word [0x422b12]
mov al, byte [0x422af8]
and edx, eax
mov byte [0x422b00], dl
mov word [0x422b12], 0xffff
mov dword [ebp - 4], ebx
jmp 0x4015ae
movsx eax, word [0x422b0c]
or eax, dword [0x422b1c]
mov dword [0x422b18], eax
mov eax, 1
mov dword [0x422b18], eax
movsx ecx, byte [0x422afe]
imul ecx, ecx, 0x914fffff
mov word [0x422b12], cx
mov ecx, dword [ebp - 0x174]
test ecx, ecx
jne 0x4018fa
mov dword [ebp - 0x1c], eax
mov word [0x422b0c], 0xfffe
mov byte [0x422aff], 0xff
mov dword [ebp - 4], 3
xor eax, eax
cmp word [0x422b04], ax
setne al
mov dword [0x422b20], eax
xor ebx, ebx
mov ecx, 0xa
mov eax, 0x564d5868
mov dx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete al
movzx eax, al
mov dword [ebp - 0x174], eax
mov byte [0x422afb], 0xff
jmp 0x40167a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x174]
test eax, eax
jne 0x4018fa
movsx eax, word [0x422b06]
and eax, dword [0x422b34]
mov byte [0x422afc], al
or eax, 0xffffffff
mov byte [0x422af8], al
mov byte [0x422afd], al
mov dword [ebp - 0x1c], 2
mov word [0x422b02], ax
push pe_nt_image_headers32
push 0x1000
push 0x1000
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0x128], eax
movsx ecx, word [0x422b12]
and ecx, 0xa30dffff
mov dword [0x422b1c], ecx
mov edx, dword [0x422afd]
mov ecx, edx
neg ecx
shl ecx, 5
sub ecx, edx
lea ecx, [ecx + ecx*4]
shl ecx, 3
sub ecx, edx
shl ecx, 0x12
sub ecx, edx
mov byte [0x422b00], cl
mov byte [eax], 0xf
mov byte [eax + 1], 0x3f
mov byte [eax + 2], bl
mov byte [eax + 3], bl
mov byte [eax + 4], 0xc3
mov eax, dword [0x422b30]
imul eax, eax, 0x86a5ffff
mov dword [0x422b28], eax
movsx edx, word [0x422b0a]
mov ecx, 0xd92dffff
sub ecx, edx
mov dword [0x422b18], ecx
mov dword [0x422b30], 0x7681fffe
mov dword [ebp - 4], 4
mov dl, byte [0x422b00]
add edx, dword [0x422b2c]
mov byte [0x422af8], dl
mov cl, byte [0x422afb]
movsx edx, cl
sub edx, eax
mov word [0x422b02], dx
cmp cl, bl
je 0x401786
cmp byte [0x422afc], bl
je 0x401786
mov ebx, 1
mov byte [0x422b00], bl
pushal
mov eax, dword [ebp - 0x128]
call eax
popal
inc dword [ebp - 0x174]
mov eax, dword [0x422b28]
mov ecx, dword [0x422b38]
add ecx, eax
mov byte [0x422b00], cl
movsx edx, byte [0x422afa]
imul edx, edx, 0x5c57ffff
mov dword [0x422b34], edx
jmp 0x4017cd
mov dword [ebp - 4], 0
mov ax, word [0x422b06]
imul eax, eax, 0x8c21ffff
mov word [0x422b10], ax
push 0x8000
push 0
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
xor eax, eax
cmp word [0x422b10], ax
setne al
mov word [0x422b02], ax
mov al, byte [0x422afc]
imul eax, eax, 0x9b85ffff
mov byte [0x422afe], al
mov ecx, dword [ebp - 0x174]
test ecx, ecx
jne 0x4018fa
mov dword [ebp - 0x1c], 3
movsx edx, al
or edx, 0x2e53ffff
mov dword [0x422b1c], edx
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
lea edx, [ebp - 0x168]
mov ecx, 0x41d2e0
call fcn.00401960
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x170], eax
cmp eax, 0xffffffff
je 0x4018a7
mov cx, word [0x422b0c]
mov edx, dword [0x422b2c]
sub edx, ecx
mov byte [0x422afb], dl
mov cx, word [0x422b06]
mov edx, 0x79c5ffff
sub edx, ecx
mov word [0x422b02], dx
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4018fa
int3
xor ecx, ecx
cmp dword [0x422b20], ebx
setne cl
mov byte [0x422afa], cl
mov cx, word [0x422b12]
add ecx, 0x77c7ffff
mov word [0x422b06], cx
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4018fa
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [0x422ad0], eax
xor ebx, ebx
jmp 0x401910
mov dword [ebp - 0x1c], eax
mov byte [0x422afc], 1
cmp dword [ebp - 0x1c], ebx
jne 0x40192b
call section..text
neg al
sbb eax, eax
and eax, 4
mov dword [ebp - 0x1c], eax
or cx, 0xffff
sub cx, word [0x422b02]
mov word [0x422b08], cx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret