Function at 0x1106d470
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11182ccb
mov eax, dword fs:[0]
push eax
sub esp, 0xa20
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
mov ebx, ecx
mov edi, dword [ebx + 0x14]
mov dword [ebp - 0xa14], eax
mov eax, dword [edi + 0x134]
mov dword [ebp - 0xa08], ebx
test eax, eax
jne 0x1106d4d3
push 0x14ee
push 0x111a2458
push 0x111a279c
call fcn.11029a70
add esp, 0xc
cmp dword [edi + 0x3a0], 0
je 0x1106d4f3
push 0x14f0
push 0x111a2458
push 0x111a313c
call fcn.11029a70
add esp, 0xc
mov ecx, dword [ebx + 8]
mov eax, dword [edi + 0x4a4]
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0xa04], ecx
mov ecx, ebx
mov dword [ebp - 0xa0c], edx
mov dword [ebp - 0xa18], eax
call fcn.11064cf0
lea esi, [edi + 0x4f8]
push esi
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0xa00], esi
mov dword [ebp - 0xa2c], esi
call dword [sym.imp.KeRneL32.DLl_EnterCriticalSection]
cmp dword [edi + 0x38c], 0
mov dword [ebp - 4], 0
je 0x1106d5ba
cmp dword [ebp + 0x10], 0
je 0x1106d5ba
cmp dword [edi + 0x614], 0
je 0x1106d5ac
xor eax, eax
mov dword [ebp - 0xa28], eax
push 0x1954
mov dword [ebp - 0xa24], eax
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0xa28], 3
call fcn.11146710
mov ecx, dword [edi + 0x61c]
push ecx
mov ecx, dword [edi + 0x614]
lea edx, [ebp - 0xa28]
mov dword [ebp - 0xa20], eax
mov eax, dword [edi + 0x618]
push edx
push eax
push 0
call ecx
add esp, 0x14
push esi
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
xor eax, eax
jmp 0x1106ddf5
cmp dword [ebp + 8], 0
jne 0x1106d690
cmp dword [edi + 0x39c], 0
jne 0x1106d5e4
push 0x150e
push 0x111a2458
push 0x111a312c
call fcn.11029a70
add esp, 0xc
mov eax, dword [edi + 0x39c]
cmp eax, 1
jle 0x1106d5fc
dec eax
mov dword [edi + 0x39c], eax
push esi
jmp 0x1106ddea
mov edx, dword [ebx]
mov eax, dword [edx + 0x44]
push 1
push 0
push 0
mov ecx, ebx
call eax
cmp dword [edi + 0x3ac], 0
je 0x1106d627
mov esi, edi
call fcn.11065340
mov ecx, dword [ebp - 0xa00]
push ecx
jmp 0x1106ddea
cmp dword [ebp + 0xc], 0
push 0
je 0x1106d63f
mov edx, dword [ebx]
mov eax, dword [edi + 0x444]
mov edx, dword [edx + 0x2c]
push 0xa
push eax
jmp 0x1106d653
mov ecx, dword [edi + 0x444]
mov eax, dword [ebx]
mov edx, dword [eax + 0x2c]
push 2
and ecx, 0x100
push ecx
mov ecx, ebx
call edx
mov esi, edi
call fcn.11065340
mov eax, dword [ebx]
mov edx, dword [eax + 0x5c]
mov ecx, ebx
call edx
test eax, eax
je 0x1106dde3
mov ecx, dword [ebp - 0xa04]
test ecx, ecx
je 0x1106dde3
push 0
push 0x110653f0
push 0x20
call fcn.1106c340
jmp 0x1106dde3
mov eax, dword [edi + 0x39c]
test eax, eax
je 0x1106d6a7
inc eax
mov dword [edi + 0x39c], eax
push esi
jmp 0x1106ddea
mov edx, dword [ebx]
mov eax, dword [edx + 0x5c]
mov ecx, ebx
call eax
test eax, eax
je 0x1106d6dc
mov ecx, dword [ebp - 0xa04]
test ecx, ecx
je 0x1106d6dc
or dword [edi + 0x3b0], 0x10
push edi
push 0x110653f0
push 0x20
mov dword [edi + 0x3bc], 0x800
call fcn.1106c340
push 0
mov esi, edi
call fcn.11066c30
call fcn.1109d320
push 0x5032
mov dword [edi + 0x4e8], eax
call fcn.11110230
mov dword [edi + 0x4f0], eax
call fcn.11083cf0
push 0x5016
mov dword [edi + 0x510], eax
call fcn.11110230
mov dword [edi + 0x518], eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x58]
add esp, 0xc
push 0
mov ecx, ebx
call eax
inc dword [edi + 0x39c]
cmp dword [edi + 0x3ac], 0
jne 0x1106d61b
cmp dword [edi + 0x130], 0
je 0x1106dda4
cmp dword [edi + 0x394], 0
jne 0x1106d7c4
test dword [edi + 0x3b0], 0x100
je 0x1106d7c4
mov edx, dword [ebp - 0xa14]
test edx, edx
je 0x1106d795
mov eax, dword [ebp + 0x10]
push eax
mov ecx, edi
call fcn.1106c420
add esp, 4
test eax, eax
jne 0x1106d795
mov esi, edi
call fcn.11065340
mov ecx, dword [ebp - 0xa00]
push ecx
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
xor eax, eax
jmp 0x1106ddf5
mov edx, dword [ebp + 0x10]
push edx
xor edx, edx
mov ecx, edi
call fcn.1106c420
add esp, 4
test eax, eax
jne 0x1106d7c4
mov esi, edi
call fcn.11065340
mov eax, dword [ebp - 0xa00]
push eax
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
xor eax, eax
jmp 0x1106ddf5
push 0x800
lea ecx, [ebp - 0x9fc]
push 0
push ecx
call fcn.11162be0
mov esi, dword [ebp - 0xa0c]
add esp, 0xc
cmp dword [edi + 0x394], 0
mov byte [ebp - 0x134], 0
jne 0x1106d856
push 0
push 0
push 0x111a311c
push 0x111a0f78
mov ecx, esi
call fcn.1105e820
test eax, eax
je 0x1106d856
mov edx, dword [edi + 0x3b0]
mov ecx, dword [ebp - 0xa18]
shr edx, 8
push 0
not edx
and edx, 1
push edx
push 0x1119fe34
push 0x111a0f40
call fcn.1105e820
test eax, eax
je 0x1106d856
mov ecx, dword [ebp - 0xa08]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
lea edx, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0xa10]
push edx
call eax
test eax, eax
je 0x1106d77a
cmp dword [edi + 0x3a4], 0
mov edx, 3
mov word [ebp - 0x9fc], dx
jle 0x1106d874
mov ax, word [edi + 0x3a4]
jmp 0x1106d8d1
push 0
call fcn.11143a20
push eax
push 0x111972c0
push 0x111a0f8c
mov ecx, esi
call fcn.1105e820
mov word [ebp - 0x9fa], ax
cmp ax, 0xa
jne 0x1106d8ba
push 4
call fcn.11143a20
push eax
push 0x111a310c
push 0x111a0f8c
mov ecx, esi
call fcn.1105e820
mov word [ebp - 0x9fa], ax
movzx ecx, ax
push 0
push ecx
push 0x111a3100
push 0x111a0f78
mov ecx, esi
call fcn.1105e820
push 0
push 0
push 0x1119d874
push 0x111a0f78
mov ecx, esi
mov word [ebp - 0x9fa], ax
call fcn.1105e820
mov dword [ebp - 0x9f4], eax
test eax, eax
jne 0x1106d947
mov edx, dword [esi]
mov edx, dword [edx + 4]
push eax
push 0xa
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x1c]
push eax
push 0x1119a860
push 0x111a0f8c
mov ecx, esi
call edx
lea eax, [ebp - 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1106d921
sub eax, edx
inc eax
shr eax, 1
push 0
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.110b7ce0
add esp, 0xc
or eax, 0xff000000
mov dword [ebp - 0x9f4], eax
mov ecx, dword [ebp - 0xa08]
mov ecx, dword [ecx + 8]
call fcn.11068f50
mov edx, dword [esi]
mov edx, dword [edx + 4]
push 0
push 0x64
mov byte [ebp - 0x9f8], al
lea eax, [ebp - 0x9f0]
push eax
push 0x111a30f4
push 0x111a0f78
mov ecx, esi
call edx
lea eax, [ebp - 0x9f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1106d982
sub eax, edx
lea esi, [ebp + eax - 0x9ef]
lea eax, [ebp - 0x134]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1106d9a0
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1106d9b0
mov ebx, dword [sym.imp.aDvapi32.DLL_GetUserNameA]
sub eax, edx
lea edx, [ebp - 0xa04]
lea esi, [esi + eax + 1]
push edx
lea eax, [ebp - 0xe4]
push eax
mov dword [ebp - 0xa04], 0x64
call ebx
lea ecx, [ebp - 0xa04]
push ecx
lea edx, [ebp - 0xe4]
push edx
call ebx
test eax, eax
je 0x1106da0c
lea eax, [ebp - 0xe4]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1106da00
jmp 0x1106da30
mov edx, dword [0x111a30e4]
mov dword [esi], edx
mov eax, dword [0x111a30e8]
mov dword [esi + 4], eax
mov ecx, dword [0x111a30ec]
mov dword [esi + 8], ecx
mov dx, word [0x111a30f0]
mov word [esi + 0xc], dx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1106da35
sub eax, edx
lea esi, [esi + eax + 1]
lea eax, [ebp - 0x198]
push 0x64
push eax
mov byte [ebp - 0x198], cl
call fcn.11065170
lea eax, [ebp - 0x198]
mov edx, esi
mov ecx, eax
add esp, 8
sub edx, ecx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1106da65
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1106da74
sub eax, edx
lea esi, [esi + eax + 1]
mov byte [ebp - 0x80], cl
lea ecx, [ebp - 0xe4]
mov eax, 0x111ee7c0
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1106dab0
test dl, dl
je 0x1106daac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1106dab0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1106da90
xor eax, eax
jmp 0x1106dab5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1106dad1
lea esp, [esp]
mov cl, byte [eax + 0x111ee758]
mov byte [ebp + eax - 0x80], cl
inc eax
test cl, cl
jne 0x1106dac0
jmp 0x1106db04
lea edx, [ebp - 0x80]
push 0x64
push edx
call fcn.111474b0
add esp, 8
xor eax, eax
mov cl, byte [ebp + eax - 0x80]
mov byte [eax + 0x111ee758], cl
inc eax
test cl, cl
jne 0x1106dae1
xor eax, eax
mov cl, byte [ebp + eax - 0xe4]
mov byte [eax + 0x111ee7c0], cl
inc eax
test cl, cl
jne 0x1106daf2
lea eax, [ebp - 0x80]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1106db10
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1106db20
sub eax, edx
lea edx, [ebp - 0xa14]
lea esi, [esi + eax + 1]
push edx
lea eax, [ebp - 0x1fc]
push eax
mov dword [ebp - 0xa14], 0x64
call dword [sym.imp.KeRneL32.DLl_GetComputerNameA]
lea eax, [ebp - 0x1fc]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1106db57
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1106db66
push 0x37
push 0x14
push 0xa
sub eax, ecx
push 0xc
lea esi, [esi + eax + 1]
push 0x111a30d8
push esi
call fcn.11163f93
lea esi, [esi + eax + 1]
call fcn.11143a20
push eax
push 0x1119f708
push esi
call fcn.11163f93
lea esi, [esi + eax + 1]
mov eax, dword [edi + 0x620]
add esp, 0x24
test eax, eax
je 0x1106dbba
mov ecx, eax
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x1106dbb0
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1106dbc0
sub eax, edx
lea esi, [esi + eax + 1]
mov byte [esi], cl
mov eax, dword [edi + 0x620]
inc esi
test eax, eax
je 0x1106dbeb
push 0xfde9
push 0x78
push esi
push eax
call fcn.111433d0
add esp, 0x10
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1106dbf0
mov ecx, dword [ebp - 0xa08]
sub eax, edx
lea ebx, [ebp - 0x9fc]
sub eax, ebx
push 4
lea eax, [eax + esi + 1]
push eax
mov dword [edi + 0x370], 0xfffffffe
mov edx, dword [ecx]
mov edx, dword [edx + 0x44]
mov eax, ebx
push eax
call edx
cmp dword [edi + 0x394], 0
jne 0x1106dda4
cmp dword [edi + 8], 0
jne 0x1106d7a9
cmp dword [edi + 0x38c], 0
je 0x1106dc54
mov esi, dword [ebp - 0xa10]
mov edx, 1
mov eax, edi
call fcn.110656b0
push 0
push 0
push 1
mov esi, edi
call fcn.1106b140
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
cmp dword [edi + 0x38c], 0
je 0x1106dc83
mov esi, dword [ebp - 0xa10]
xor edx, edx
mov eax, edi
call fcn.110656b0
test ebx, ebx
je 0x1106d77a
test dword [edi + 0x3b0], 0x100
jne 0x1106dcc8
cmp dword [edi + 0x3c0], 0
je 0x1106dcc8
push edi
call fcn.1106a520
add esp, 4
test eax, eax
jne 0x1106dcc8
mov esi, edi
call fcn.11065340
mov edx, dword [ebp - 0xa00]
push edx
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
xor eax, eax
jmp 0x1106ddf5
call fcn.11143a20
mov ecx, dword [ebp - 0xa18]
push 0
push 0
push 0x111972c0
push 0x111a0f8c
mov esi, eax
call fcn.1105e820
mov ecx, dword [ebp - 0xa0c]
push 0
push 0
push 0x111972c0
push 0x111a0f8c
mov ebx, eax
call fcn.1105e820
cmp dword [edi + 0x3a4], 0x37
jne 0x1106dd13
mov esi, 0x37
jmp 0x1106dd1f
cmp eax, 0x2a
je 0x1106dd1d
cmp eax, 0x2d
jne 0x1106dd1f
mov esi, eax
cmp esi, ebx
je 0x1106dd35
cmp eax, 0x2a
je 0x1106d7a9
cmp eax, 0x2d
je 0x1106d7a9
cmp esi, 0x32
je 0x1106dd3f
cmp esi, 0xa
jg 0x1106dd48
cmp ebx, 0x39
je 0x1106d77a
push 7
mov esi, 0x1119b2ec
call fcn.1102ad70
add esp, 4
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1106dd77
test cl, cl
je 0x1106dd73
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1106dd77
add eax, 2
add esi, 2
test cl, cl
jne 0x1106dd57
xor eax, eax
jmp 0x1106dd7c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1106dda4
cmp ebx, 0x39
jne 0x1106dda4
mov ecx, dword [ebp - 0xa0c]
push eax
push eax
push 0x111a30cc
push 0x111a30c8
call fcn.1105e820
test eax, eax
jne 0x1106dcad
mov esi, dword [ebp - 0xa08]
push 0
mov dword [edi + 0x38c], 0
mov dword [edi + 0x394], 1
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push 0xc
push 0
mov ecx, esi
call edx
cmp dword [edi + 0x130], 0
je 0x1106dde3
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
push 0
push 1
mov ecx, esi
call edx
mov eax, dword [ebp - 0xa00]
push eax
call dword [sym.imp.KeRneL32.DLl_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret 0x10