Function at 0x1012361
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x19c], 0
cmp dword [0x10493e4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1a4], edi
mov ebx, 0x80010000
je 0x10123ea
mov al, byte [0x10493e8]
cmp al, 4
jb 0x10125eb
mov eax, dword [0x10493d0]
mov ecx, dword [0x10493d4]
and eax, 1
and ecx, ebx
or eax, ecx
je 0x10123ea
mov eax, dword [0x10493d8]
mov esi, dword [0x10493dc]
mov ecx, eax
mov edx, esi
and ecx, 1
and edx, ebx
cmp ecx, eax
jne 0x10123ea
cmp edx, esi
jne 0x10123ea
push 0x1012600
push dword [0x104939c]
push dword [0x1049398]
call fcn.01011f0f
mov eax, dword [edi + 4]
mov dword [0x10491c0], eax
mov eax, dword [edi]
mov dword [0x1049178], eax
call fcn.01013345
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, 0x1013298
mov edi, 0x1049104
test eax, eax
jne 0x1013840
mov dword [0x104917c], 1
call sym.spoolsv.exe_PrvSplIsUpgrade
push 0x5c
pop eax
mov word [0x1049792], ax
mov word [0x1049790], ax
lea eax, [ebp - 0x1a0]
push eax
push 0x1049794
mov dword [ebp - 0x1a0], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x101386c
call fcn.010132c5
push eax
call fcn.0101284f
mov dword [ebp - 0x198], eax
test eax, eax
jl 0x10138ae
push 0x104927c
push 0x1049278
call sym.spoolsv.exe_PrvBuildOtherNamesFromMachineName
test eax, eax
je 0x10138e6
push 0x5c
pop eax
mov word [0x1049b18], ax
mov word [0x1049b1a], ax
mov eax, dword [0x1049278]
push dword [eax + 4]
push 0x102
push 0x1049b1c
call fcn.0100bc84
call fcn.01012fef
mov dword [ebp - 0x198], eax
test eax, eax
jl 0x101391c
call fcn.01013073
mov dword [ebp - 0x198], eax
test eax, eax
jl 0x1013957
call fcn.010121c0
test eax, eax
jne 0x1012514
push 1
call fcn.010131c1
mov dword [ebp - 0x198], eax
test eax, eax
jl 0x1013992
lea eax, [ebp - 0x19c]
push eax
push 0
push 0x1012ce8
call fcn.01012a1d
mov dword [0x10491bc], eax
test eax, eax
je 0x10139d2
push dword [eax + 8]
call fcn.0101381b
test eax, eax
je 0x1013a08
call fcn.01014550
push dword [0x1049280]
call fcn.01010d76
xor edi, edi
inc edi
mov dword [0x1049174], edi
call fcn.01013c73
call fcn.01014c31
call fcn.01013ae5
call fcn.01014be1
call fcn.010151cc
call fcn.010152e9
call fcn.01014d8d
push dword [ebp - 0x1a4]
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [0x10493e4], 0
je 0x10125e1
mov al, byte [0x10493e8]
cmp al, 4
jb 0x10125f8
mov eax, dword [0x10493d0]
mov ecx, dword [0x10493d4]
and eax, edi
and ecx, ebx
or eax, ecx
je 0x10125e1
mov eax, dword [0x10493d8]
mov esi, dword [0x10493dc]
mov ecx, eax
mov edx, esi
and ecx, edi
and edx, ebx
cmp ecx, eax
jne 0x10125e1
cmp edx, esi
jne 0x10125e1
push 0x1012610
push dword [0x104939c]
push dword [0x1049398]
call fcn.01011f0f
call fcn.01013bd9
jmp 0x1013a28
test al, al
je 0x10123a4
jmp 0x10123ea
test al, al
jne 0x10125e1
jmp 0x101259d
mov ecx, dword [0x1049104]
cmp ecx, edi
je 0x1012442
test byte [ecx + 0x1c], 1
je 0x1012442
push eax
push esi
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01034754
jmp 0x1012442
mov eax, dword [0x1049104]
cmp eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1013897
test byte [eax + 0x1c], 1
je 0x1013897
call edi
push eax
mov eax, dword [0x1049104]
push esi
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push 0
call edi
push eax
push 0x1013a40
call fcn.01031f8b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1049104]
cmp eax, edi
je 0x10138d1
test byte [eax + 0x1c], 1
je 0x10138d1
push dword [ebp - 0x198]
push esi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push 0
push dword [ebp - 0x198]
call fcn.01024167
push eax
push 0x101fee8
jmp 0x10138a1
mov eax, dword [0x1049104]
cmp eax, edi
je 0x101390f
test byte [eax + 0x1c], 1
je 0x101390f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1049104]
push esi
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
xor eax, eax
mov word [0x1049b18], ax
jmp 0x10124d0
mov eax, dword [0x1049104]
cmp eax, edi
je 0x101393f
test byte [eax + 0x1c], 1
je 0x101393f
push dword [ebp - 0x198]
push esi
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push 0
push dword [ebp - 0x198]
call fcn.01024167
push eax
push 0x1013a60
jmp 0x10138a1
mov eax, dword [0x1049104]
cmp eax, edi
je 0x101397a
test byte [eax + 0x1c], 1
je 0x101397a
push dword [ebp - 0x198]
push esi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push 0
push dword [ebp - 0x198]
call fcn.01024167
push eax
push 0x1013a70
jmp 0x10138a1
mov eax, dword [0x1049104]
cmp eax, edi
je 0x10139b5
test byte [eax + 0x1c], 1
je 0x10139b5
push dword [ebp - 0x198]
push esi
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push 0
push dword [ebp - 0x198]
call fcn.01024167
push eax
push 0x1013a80
call fcn.01031f8b
jmp 0x1012514
mov eax, dword [0x1049104]
cmp eax, edi
je 0x10139f5
test byte [eax + 0x1c], 1
je 0x10139f5
push dword [ebp - 0x19c]
push esi
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1013a50
jmp 0x10138a1
mov eax, dword [0x1049104]
cmp eax, edi
je 0x10139f5
test byte [eax + 0x1c], 1
je 0x10139f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1049104]
push esi
push 0x12
jmp 0x10139ea
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100327d
leave
ret 4