Function at 0x100d610
Capabilities:
Get hostname
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x690
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x10015d8]
mov dword [ebp - 0x550], eax
mov ecx, dword [0x10015dc]
mov dword [ebp - 0x54c], ecx
mov dx, word [0x10015e0]
mov word [ebp - 0x548], dx
mov ax, word [0x10015d4]
mov word [ebp - 0x410], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x40e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0x688], dx
push 0x106
push 0
lea eax, [ebp - 0x686]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov cx, word [0x10015d4]
mov word [ebp - 0x518], cx
push 0x106
push 0
lea edx, [ebp - 0x516]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x53c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x520], 0
mov dword [ebp - 0x57c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x534], 0x10015b4
mov dword [ebp - 0x530], 0x10316a0
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x544], 0
call fcn.01047b30
test eax, eax
jne 0x100d74b
xor eax, eax
jmp 0x100de59
push 0x1d10
push 0
push 0x104ca50
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [0x104e7a8], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x104ef30], eax
mov eax, dword [0x104ef30]
push eax
call sub.SqlResourceLoader.dll__LoadResourceLibrary_4
mov dword [0x104ef34], eax
cmp dword [0x104ef34], 0
jne 0x100d796
xor eax, eax
jmp 0x100de59
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x540], eax
push 0
push 0
push 0
push 2
push 2
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x540], eax
push fcn.01045c20
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [ebp - 0x520], 0x10
lea ecx, [ebp - 0x520]
push ecx
push 0x104e9e8
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [0x104e7a8], 0
push 0x200
lea edx, [ebp - 0x410]
push edx
push 0x12
mov eax, dword [0x104ef34]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x1001598
push 0x10015b4
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 0xc
push 0x104c8f4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c8dc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c8c4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c8ac
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c894
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c87c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c864
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c84c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c834
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c81c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c804
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c7ec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c7d4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c7bc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104c7a4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea edx, [ebp - 0x578]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x564]
mov dword [0x104e7d8], eax
push 1
push 0x104c6d0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x100d94c
push 0
push 0
push 1
push 0x104c6d0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x100d940
mov dword [0x104c6e4], 0xc
mov dword [0x104c6e8], 0x104c6d0
mov dword [0x104c6ec], 0
mov dword [0x104c6f0], 0x104c6e4
jmp 0x100d94a
jmp 0x100dd40
jmp 0x100d956
jmp 0x100dd40
call dword [sym.imp.SQLSVC90.dll_SQLSvcInit]
test eax, eax
jne 0x100d96a
jmp 0x100dd40
push 0
push 0x100157c
push 3
call fcn.0100de70
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100d9ab
push 0x1001564
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104ef44], eax
cmp dword [0x104ef44], 0
jne 0x100d9ab
jmp 0x100dd40
push 1
call fcn.01011690
add esp, 4
mov dword [0x104f16c], eax
cmp dword [0x104f168], 2
jne 0x100da05
cmp dword [0x104f16c], 0
jne 0x100da05
push 0x200
lea edx, [ebp - 0x410]
push edx
push 0x78
mov eax, dword [0x104ef34]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea ecx, [ebp - 0x410]
push ecx
push 0x100155c
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
jmp 0x100dd40
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x688]
push eax
push 0x104e7d4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0100e4b0
add esp, 0x14
test eax, eax
jne 0x100da36
jmp 0x100dd40
mov eax, dword [0x104e7d4]
and eax, 0x20
je 0x100da55
cmp dword [0x104e7a8], 0
jne 0x100da55
mov dword [ebp - 0x690], 0
jmp 0x100da5f
mov dword [ebp - 0x690], 1
mov ecx, dword [ebp - 0x690]
mov dword [0x104e7b0], ecx
movzx edx, word [ebp - 0x518]
neg edx
sbb edx, edx
lea eax, [ebp - 0x518]
and edx, eax
push edx
movzx ecx, word [ebp - 0x688]
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x688]
and ecx, edx
push ecx
push 0x104ca50
call fcn.0102b420
add esp, 0xc
mov eax, dword [0x104e7d4]
and eax, 1
jne 0x100dab6
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov dword [ebp - 0x53c], eax
push 0
push 0x3ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [ebp - 0x53c], eax
push 0x104
push 0x104e7e0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov word [0x104e9e6], 0
push 0x104e7e0
call fcn.0102a780
add esp, 4
push 0xa
push 0xe94
push 0x104ca2c
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x148
push 0x104ca0c
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x28
push 0x104c9ec
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x1014
push 0x104c9cc
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
push 8
push 0x574
push 0x104c9ac
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x14
push 0x104c98c
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x24
push 0x104c96c
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
push 5
push 0x28
push 0x104c94c
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x104
push 0x104c92c
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x8a8
push 0x104c90c
call dword [sym.imp.SQLSVC90.dll_SHRecMemInit]
add esp, 0xc
mov ecx, dword [0x104e7d4]
and ecx, 1
jne 0x100dcca
push str.MSSQLSERVER
call sub.instapi.dll_IsDefaultInstanceName
test eax, eax
je 0x100dbe0
mov dword [ebp - 0x534], 0x10015b4
jmp 0x100dc0c
mov dword [ebp - 0x68c], 0x84
lea edx, [ebp - 0x68c]
push edx
push 0x104ec10
push 1
push str.MSSQLSERVER
call sub.instapi.dll_GetSQLServiceByName
mov dword [ebp - 0x534], 0x104ec10
lea eax, [ebp - 0x534]
push eax
call fcn.01031670
add esp, 4
test eax, eax
je 0x100dc38
mov dword [ebp - 0x544], 1
mov dword [0x104b110], 0
jmp 0x100dcc8
cmp dword [ebp + 8], 1
jne 0x100dc70
push 0x200
lea ecx, [ebp - 0x410]
push ecx
push 0xf
mov edx, dword [0x104ef34]
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10015b4
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
jmp 0x100dcc8
push 0x200
lea ecx, [ebp - 0x410]
push ecx
push 0x10
mov edx, dword [0x104ef34]
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
push eax
push 1
push 2
push 0xc0000064
push 1
push 1
call fcn.010287e0
add esp, 0x18
jmp 0x100dd40
call fcn.0100e9c0
test eax, eax
jne 0x100dcd7
jmp 0x100dd40
push 0x10015b4
push 0x5e
push 0
push 4
call fcn.01028fb0
add esp, 0x10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0x10103d0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.0100f070
test eax, eax
je 0x100dd40
call fcn.0100ff30
test eax, eax
je 0x100dd40
push 0xffffffffffffffff
mov ecx, dword [0x104e760]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.01014220
push 0xf
call fcn.01024da0
add esp, 4
mov dword [0x104b110], 0
call fcn.0100e180
cmp dword [ebp - 0x544], 0
jne 0x100dd4e
call fcn.0100e210
call dword [sym.imp.SQLSVC90.dll_SQLSvcExit]
push 0x200
lea edx, [ebp - 0x410]
push edx
push 0xf2
mov eax, dword [0x104ef34]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea ecx, [ebp - 0x410]
push ecx
push 0x10015b4
push 0x62
push 0
push 4
call fcn.01028fb0
add esp, 0x14
call fcn.01026730
mov edx, dword [0x104f16c]
push edx
call fcn.01011f00
add esp, 4
push 0x104c8dc
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c8c4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c8ac
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c894
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c87c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c864
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c84c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c834
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c81c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c804
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c7ec
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c7bc
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c7a4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x104c7d4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x104ef34]
push eax
call sub.SqlResourceLoader.dll__FreeResourceLibrary_4
cmp dword [ebp - 4], 0
je 0x100de54
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x104b110]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret