Function at 0x403c9a
Capabilities:
Get hostname
Get session user name
Resolve dns

Disassembly:
mov eax, 0x426e58
call fcn.004268b0
sub esp, 0x6ac
push ebx
push esi
push edi
xor edi, edi
push 0x138
lea eax, [ebp - 0x1b0]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0040196b
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
mov dword [ebp - 4], edi
call fcn.0040196e
test eax, eax
lea eax, [ebp - 0x3b0]
je 0x40442c
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push str.OS:
push eax
call esi
mov eax, dword [ebp - 0x1a4]
pop ecx
sub eax, edi
pop ecx
je 0x40421f
dec eax
je 0x4041f2
dec eax
je 0x404123
dec eax
je 0x403d38
dec eax
je 0x403d2e
lea eax, [ebp - 0x78]
push str.Unknown_OS
push eax
call esi
jmp 0x404230
push str.Windows_CE
jmp 0x404224
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402778
test eax, eax
je 0x403e0e
lea eax, [ebp - 0x3b0]
push str.Windows_NT
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x1b0]
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040280a
test eax, eax
je 0x403d7c
push str.__Workstation_
jmp 0x403dc8
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004027c2
test eax, eax
je 0x403d96
push str.__Server_
jmp 0x403dc8
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402798
test eax, eax
je 0x403db0
push str.__Primary_Domain_Controller_
jmp 0x403dc8
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004027e0
test eax, eax
je 0x403dd6
push str.__Backup_Domain_Controller_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402895
test eax, eax
jne 0x403ea5
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402874
test eax, eax
je 0x403ff9
push str.___Enterprise_
jmp 0x403feb
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004023ae
test eax, eax
je 0x403ed0
lea eax, [ebp - 0x3b0]
push str.Windows_2000
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x1b0]
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004028b6
test eax, eax
je 0x403e52
push str.__Professional_
jmp 0x403e84
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004028d7
test eax, eax
je 0x403e6c
push str.__Server_
jmp 0x403e84
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402937
test eax, eax
je 0x403e92
push str.__Domain_Controller_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402916
test eax, eax
je 0x403eaf
push str.___Datacenter_
jmp 0x403feb
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004028f5
test eax, eax
je 0x403ff9
push str.___Advanced_Server_
jmp 0x403feb
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004023d7
test eax, eax
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
je 0x403fc3
call fcn.00402958
test eax, eax
je 0x403f01
push str.Windows_XP__Personal_
jmp 0x403f4d
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402979
test eax, eax
je 0x403f1b
push str.Windows_XP__Professional_
jmp 0x403f4d
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004029c3
test eax, eax
je 0x403f35
push str.Windows_Server_2003
jmp 0x403f4d
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a23
test eax, eax
je 0x403f5b
push str.Windows_Server_2003__Domain_Controller_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a02
test eax, eax
je 0x403f75
push str.___Datacenter_Edition_
jmp 0x403feb
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004029e1
test eax, eax
je 0x403f8f
push str.___Enterprise_Edition_
jmp 0x403feb
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004029a2
test eax, eax
je 0x403fa9
push str.___Web_Edition_
jmp 0x403feb
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004029c3
test eax, eax
je 0x403ff9
push str.___Standard_Edition_
jmp 0x403feb
call fcn.00402400
test eax, eax
je 0x403fd3
push str.Windows_Vista:_Warning_UAC_windows_need_to_be_controled_by_local_user__to_view_mouse_during_this_action__select_Let_server_deal_with_mouse__viewer_option_
jmp 0x403feb
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402429
test eax, eax
je 0x403ff9
push str.Windows_Win7:_Warning_UAC_windows_need_to_be_controled_by_local_user__to_view_mouse_during_this_action__select_Let_server_deal_with_mouse__viewer_option_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040282b
test eax, eax
je 0x40401f
lea eax, [ebp - 0x3b0]
push str.___Terminal_Services_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402864
test eax, eax
je 0x404045
lea eax, [ebp - 0x3b0]
push str.___BackOffice_Small_Business_Edition_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040283e
test eax, eax
je 0x40406b
lea eax, [ebp - 0x3b0]
push str.___Embedded_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402851
test eax, eax
je 0x404091
lea eax, [ebp - 0x3b0]
push str.___Terminal_Services_in_Remote_Admin_Mode_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a57
test eax, eax
je 0x4040b7
lea eax, [ebp - 0x3b0]
push str.___64_Bit_Edition_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402a44
test eax, eax
je 0x4040dd
lea eax, [ebp - 0x3b0]
push str.___Media_Center_Edition_
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
mov eax, dword [ebp - 0x84]
test ah, 4
je 0x4040f2
push str.___Uniprocessor_Free_
jmp 0x404224
test ah, 8
je 0x404101
push str.___Uniprocessor_Checked_
jmp 0x404224
test ah, 0x10
je 0x404110
push str.___Multiprocessor_Free_
jmp 0x404224
test ah, 0x20
je 0x404232
push str.___Multiprocessor_Checked_
jmp 0x404224
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402240
test eax, eax
je 0x404140
push str.Windows_95
jmp 0x4041e4
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402275
test eax, eax
je 0x40415d
push str.Windows_95_SP1
jmp 0x4041e4
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004022a9
test eax, eax
je 0x404177
push str.Windows_95_OSR2
jmp 0x4041e4
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.004022de
test eax, eax
je 0x404191
push str.Windows_98
jmp 0x4041e4
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402313
test eax, eax
je 0x4041ab
push str.Windows_98_SP1
jmp 0x4041e4
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402350
test eax, eax
je 0x4041c5
push str.Windows_98_Second_Edition
jmp 0x4041e4
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402385
test eax, eax
je 0x4041df
push str.Windows_Millenium_Edition
jmp 0x4041e4
push str.Windows___
lea eax, [ebp - 0x78]
push eax
call esi
pop ecx
lea eax, [ebp - 0x78]
pop ecx
push eax
jmp 0x404224
lea eax, [ebp - 0x3b0]
push str.Windows
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x1b0]
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00402765
test eax, eax
je 0x404232
push str.__Win32s_
jmp 0x404224
push 0x4306a8
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
mov eax, dword [ebp - 0x1a0]
dec eax
cmp eax, 9
ja case.default.0x40423e
jmp dword [eax*4 + 0x404558]
push str.___Intel_Processor_
jmp 0x404290
push str.___MSIL_Processor_
jmp 0x404290
push str.___MIPS_Processor_
jmp 0x404290
push str.___ARM_Processor_
jmp 0x404290
push str.___SHX_Processor_
jmp 0x404290
push str.___Alpha_Processor_
jmp 0x404290
push str.___Alpha64_Processor_
jmp 0x404290
push str.___PPC_Processor_
jmp 0x404290
push str.___IA64_Processor_
jmp 0x404290
push str.___AMD64_Processor_
jmp 0x404290
push str.___Unknown_Processor_
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x78]
pop ecx
push dword [ebp - 0x1b0]
push str._v_d.
push eax
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
mov ecx, dword [ebp - 0x1ac]
add esp, 0x14
mov eax, ecx
xor edx, edx
push 0xa
pop ebx
div ebx
cmp edx, edi
je 0x4042e5
cmp ecx, 9
lea eax, [ebp - 0x78]
push ecx
jbe 0x4042e9
push str._02d
jmp 0x4042ee
push eax
lea eax, [ebp - 0x78]
push str._01d
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
cmp dword [ebp - 0x1a8], edi
pop ecx
pop ecx
je 0x404332
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x78]
push str._Build:_d
push eax
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x14
cmp word [ebp - 0x11c], di
je 0x4043fa
cmp word [ebp - 0x11a], di
je 0x4043d0
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402778
test eax, eax
je 0x40437a
cmp word [ebp - 0x11c], 6
jne 0x40437a
cmp word [ebp - 0x11a], 1
jne 0x40437a
push str._Service_Pack:_6a
jmp 0x4043a6
lea eax, [ebp - 0x1b0]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402452
test eax, eax
je 0x4043b0
cmp word [ebp - 0x11c], 1
jne 0x4043b0
cmp word [ebp - 0x11a], 1
jne 0x4043b0
push str._Service_Pack:_1a
lea eax, [ebp - 0x78]
push eax
call esi
pop ecx
pop ecx
jmp 0x4043e6
movzx eax, word [ebp - 0x11a]
push eax
movzx eax, word [ebp - 0x11c]
push eax
lea eax, [ebp - 0x78]
push str._Service_Pack:_d._d
push eax
call esi
add esp, 0x10
jmp 0x4043e6
movzx eax, word [ebp - 0x11c]
push eax
lea eax, [ebp - 0x78]
push str._Service_Pack:_d
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x3b0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x404419
cmp word [ebp - 0x11a], di
je 0x404419
movzx eax, word [ebp - 0x11a]
push eax
lea eax, [ebp - 0x78]
push str._Service_Pack:0._d
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x3b0]
push 0x430538
push eax
call sub.MSVCRT.dll_strcat
jmp 0x404438
push str.Failed_in_call_to_GetOSVersion_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov al, byte [0x437894]
pop ecx
pop ecx
mov byte [ebp - 0x5b8], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x5b7]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x101
push eax
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x40448c
push str.Current_user_:
push ebx
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x5b8]
push eax
push ebx
call sub.MSVCRT.dll_strcat
add esp, 0x10
mov al, byte [0x437894]
push 0x40
mov byte [ebp - 0x4b4], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x4b3]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4044d4
push str._nComputerName_:
push ebx
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x4b4]
push eax
push ebx
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x6b8]
push 0xff
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x404520
lea eax, [ebp - 0x6b8]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x404520
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.WSOCK32.dll_inet_ntoa
mov esi, eax
test esi, esi
je 0x404520
push str._nIP_:
push ebx
call sub.MSVCRT.dll_strcat
push esi
push ebx
call sub.MSVCRT.dll_strcat
add esp, 0x10
push 0x430538
push ebx
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x3b0]
push eax
push ebx
call sub.MSVCRT.dll_strcat
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.00426c14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret