Function at 0x41d7d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d4
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x7d0], eax
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x284], ax
lea eax, [ebp - 0x282]
push eax
call fcn.0042bf20
push str.Enter_GetUserScript_r_n
push 1
mov dword [ebp - 0x7d4], 0x80
call fcn.0041a380
lea eax, [ebp - 0x7d0]
mov byte [ebp - 0x66c], 0
push eax
call fcn.0041fb40
call fcn.0041f890
push eax
push str.Domain_Controller_is__s_r_n
push 2
call fcn.0041a380
add esp, 0x24
lea eax, [ebp - 0x284]
push 0x80
push eax
push 0xffffffffffffffff
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x7cc]
mov dword [ebp - 0x7cc], 0
push eax
lea eax, [ebp - 0x284]
push 3
push eax
call fcn.0041f890
push eax
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
je 0x41d8ba
push eax
push eax
call fcn.0041f890
push eax
lea eax, [ebp - 0x284]
push eax
push str.NetUsergetInfo___level_3_fails_for_user_s_domaincontroller_s_rc_d__0x_X__n
push 2
call fcn.0041a5b0
add esp, 0x18
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x7cc]
push dword [esi + 0x1c]
push str.script_path___s_r_n
push 2
call fcn.0041a380
mov eax, dword [esi + 0x1c]
add esp, 0xc
test eax, eax
je 0x41da36
cmp word [eax], 0
je 0x41da36
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x104]
push 0
push 0
push 0x80
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call esi
call fcn.0041f890
test eax, eax
je 0x41d942
push 0
push 0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0xffffffffffffffff
call fcn.0041f890
push eax
push 0
push 0
call esi
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x84]
push eax
push 0x446e40
jmp 0x41d969
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x84]
push eax
push str._sNETLOGON_s
lea eax, [ebp - 0x66c]
push eax
call fcn.0041d790
add esp, 0x10
lea eax, [ebp - 0x66c]
push eax
push str.netlogon_script_is___s_n
push 2
call fcn.0041a380
lea eax, [ebp - 0x66c]
push 0x20
push eax
call fcn.00427670
add esp, 0x14
test eax, eax
je 0x41d9c2
lea ecx, [ebp - 0x66c]
sub eax, ecx
push eax
mov eax, ecx
push eax
lea eax, [ebp - 0x184]
push 0x80
push eax
call fcn.00427f68
add esp, 0x10
jmp 0x41d9dd
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x184]
push 0x80
push eax
call fcn.00427b16
add esp, 0xc
lea eax, [ebp - 0x7c8]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.0042bfb0
add esp, 8
test eax, eax
je 0x41da36
push str.SystemRoot
push 0x12c
lea eax, [ebp - 0x798]
push eax
lea eax, [ebp - 0x7cc]
push eax
call fcn.00427325
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x798]
push eax
lea eax, [ebp - 0x66c]
push str._sSYSTEM32REPLIMPORTSCRIPTS_s
push eax
call fcn.0041d790
add esp, 0x20
push edi
lea edi, [ebp - 0x66c]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41da40
sub edi, ecx
je 0x41da89
lea eax, [edi + 2]
push eax
call fcn.00427138
mov esi, eax
lea ecx, [edi + 2]
lea eax, [ebp - 0x66c]
push eax
push ecx
push esi
call fcn.00427b16
push esi
push str.Exit_GetUserScript_script___s_r_n
push 1
call fcn.0041a380
add esp, 0x1c
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
push str.Exit_GetUserScript_r_n
push 1
call fcn.0041a380
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.004265fb
mov esp, ebp
pop ebp
ret