Function at 0x100fee0
Capabilities:
Get hostname
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x710
mov rax, qword [0x010657f0]
xor rax, rsp
mov qword [rsp + 0x708], rax
call fcn.01010d90
movzx eax, word [0x01001c38]
mov word [rsp + 0x60], ax
lea rax, [rsp + 0x62]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x5e0], ax
lea rax, [rsp + 0x5e2]
mov rdi, rax
xor eax, eax
mov ecx, 0x106
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x460], ax
lea rax, [rsp + 0x462]
mov rdi, rax
xor eax, eax
mov ecx, 0x106
rep stosb byte [rdi], al
mov dword [rsp + 0x598], 0
mov dword [rsp + 0x570], 0
mov qword [rsp + 0x50], 0
lea rax, [0x01001c18]
mov qword [rsp + 0x578], rax
lea rax, [0x0103ddf0]
mov qword [rsp + 0x580], rax
mov qword [rsp + 0x588], 0
mov qword [rsp + 0x590], 0
mov dword [rsp + 0x5a0], 0
call fcn.010593e0
test eax, eax
jne 0x100ffdb
xor eax, eax
jmp 0x10108e9
mov r8d, 0x1b30
xor edx, edx
lea rcx, [0x01065e00]
call sub.MSVCR80.dll_memset
mov dword [0x010679c0], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x01068048], rax
mov rcx, qword [0x01068048]
call sub.SqlResourceLoader.dll_LoadResourceLibrary
mov qword [0x01068158], rax
cmp qword [0x01068158], 0
jne 0x101002c
xor eax, eax
jmp 0x10108e9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x59c], eax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rsp + 0x59c], eax
lea rcx, [fcn.010567a0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [rsp + 0x570], 0x10
lea rdx, [rsp + 0x570]
lea rcx, [0x01067bf8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [0x010679c0], 0
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, 0x12
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r8, [0x01001c00]
lea rdx, [0x01001c18]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01065bf0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065bc8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065ba0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065b78]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065b50]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065b28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065b00]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065ad8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065ab0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065a88]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065a60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065a38]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065a10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x010659e8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x01065968]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [rsp + 0x5a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x5c8]
mov dword [0x010679ec], eax
mov edx, 1
lea rcx, [0x01065870]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1010249
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [0x01065870]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x101023d
mov dword [0x01065898], 0x18
lea rax, [0x01065870]
mov qword [0x010658a0], rax
mov dword [0x010658a8], 0
lea rax, [0x01065898]
mov qword [0x010658b0], rax
jmp 0x1010247
jmp 0x1010706
jmp 0x1010253
jmp 0x1010706
call qword [sym.imp.SQLSVC.dll_SQLSvcInit]
test eax, eax
jne 0x1010267
jmp 0x1010706
xor r8d, r8d
lea rdx, [0x01001be0]
mov ecx, 3
call fcn.01010910
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10102b5
lea rdx, [0x01001bc8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01068178], rax
cmp qword [0x01068178], 0
jne 0x10102b5
jmp 0x1010706
mov ecx, 1
call fcn.01014d50
mov qword [0x010683a8], rax
cmp dword [0x010683a0], 2
jne 0x1010312
cmp qword [0x010683a8], 0
jne 0x1010312
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, 0x78
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [rsp + 0x60]
lea rcx, [0x01001bbc]
call qword [sym.imp.MSVCR80.dll_wprintf]
jmp 0x1010706
lea rax, [rsp + 0x460]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5e0]
lea r8, [0x010679e8]
mov rdx, qword [rsp + 0x728]
mov ecx, dword [rsp + 0x720]
call fcn.01011260
test eax, eax
jne 0x1010350
jmp 0x1010706
mov eax, dword [0x010679e8]
and eax, 0x20
cmp eax, 0x20
jne 0x1010374
cmp dword [0x010679c0], 0
jne 0x1010374
mov dword [rsp + 0x6f4], 0
jmp 0x101037f
mov dword [rsp + 0x6f4], 1
mov eax, dword [rsp + 0x6f4]
mov dword [0x010679c8], eax
movzx eax, word [rsp + 0x460]
test eax, eax
je 0x10103aa
lea rax, [rsp + 0x460]
mov qword [rsp + 0x6f8], rax
jmp 0x10103b6
mov qword [rsp + 0x6f8], 0
movzx eax, word [rsp + 0x5e0]
test eax, eax
je 0x10103d4
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x700], rax
jmp 0x10103e0
mov qword [rsp + 0x700], 0
mov r8, qword [rsp + 0x6f8]
mov rdx, qword [rsp + 0x700]
lea rcx, [0x01065e00]
call fcn.01036b60
mov eax, dword [0x010679e8]
and eax, 1
test eax, eax
jne 0x1010416
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov dword [rsp + 0x598], eax
xor edx, edx
mov ecx, 0x3ff
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [rsp + 0x598], eax
mov r8d, 0x104
lea rdx, [0x010679f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov word [0x01067bf6], 0
lea rcx, [0x010679f0]
call fcn.01035d50
mov r8d, 0xa
mov edx, 0xeb0
lea rcx, [0x01065dc8]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x148
lea rcx, [0x01065d98]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x28
lea rcx, [0x01065d68]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x1020
lea rcx, [0x01065d38]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 8
mov edx, 0x588
lea rcx, [0x01065d08]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x20
lea rcx, [0x01065cd8]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x40
lea rcx, [0x01065ca8]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 5
mov edx, gethostbyname
lea rcx, [0x01065c78]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x104
lea rcx, [0x01065c48]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov r8d, 0xa
mov edx, 0x8b0
lea rcx, [0x01065c18]
call qword [sym.imp.SQLSVC.dll_SHRecMemInit]
mov eax, dword [0x010679e8]
and eax, 1
test eax, eax
jne 0x1010682
lea rcx, str.MSSQLSERVER
call sub.instapi10.dll_IsDefaultInstanceName
test eax, eax
je 0x1010576
lea rax, [0x01001c18]
mov qword [rsp + 0x578], rax
jmp 0x10105b0
mov dword [rsp + 0x6f0], 0x84
lea r9, [rsp + 0x6f0]
lea r8, [0x01067e30]
mov edx, 1
lea rcx, str.MSSQLSERVER
call sub.instapi10.dll_GetSQLServiceByName
lea rax, [0x01067e30]
mov qword [rsp + 0x578], rax
lea rcx, [rsp + 0x578]
call fcn.0103dda0
test eax, eax
je 0x10105db
mov dword [rsp + 0x5a0], 1
mov dword [0x01064108], 0
jmp 0x101067d
cmp dword [rsp + 0x720], 1
jne 0x1010616
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, SQLFreeStmt
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [0x01001c18]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wprintf]
jmp 0x101067d
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, reloc.ODBC32.dll_SQLFreeStmt
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
mov edx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR80.dll_wprintf]
call qword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
mov r9d, 2
mov r8d, 0xc0000064
mov edx, 1
mov ecx, 1
call fcn.01033610
jmp 0x1010706
call fcn.01011890
test eax, eax
jne 0x101068f
jmp 0x1010706
lea r9, [0x01001c18]
mov r8d, 0x5e
xor edx, edx
mov ecx, 4
call fcn.01033fa0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov edx, 1
lea rcx, [0x01013790]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.01012030
test eax, eax
je 0x1010706
call fcn.01013240
test eax, eax
je 0x1010706
mov edx, 0xffffffff
mov rcx, qword [0x01067930]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.01018e20
mov ecx, SQLFreeStmt
call fcn.0102f250
mov dword [0x01064108], 0
call fcn.01010ef0
cmp dword [rsp + 0x5a0], 0
jne 0x1010715
call fcn.01010f80
call qword [sym.imp.SQLSVC.dll_SQLSvcExit]
mov r9d, 0x200
lea r8, [rsp + 0x60]
mov edx, 0xf2
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x01001c18]
mov r8d, 0x62
xor edx, edx
mov ecx, 4
call fcn.01033fa0
call fcn.01030f50
mov rcx, qword [0x010683a8]
call fcn.01015700
lea rcx, [0x01065bc8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065ba0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065b78]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065b50]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065b28]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065b00]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065ad8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065ab0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065a88]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065a60]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065a38]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x010659e8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065968]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x01065a10]
call qword [0x01068178]
test eax, eax
jne 0x1010859
cmp dword [0x010679c0], 0
je 0x101084c
cmp dword [0x01067484], 0
je 0x101084c
lea rdx, [0x01001bb0]
lea rcx, [0x01001b70]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01065a10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x010679c0], 0
je 0x101087f
cmp dword [0x01067484], 0
je 0x101087f
lea rdx, [0x01001bb0]
lea rcx, [0x01001b38]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01065a10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x010679c0], 0
je 0x10108b2
cmp dword [0x01067484], 0
je 0x10108b2
lea rdx, [0x01001bb0]
lea rcx, [0x01001b00]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01065a10]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [0x01068158]
call sub.SqlResourceLoader.dll_FreeResourceLibrary
cmp qword [rsp + 0x50], 0
je 0x10108de
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.010566e0
mov eax, dword [0x01064108]
mov rcx, qword [rsp + 0x708]
xor rcx, rsp
call fcn.010588f0
add rsp, 0x710
pop rdi
ret