Function at 0x4411bc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x240
mov ecx, dword [0x565fa8]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, ebx
push eax
call fcn.0041d496
movzx eax, byte [ebx + 0xb]
mov ecx, dword [ebx + 4]
test al, al
mov esi, eax
cmovs esi, ecx
test esi, esi
je 0x441a5a
cmp esi, 1
je 0x441256
mov edx, dword [ebx]
test al, al
mov edi, ebx
cmovs edi, edx
movzx ebx, word [edi]
cmp bx, 0x27
je 0x441221
cmp bx, 0x22
mov ebx, dword [ebp + 8]
jne 0x441256
cmp word [edi + esi*2 - 2], 0x22
je 0x44122c
jmp 0x441256
cmp word [edi + esi*2 - 2], 0x27
mov ebx, dword [ebp + 8]
jne 0x441256
test al, al
js 0x44123c
lea ecx, [eax - 1]
lea eax, [ebx + eax*2 - 2]
mov byte [ebx + 0xb], cl
jmp 0x441246
lea eax, [ecx - 1]
mov dword [ebx + 4], eax
lea eax, [edx + ecx*2 - 2]
mov word [eax], 0
mov ecx, ebx
push 1
push 0
call fcn.0041dd9c
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x24c], eax
je 0x44127f
push 0x51a91a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x238], eax
jmp 0x44127f
xor eax, eax
mov esi, dword [eax*8 + 0x51a934]
mov dword [ebp - 0x230], eax
push esi
call fcn.004ff384
add esp, 4
movzx edx, byte [ebx + 0xb]
mov ecx, ebx
test dl, dl
jns 0x4412a3
mov ecx, dword [ebx]
test eax, eax
je 0x44133d
test dl, dl
mov dword [ebp - 0x22c], ecx
jns 0x4412b8
mov edx, dword [ebx + 4]
lea ecx, [edx + edx]
add eax, eax
sar eax, 1
sar ecx, 1
cmp ecx, eax
jl 0x44149c
mov edi, dword [ebp - 0x22c]
lea ebx, [eax - 1]
mov dword [ebp - 0x23c], ebx
lea edx, [edi + edx*2]
mov dword [ebp - 0x234], edx
movzx edx, word [esi]
mov ebx, ecx
sub ebx, eax
inc ebx
je 0x44149c
mov ebx, dword [ebp - 0x23c]
sub ebx, ecx
cmp word [edi], dx
je 0x441307
add edi, 2
inc ebx
jne 0x4412f7
jmp 0x44149c
test edi, edi
je 0x44149c
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x44141e
movzx ebx, word [edi + ecx*2]
cmp bx, word [esi + ecx*2]
lea ecx, [ecx + 1]
je 0x441312
mov ecx, dword [ebp - 0x234]
add edi, 2
sub ecx, edi
sar ecx, 1
cmp ecx, eax
jge 0x4412e4
jmp 0x44149c
xor edi, edi
push esi
call fcn.004ff384
add esp, 4
mov dword [ebp - 0x22c], eax
xor eax, eax
push eax
mov ecx, dword [ebp - 0x230]
push dword [ecx*8 + 0x51a938]
lea esi, [ebp - 0x218]
push esi
push eax
call dword [ebp - 0x238]
test eax, eax
jne 0x441379
mov word [ebp - 0x218], 0
lea ebx, [ebp - 0x224]
mov ecx, ebx
push esi
call fcn.00402768
movzx eax, byte [ebp - 0x219]
mov ecx, dword [ebp - 0x220]
test al, al
mov esi, eax
mov dword [ebp - 0x23c], ecx
cmovs esi, ecx
test esi, esi
je 0x44145a
mov ecx, dword [ebp - 0x224]
test al, al
mov edx, ebx
cmovs edx, ecx
mov dword [ebp - 0x234], ecx
cmp word [edx + esi*2 - 2], 0x5c
jne 0x44145a
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + 0xb]
test cl, cl
mov edx, ecx
jns 0x4413db
mov edx, dword [ebp + 8]
mov edx, dword [edx + 4]
mov esi, dword [ebp - 0x22c]
lea ebx, [ebp - 0x224]
add esi, edi
cmp edx, esi
jbe 0x44145a
mov ebx, dword [ebp + 8]
test cl, cl
mov edx, ebx
jns 0x4413f8
mov edx, dword [ebx]
cmp word [edx + esi*2], 0x5c
lea ebx, [ebp - 0x224]
jne 0x44145a
test al, al
js 0x441438
lea ecx, [eax - 1]
mov byte [ebp - 0x219], cl
mov word [ebp + eax*2 - 0x226], 0
jmp 0x441454
cmp dword [ebp - 0x234], edi
je 0x44149c
sub edi, dword [ebp - 0x22c]
cmp edi, 0xfffffffe
je 0x44149c
sar edi, 1
jmp 0x44133f
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ebp - 0x234]
lea eax, [ecx - 1]
mov dword [ebp - 0x220], eax
mov word [edx + ecx*2 - 2], 0
lea ebx, [ebp - 0x224]
movzx eax, byte [ebp - 0x219]
mov edx, dword [ebp - 0x224]
mov ecx, dword [ebp + 8]
test al, al
cmovs eax, dword [ebp - 0x220]
cmovns edx, ebx
push eax
push edx
push dword [ebp - 0x22c]
push edi
call fcn.0041de22
xor eax, eax
cmp byte [ebp - 0x219], al
jns 0x44149c
push dword [ebp - 0x224]
call fcn.004e6856
add esp, 4
mov eax, dword [ebp - 0x230]
mov ebx, dword [ebp + 8]
inc eax
cmp eax, 7
jne 0x441281
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x234], eax
je 0x4414d8
push 0x51a96e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x238], eax
jmp 0x4414d8
mov dl, byte [ebx + 0xb]
mov esi, dword [ebx + 4]
mov eax, dword [ebx]
movzx ecx, dl
test dl, dl
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], eax
mov edi, ecx
cmovs ebx, eax
cmovs edi, esi
lea esi, [edi + edi]
cmp esi, 0x18
jl 0x44163d
lea eax, [ebx + edi*2]
mov edi, ebx
mov dword [ebp - 0x23c], eax
shr esi, 1
add esi, 0xfffffff5
je 0x44163d
cmp word [edi], 0x24
je 0x44152c
add edi, 2
dec esi
jne 0x44151b
jmp 0x44163d
test edi, edi
je 0x44163d
mov esi, 0xffffffea
test esi, esi
je 0x441563
movzx eax, word [edi + esi + 0x18]
cmp ax, word [esi + 0x51a9ae]
lea esi, [esi + 2]
je 0x441539
mov esi, dword [ebp - 0x23c]
add edi, 2
sub esi, edi
cmp esi, 0x18
jge 0x441510
jmp 0x44163d
cmp dword [ebp - 0x23c], edi
je 0x44163d
sub edi, ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x22c]
cmp edi, 0xfffffffe
je 0x441646
xor eax, eax
lea esi, [ebp - 0x224]
mov dword [ebp - 0x224], eax
push esi
push eax
mov esi, dword [ebp - 0x238]
call esi
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x44162a
sar edi, 1
xor ecx, ecx
dec ecx
add eax, eax
cmovb eax, ecx
push eax
call fcn.004e6883
add esp, 4
mov ecx, eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x224]
push eax
push ecx
call esi
lea esi, [ebp - 0x218]
mov ecx, esi
push dword [ebp - 0x230]
call fcn.00402768
movzx eax, byte [ebp - 0x20d]
test al, al
jns 0x4415f8
mov eax, dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
mov ecx, ebx
push eax
push esi
push 0xc
push edi
call fcn.0041de22
xor eax, eax
cmp byte [ebp - 0x20d], al
jns 0x44161c
push dword [ebp - 0x218]
call fcn.004e6856
add esp, 4
push dword [ebp - 0x230]
call fcn.004e688c
add esp, 4
mov eax, dword [ebx]
mov dl, byte [ebx + 0xb]
mov dword [ebp - 0x230], eax
mov eax, dword [ebx + 4]
movzx ecx, dl
jmp 0x441646
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x22c]
mov edi, dword [ebp - 0x230]
test dl, dl
cmovs ecx, eax
lea edx, [ecx + ecx]
cmovns edi, ebx
cmp edx, 0x1e
jl 0x441761
lea ecx, [edi + ecx*2]
mov esi, edi
shr edx, 1
add edx, 0xfffffff2
je 0x441761
cmp word [esi], 0x24
je 0x441681
add esi, 2
dec edx
jne 0x441670
jmp 0x441761
test esi, esi
je 0x441761
mov edx, 0xffffffe4
test edx, edx
je 0x4416b4
movzx eax, word [esi + edx + 0x1e]
cmp ax, word [edx + 0x51a9ce]
lea edx, [edx + 2]
je 0x44168e
add esi, 2
mov edx, ecx
sub edx, esi
cmp edx, 0x1e
jge 0x441665
jmp 0x441761
cmp ecx, esi
je 0x441761
sub esi, edi
cmp esi, 0xfffffffe
je 0x441761
xor eax, eax
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], eax
push ecx
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x441761
sar esi, 1
xor ecx, ecx
dec ecx
add eax, eax
cmovb eax, ecx
push eax
call fcn.004e6883
add esp, 4
mov edi, eax
lea eax, [ebp - 0x224]
push eax
push edi
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea ebx, [ebp - 0x218]
mov ecx, ebx
push edi
call fcn.00402768
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x441730
mov eax, dword [ebp - 0x214]
mov ebx, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push ebx
push 0xf
push esi
call fcn.0041de22
xor eax, eax
cmp byte [ebp - 0x20d], al
jns 0x441755
push dword [ebp - 0x218]
call fcn.004e6856
add esp, 4
push edi
call fcn.004e688c
add esp, 4
mov ebx, dword [ebp + 8]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x22c], eax
je 0x44178a
push 0x51a9d2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x244], eax
jmp 0x44178a
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x23c], eax
je 0x4417b3
push 0x51aa0a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x240], eax
jmp 0x4417b3
mov dl, byte [ebx + 0xb]
mov esi, dword [ebx + 4]
mov eax, dword [ebx]
mov edi, ebx
movzx ecx, dl
test dl, dl
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x230], eax
mov ebx, ecx
cmovs edi, eax
cmovs ebx, esi
lea esi, [ebx + ebx]
cmp esi, 0x1c
jl 0x4418fa
lea eax, [edi + ebx*2]
mov ebx, edi
mov dword [ebp - 0x248], eax
shr esi, 1
add esi, 0xfffffff3
je 0x4418fa
cmp word [ebx], 0x24
je 0x441809
add ebx, 2
dec esi
jne 0x4417f8
jmp 0x4418fa
test ebx, ebx
je 0x4418fa
mov esi, 0xffffffe6
test esi, esi
je 0x441840
movzx eax, word [ebx + esi + 0x1c]
cmp ax, word [esi + 0x51aa34]
lea esi, [esi + 2]
je 0x441816
mov esi, dword [ebp - 0x248]
add ebx, 2
sub esi, ebx
cmp esi, 0x1c
jge 0x4417ed
jmp 0x4418fa
cmp dword [ebp - 0x248], ebx
je 0x4418fa
sub ebx, edi
mov edi, dword [ebp - 0x234]
mov esi, dword [ebp - 0x238]
cmp ebx, 0xfffffffe
je 0x441906
xor eax, eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x224], eax
mov dword [ecx], eax
push ecx
lea ecx, [ebp - 0x224]
push ecx
push 0xa
push 0xffffffffffffffff
push eax
call dword [ebp - 0x244]
test eax, eax
je 0x4418e4
lea esi, [ebp - 0x218]
sar ebx, 1
mov ecx, esi
push dword [ebp - 0x224]
call fcn.00402768
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4418b3
mov eax, dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push esi
push 0xe
push ebx
call fcn.0041de22
push dword [ebp - 0x224]
call dword [ebp - 0x240]
xor eax, eax
cmp byte [ebp - 0x20d], al
jns 0x4418e4
push dword [ebp - 0x218]
call fcn.004e6856
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dl, byte [eax + 0xb]
mov esi, dword [eax + 4]
mov dword [ebp - 0x230], ecx
movzx ecx, dl
jmp 0x441906
mov edi, dword [ebp - 0x234]
mov esi, dword [ebp - 0x238]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x230]
test dl, dl
cmovs ecx, esi
lea edx, [ecx + ecx]
cmovns eax, ebx
cmp edx, 0x1e
mov dword [ebp - 0x230], eax
jl 0x441a1c
mov esi, dword [ebp - 0x230]
lea ecx, [esi + ecx*2]
shr edx, 1
add edx, 0xfffffff2
je 0x441a1c
cmp word [esi], 0x24
je 0x44194e
add esi, 2
dec edx
jne 0x44193d
jmp 0x441a1c
test esi, esi
je 0x441a1c
mov edx, 0xffffffe4
test edx, edx
je 0x441981
movzx eax, word [esi + edx + 0x1e]
cmp ax, word [edx + 0x51aa54]
lea edx, [edx + 2]
je 0x44195b
add esi, 2
mov edx, ecx
sub edx, esi
cmp edx, 0x1e
jge 0x441932
jmp 0x441a1c
cmp ecx, esi
je 0x441a1c
sub esi, dword [ebp - 0x230]
cmp esi, 0xfffffffe
je 0x441a1c
xor eax, eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x224], eax
mov dword [ecx], eax
push ecx
lea ecx, [ebp - 0x224]
push ecx
push 6
push 0xffffffffffffffff
push eax
call dword [ebp - 0x244]
test eax, eax
je 0x441a1c
lea ebx, [ebp - 0x218]
sar esi, 1
mov ecx, ebx
push dword [ebp - 0x224]
call fcn.00402768
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4419e8
mov eax, dword [ebp - 0x214]
mov ebx, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
push eax
push ebx
push 0xf
push esi
call fcn.0041de22
push dword [ebp - 0x224]
call dword [ebp - 0x240]
xor eax, eax
cmp byte [ebp - 0x20d], al
jns 0x441a19
push dword [ebp - 0x218]
call fcn.004e6856
add esp, 4
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x441a2d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x441a3e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x441a49
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x441a5a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0x240
pop esi
pop edi
pop ebx
pop ebp
ret