Function at 0x42812d
Capabilities:
Get hostname
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x485118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x8c], 0
and word [eax], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 4
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], edi
mov ecx, 0x401e64
mov eax, ebx
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x428199
test dx, dx
je 0x428195
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x428199
add eax, esi
add ecx, esi
test dx, dx
jne 0x428175
xor eax, eax
jmp 0x42819e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x428200
mov esi, dword [ebp + 0x1c]
test esi, esi
je 0x4281db
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4281ae
sub eax, edx
sar eax, 1
je 0x4281db
mov edx, dword [ebp - 0x88]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4281c8
jmp 0x4285d7
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x88]
dec edi
mov dword [ebp - 0x90], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [ebp - 0x8c], eax
jmp 0x4285e1
mov ecx, 0x401e60
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42822b
test dx, dx
je 0x428227
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42822b
add eax, esi
add ecx, esi
test dx, dx
jne 0x428207
xor eax, eax
jmp 0x428230
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42828c
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x42826d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x428240
sub eax, edx
sar eax, 1
je 0x42826d
mov edx, dword [ebp - 0x88]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x42825a
jmp 0x4285d7
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x88]
dec edi
mov dword [ebp - 0x90], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4281f5
mov ecx, 0x401e5c
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4282b7
test dx, dx
je 0x4282b3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4282b7
add eax, esi
add ecx, esi
test dx, dx
jne 0x428293
xor eax, eax
jmp 0x4282bc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4282e0
mov edx, dword [ebp - 0x88]
mov eax, 0x401e58
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4282cd
jmp 0x4285d7
mov ecx, 0x401e54
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42830b
test dx, dx
je 0x428307
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42830b
add eax, esi
add ecx, esi
test dx, dx
jne 0x4282e7
xor eax, eax
jmp 0x428310
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42833a
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4285d7
mov edx, dword [ebp - 0x88]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x428327
jmp 0x4285d7
mov ecx, 0x401e50
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x428365
test dx, dx
je 0x428361
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x428365
add eax, esi
add ecx, esi
test dx, dx
jne 0x428341
xor eax, eax
jmp 0x42836a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x428394
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x4285d7
mov edx, dword [ebp - 0x88]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x428381
jmp 0x4285d7
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x428399
sub eax, edx
sar eax, 1
push 0x401e40
push ebx
mov esi, eax
call dword [sym.imp.msvcrt.dll_wcsspn]
cmp eax, esi
pop ecx
pop ecx
jne 0x4285e1
push 0
call dword [sym.imp.msvcrt.dll_time]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.msvcrt.dll_localtime]
pop ecx
pop ecx
mov esi, eax
movzx eax, word [ebx]
test ax, ax
push 9
pop ecx
lea edi, [ebp - 0xbc]
rep movsd dword es:[edi], dword [esi]
je 0x4285d7
mov ebx, dword [sym.imp.msvcrt.dll_swprintf]
movzx eax, ax
sub eax, 0x44
mov ecx, 0x401e34
je 0x428574
sub eax, 4
je 0x428538
dec eax
je 0x4284fc
sub eax, 4
je 0x4284bb
sub eax, 6
je 0x42847c
sub eax, 6
jne 0x4285be
mov eax, dword [ebp - 0xa8]
add eax, 0x76c
push eax
lea eax, [ebp - 0x84]
push 0x401e28
push eax
call ebx
lea eax, [ebp - 0x84]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x428458
mov edi, dword [ebp - 0x88]
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x42846c
jmp 0x4285ae
push dword [ebp - 0xbc]
lea eax, [ebp - 0x84]
push ecx
push eax
call ebx
lea eax, [ebp - 0x84]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x428497
mov edi, dword [ebp - 0x88]
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x4284ab
jmp 0x4285ae
mov eax, dword [ebp - 0xac]
inc eax
push eax
push ecx
lea eax, [ebp - 0x84]
push eax
call ebx
lea eax, [ebp - 0x84]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4284d8
mov edi, dword [ebp - 0x88]
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x4284ec
jmp 0x4285ae
push dword [ebp - 0xb8]
lea eax, [ebp - 0x84]
push ecx
push eax
call ebx
lea eax, [ebp - 0x84]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x428517
mov edi, dword [ebp - 0x88]
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x42852b
jmp 0x4285ae
push dword [ebp - 0xb4]
lea eax, [ebp - 0x84]
push ecx
push eax
call ebx
lea eax, [ebp - 0x84]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x428553
mov edi, dword [ebp - 0x88]
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x428567
jmp 0x4285ae
push dword [ebp - 0xb0]
lea eax, [ebp - 0x84]
push ecx
push eax
call ebx
lea eax, [ebp - 0x84]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x42858f
mov edi, dword [ebp - 0x88]
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x4285a3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [ebp - 0x94], 2
mov eax, dword [ebp - 0x94]
movzx eax, word [eax]
test ax, ax
jne 0x4283fb
mov dword [ebp - 0x8c], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004347dd
leave
ret 0x20