Function at 0x6ca014e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov dword [ebp - 0x4c], 0
mov ebx, dword [ebp + 0xc]
test byte [0x6ca06010], 8
jne 0x6ca01601
lea eax, [ebp - 0x54]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x54], 0x10
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._GetComputerNameW_8
add dword [ebp - 0x54], 1
xor edx, edx
xor eax, eax
sub esp, 8
mov dword [ebp + eax - 0x48], edx
add eax, 4
cmp eax, 0x18
jb 0x6ca01524
lea eax, [ebp - 0x50]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._LsaOpenPolicy_16
sub esp, 0x10
mov edi, eax
test eax, eax
je 0x6ca01581
test byte [0x6ca06010], 4
jne 0x6ca01640
mov dword [esp], edi
call sym._LsaNtStatusToWinError_4
sub esp, 4
mov esi, eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
lea eax, [ebp - 0x4c]
mov dword [esp + 4], 3
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call sym._LsaQueryInformationPolicy_12
mov edi, eax
mov eax, dword [ebp - 0x50]
sub esp, 0xc
mov dword [esp], eax
call sym._LsaClose_4
sub esp, 4
test edi, edi
jne 0x6ca01680
cmp ebx, 0x65
je 0x6ca016a3
cmp ebx, 0x66
je 0x6ca017f1
cmp ebx, 0x64
je 0x6ca017b2
mov esi, 0x7c
test byte [0x6ca06010], 1
jne 0x6ca019b3
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x6ca01575
mov dword [esp], eax
call sym._LsaFreeMemory_4
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], str.NetrWkstaGetInfo_level__lu_n
mov dword [esp + 0x10], 0x62
mov dword [esp + 0xc], str.NetrWkstaGetInfo
mov dword [esp + 8], 0x6ca07175
mov dword [esp + 4], 0x6ca06010
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x6ca01500
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.LsaOpenPolicy___failed__Status_0x_08lx__n
mov dword [esp + 0x10], 0x6f
mov dword [esp + 0xc], str.NetrWkstaGetInfo
mov dword [esp + 8], 0x6ca07175
mov dword [esp + 4], 0x6ca06010
mov dword [esp], 2
call sym._ros_dbg_log
jmp 0x6ca01568
test byte [0x6ca06010], 4
je 0x6ca01568
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], str.LsaQueryInformationPolicy___failed__Status_0x_08lx__n
mov dword [esp + 0x10], 0x7b
jmp 0x6ca01654
call sym._GetProcessHeap_0
mov dword [esp + 8], 0x18
mov dword [esp + 4], 8
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6ca017dc
mov dword [eax], 0x1f4
mov eax, dword [ebp - 0x54]
lea edi, [eax + eax]
call sym._GetProcessHeap_0
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebx + 4], eax
test eax, eax
je 0x6ca01709
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [ebp - 0x4c]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
mov eax, dword [eax + 4]
mov dword [esp], eax
call esi
mov edi, eax
call sym._GetProcessHeap_0
lea edx, [edi + edi + 2]
mov dword [esp + 4], 8
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebx + 8], eax
test eax, eax
je 0x6ca01756
mov edx, dword [ebp - 0x4c]
mov edx, dword [edx + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [0x6ca09024]
mov dword [ebx + 0xc], eax
mov eax, dword [0x6ca09028]
mov dword [ebx + 0x10], eax
mov dword [esp], 0x6ca0726a
call esi
mov esi, eax
call sym._GetProcessHeap_0
lea edx, [esi + esi + 2]
mov dword [esp + 4], 8
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebx + 0x14], eax
test eax, eax
je 0x6ca018fa
mov dword [esp + 4], 0x6ca0726a
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcscpy]
jmp 0x6ca018fa
call sym._GetProcessHeap_0
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov ebx, eax
test eax, eax
jne 0x6ca01910
mov eax, dword [ebp - 0x4c]
mov esi, 8
test eax, eax
jne 0x6ca015ea
jmp 0x6ca01575
call sym._GetProcessHeap_0
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 8
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6ca017dc
mov dword [eax], 0x1f4
mov eax, dword [ebp - 0x54]
lea edi, [eax + eax]
call sym._GetProcessHeap_0
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebx + 4], eax
test eax, eax
je 0x6ca01853
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [ebp - 0x4c]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
mov eax, dword [eax + 4]
mov dword [esp], eax
call esi
mov edi, eax
call sym._GetProcessHeap_0
lea edx, [edi + edi + 2]
mov dword [esp + 4], 8
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebx + 8], eax
test eax, eax
je 0x6ca018a0
mov edx, dword [ebp - 0x4c]
mov edx, dword [edx + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [0x6ca09024]
mov dword [ebx + 0xc], eax
mov eax, dword [0x6ca09028]
mov dword [ebx + 0x10], eax
mov dword [esp], 0x6ca0726a
call esi
mov esi, eax
call sym._GetProcessHeap_0
lea edx, [esi + esi + 2]
mov dword [esp + 4], 8
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebx + 0x14], eax
test eax, eax
je 0x6ca018f3
mov dword [esp + 4], 0x6ca0726a
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov dword [ebx + 0x18], 1
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], ebx
jmp 0x6ca015e3
mov dword [eax], 0x1f4
mov eax, dword [ebp - 0x54]
lea edi, [eax + eax]
call sym._GetProcessHeap_0
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebx + 4], eax
test eax, eax
je 0x6ca0194c
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, eax
call sym._GetProcessHeap_0
lea edx, [esi + esi + 2]
mov dword [esp + 4], 8
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebx + 8], eax
test eax, eax
je 0x6ca01997
mov edx, dword [ebp - 0x4c]
mov edx, dword [edx + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [0x6ca09024]
xor esi, esi
mov dword [ebx + 0xc], eax
mov eax, dword [0x6ca09028]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
jmp 0x6ca015e3
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], str.Level__d_unimplemented_n
mov dword [esp + 0x10], 0xd4
mov dword [esp + 0xc], str.NetrWkstaGetInfo
mov dword [esp + 8], 0x6ca07175
mov dword [esp + 4], 0x6ca06010
mov dword [esp], 0
call sym._ros_dbg_log
jmp 0x6ca015e3