Function at 0x40ee3a
Capabilities:
Get hostname
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9e4
mov eax, dword [0x44e824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x9cc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x9e4], ebx
push 0x9c6
push edi
push eax
mov dword [ebp - 0x9d0], edi
call fcn.00414350
add esp, 0xc
mov dword [ebp - 0x9dc], edi
test esi, esi
je 0x40f18d
test ebx, ebx
je 0x40f18d
push 0x43aa90
push ebx
call fcn.0041bf81
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x40eec2
call fcn.00418640
push str.Failed_to_open_the_initialization_file.
push dword [eax]
push 3
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffffc
jmp 0x40f18f
push 2
push edi
push ebx
call fcn.0041b4ed
push ebx
call fcn.00422799
push edi
push edi
push ebx
mov dword [ebp - 0x9d4], eax
call fcn.0041b4ed
mov eax, dword [ebp - 0x9d4]
add esp, 0x1c
cmp eax, 1
jge 0x40ef10
push ebx
call fcn.0041acb0
mov dword [esp], str.Invalid_initialization_file.
push 0xfffffffffffffff6
push 3
push 3
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffff6
jmp 0x40f18f
add eax, 0xa
push eax
mov dword [ebp - 0x9e0], eax
call fcn.004188c5
mov dword [ebp - 0x9d8], eax
pop ecx
test eax, eax
jne 0x40ef4d
push ebx
call fcn.0041acb0
mov dword [esp], str.Memory_allocation_error_during_the_reading_of_the_intialization_fie.
push 0xfffffffffffffff3
push 3
push 3
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffff3
jmp 0x40f18f
push dword [ebp - 0x9e0]
push edi
push eax
call fcn.00414350
mov eax, dword [ebp - 0x9d4]
push ebx
push eax
push 1
push dword [ebp - 0x9d8]
call fcn.0042210b
push ebx
mov dword [ebp - 0x9d4], eax
call fcn.0041acb0
push dword [ebp - 0x9d4]
lea eax, [ebp - 0x9d0]
push dword [ebp - 0x9d8]
push eax
push str.Password
call fcn.00409627
add esp, 0x30
test eax, eax
jne 0x40f01d
cmp dword [ebp - 0x9d0], edi
je 0x40f01d
push 0x9c6
lea eax, [ebp - 0x9cc]
push edi
push eax
call fcn.00414350
mov eax, dword [ebp - 0x9d0]
mov ebx, edi
movsx eax, byte [eax]
push eax
call fcn.004228f7
add esp, 0x10
jmp 0x40eff3
cmp ebx, 0x9c5
jae 0x40eff7
mov ecx, dword [ebp - 0x9d0]
mov al, byte [ebx + ecx]
mov byte [ebp + ebx - 0x9cc], al
inc ebx
movsx eax, byte [ebx + ecx]
push eax
call fcn.004228f7
pop ecx
test eax, eax
jne 0x40efcf
push 0xf
lea eax, [ebp - 0x9cc]
push str.NewKaseyaAgent
push eax
call fcn.0041bd90
add esp, 0xc
test eax, eax
jne 0x40f030
mov dword [esi + 0x23c], 1
jmp 0x40f030
push str.Failed_to_determine_if_initialization_file_may_be_updated.
push eax
push 3
push 3
push esi
call fcn.004117f5
add esp, 0x14
push dword [ebp - 0x9d4]
lea eax, [ebp - 0x9d0]
push dword [ebp - 0x9d8]
push eax
push str.User_Name
call fcn.00409627
add esp, 0x10
test eax, eax
je 0x40f06c
push str.Failed_to_determine_groupid_from_initialization_file.
push eax
push 1
push 3
push esi
call fcn.004117f5
add esp, 0x14
jmp 0x40f11a
mov ebx, dword [ebp - 0x9d0]
test ebx, ebx
je 0x40f11a
push 0x9c6
lea eax, [ebp - 0x9cc]
push edi
push eax
call fcn.00414350
add esp, 0xc
cmp byte [ebx], 0x2e
jne 0x40f11a
inc ebx
mov dword [ebp - 0x9d0], ebx
movsx eax, byte [ebx]
jmp 0x40f0d6
mov eax, dword [ebp - 0x9d0]
movsx eax, byte [edi + eax]
push eax
call fcn.004229ad
pop ecx
test eax, eax
jne 0x40f0e1
cmp edi, 0x9c5
jae 0x40f0e1
mov ecx, dword [ebp - 0x9d0]
mov al, byte [edi + ecx]
mov byte [ebp + edi - 0x9cc], al
inc edi
movsx eax, byte [edi + ecx]
push eax
call fcn.00422926
pop ecx
test eax, eax
je 0x40f0a4
lea ecx, [ebp - 0x9cc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f0ea
sub ecx, edx
cmp ecx, 1
jbe 0x40f11a
push 0x50
lea eax, [ebp - 0x9cc]
push eax
lea eax, [esi + 0x2c4]
push eax
call fcn.0041bc30
add esp, 0xc
mov dword [esi + 0x2c0], 5
push dword [ebp - 0x9d8]
call fcn.004188c0
lea ebx, [esi + 0x102]
push ebx
lea eax, [esi + 0xcf]
push eax
lea eax, [esi + 0x9c]
push eax
push dword [ebp - 0x9e4]
call fcn.0040924b
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40f163
push str.Failed_to_get_Adminstrator_credentials.
push edi
push 3
push 3
push esi
call fcn.004117f5
add esp, 0x14
jmp 0x40f189
cmp byte [ebx], 0
jne 0x40f180
lea eax, [ebp - 0x9dc]
mov dword [ebp - 0x9dc], 0x33
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push esi
call fcn.0040edd5
pop ecx
mov edi, eax
mov eax, edi
jmp 0x40f190
push 0xfffffffffffffff8
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412e47
mov esp, ebp
pop ebp
ret