Function at 0x401190
Capabilities:
Get hostname
Get user security identifier

Disassembly:
sub esp, 0x48
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x54]
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4011e7
lea ecx, [esp + 8]
mov edx, ecx
push edx
mov dword [esp + 0x14], ecx
call fcn.00401000
add esp, 4
test eax, eax
je 0x4011e7
mov eax, 1
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00414aec
add esp, 0x48
ret
push ebx
push ebp
push esi
push 2
push edi
push 0x421548
call fcn.00414a46
add esp, 0xc
test eax, eax
je 0x401248
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401203
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push 0
mov dword [esp + 0x2c], eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebp
mov esi, eax
test esi, esi
je 0x40129b
mov edx, dword [esp + 0x24]
push edx
push edi
push esi
call fcn.00414570
add esp, 0xc
jmp 0x401305
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x2c], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401265
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
sub eax, edx
sar eax, 1
add ecx, eax
lea edx, [ecx + ecx]
push edx
push 0
mov dword [esp + 0x2c], ecx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x4012e7
push str.username_sid
push str.expanded
push 0xc00001fa
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
lea eax, [esp + 0x24]
add esp, 0x10
cmp dword [esp + 0x1c], eax
jne 0x4012cf
mov ecx, dword [esp + 0x14]
push ecx
call sub.ADVAPI32.dll_LsaClose
pop esi
pop ebp
pop ebx
mov eax, 2
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00414aec
add esp, 0x48
ret
mov eax, dword [esp + 0x24]
add edi, 4
push edi
lea edx, [esp + 0x38]
push edx
push 0x4213dc
push 0xffffffffffffffff
push eax
push esi
call fcn.0041454f
add esp, 0x18
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
push esi
call fcn.004142b0
add esp, 0xc
push esi
push 0
mov edi, eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x401376
lea eax, [esp + 0x14]
cmp dword [esp + 0x1c], eax
jne 0x40133e
mov ecx, dword [esp + 0x14]
push ecx
call sub.ADVAPI32.dll_LsaClose
push str.username_sid__
push str.LSA_UNICODE_STRING
push 0xc00001fa
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 0x10
pop esi
pop ebp
pop ebx
mov eax, 4
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00414aec
add esp, 0x48
ret
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
lea eax, [edx + edx]
mov word [esp + 0x2c], ax
mov ecx, dword [esp + 0x2c]
add ecx, 2
lea edx, [esp + 0x10]
push edx
mov edx, dword [edi]
lea eax, [esp + 0x1c]
push eax
mov word [esp + 0x36], cx
lea ecx, [esp + 0x34]
push ecx
push 1
push edx
call sub.ADVAPI32.dll_LsaLookupNames
mov esi, eax
mov eax, dword [esp + 0x30]
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x14]
cmp edi, ecx
jne 0x4013cf
mov edx, dword [esp + 0x14]
push edx
call sub.ADVAPI32.dll_LsaClose
test esi, esi
je 0x40142a
mov eax, dword [esp + 0x18]
push eax
call sub.ADVAPI32.dll_LsaFreeMemory
mov ecx, dword [esp + 0x10]
push ecx
call sub.ADVAPI32.dll_LsaFreeMemory
push esi
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
call fcn.004020f0
mov edx, dword [esp + 0x24]
add esp, 4
push eax
push edx
push 0x40000207
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 0x10
pop esi
pop ebp
pop ebx
mov eax, 5
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00414aec
add esp, 0x48
ret
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
cmp eax, 1
je 0x40148d
cmp eax, 5
je 0x40148d
cmp eax, 8
jne 0x401457
mov ecx, dword [esp + 0x20]
push 0xb
push ecx
push str.NT_Service_
call fcn.00414a46
add esp, 0xc
test eax, eax
je 0x40148d
mov edx, dword [esp + 0x18]
push edx
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, dword [esp + 0x10]
push eax
call sub.ADVAPI32.dll_LsaFreeMemory
mov ecx, dword [esp + 0x20]
push ecx
push 0x40000232
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
mov eax, 6
jmp 0x40169b
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 8]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 4]
lea eax, [eax + eax*2]
lea esi, [edx + eax*4]
mov dword [esp + 0x1c], esi
test esi, esi
je 0x40166a
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x40166a
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov edi, eax
mov dl, byte [edi]
inc dl
movzx eax, dl
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
push eax
push 8
call ebx
push eax
call ebp
mov ebp, dword [esp + 0x28]
mov dword [ebp], eax
test eax, eax
jne 0x401538
mov ecx, dword [esp + 0x18]
push ecx
call sub.ADVAPI32.dll_LsaFreeMemory
mov edx, dword [esp + 0x10]
push edx
call sub.ADVAPI32.dll_LsaFreeMemory
push str.username_sid
push 0x4214b0
push 0xc00001fa
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 0x10
pop esi
pop ebp
pop ebx
mov eax, 8
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00414aec
add esp, 0x48
ret
mov al, byte [edi]
mov edx, dword [esi + 8]
inc al
movzx ecx, al
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
push eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSid]
test eax, eax
jne 0x4015c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp]
push ecx
push 0
mov esi, eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x18]
push edx
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, dword [esp + 0x10]
push eax
call sub.ADVAPI32.dll_LsaFreeMemory
push esi
call fcn.004020f0
mov ecx, dword [esp + 0x24]
add esp, 4
push eax
push ecx
push 0x40000208
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 0x10
pop esi
pop ebp
pop ebx
mov eax, 9
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00414aec
add esp, 0x48
ret
xor bl, bl
jmp 0x4015c9
mov ebp, dword [esp + 0x28]
mov edx, dword [ebp]
movzx esi, bl
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebp, eax
cmp bl, byte [edi]
jae 0x4015f3
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov edx, dword [eax]
mov dword [ebp], edx
jmp 0x4015fd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp], ecx
inc bl
cmp bl, byte [edi]
jbe 0x4015c5
mov edx, dword [esp + 0x10]
xor esi, esi
cmp dword [edx], 5
jne 0x401641
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push ecx
call fcn.00401140
add esp, 4
test eax, eax
jne 0x401641
mov edx, dword [esp + 0x20]
push edx
push 0x40000232
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 0xc
mov esi, 0xa
mov eax, dword [esp + 0x18]
push eax
call sub.ADVAPI32.dll_LsaFreeMemory
mov ecx, dword [esp + 0x10]
push ecx
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00414aec
add esp, 0x48
ret
mov edx, dword [esp + 0x18]
push edx
call sub.ADVAPI32.dll_LsaFreeMemory
mov eax, dword [esp + 0x10]
push eax
call sub.ADVAPI32.dll_LsaFreeMemory
mov ecx, dword [esp + 0x20]
push ecx
push 0x40000232
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
mov eax, 7
mov ecx, dword [esp + 0x60]
add esp, 0xc
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.00414aec
add esp, 0x48
ret