Function at 0x10000a0d0
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x100080258]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor esi, esi
mov rdi, rcx
movabs r14, 0x8001000000000001
mov dword [rsp + 0x20], esi
cmp dword [0x100081514], esi
je 0x10000a158
mov al, byte [0x100081518]
cmp al, 4
jb 0x10000ab49
test qword [0x100081500], r14
je 0x10000a158
mov rcx, qword [0x100081508]
mov rax, rcx
and rax, r14
cmp rax, rcx
jne 0x10000a158
mov rcx, qword [0x100081ad8]
lea rdx, [0x100076218]
call fcn.100009ce8
mov rax, qword [rdi + 8]
mov qword [0x1000802f8], rax
mov rax, qword [rdi]
mov qword [0x1000802a0], rax
call fcn.10000de38
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x198
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebp, 1
lea r13, [0x100076228]
lea r12, [0x100080250]
cmp eax, esi
jne 0x10000ab57
mov dword [0x100080230], ebp
call sym.spoolsv.exe_PrvSplIsUpgrade
mov r15d, 0x5c
lea rdx, [rsp + 0x24]
lea rcx, [0x100080aac]
mov word [0x100080aaa], r15w
mov word [0x100080aa8], r15w
mov dword [rsp + 0x24], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, esi
je 0x10000ab88
call fcn.10000d434
mov ecx, eax
call fcn.10000db30
cmp eax, esi
mov ebx, eax
jl 0x10000abdf
lea rdx, [0x100081b00]
lea rcx, [0x100081b08]
call sym.spoolsv.exe_PrvBuildOtherNamesFromMachineName
cmp eax, esi
je 0x10000ac38
mov rax, qword [0x100081b08]
mov word [0x100080bb0], r15w
mov word [0x100080bb2], r15w
mov r8, qword [rax + 8]
mov edx, 0x102
lea rcx, [0x100080bb4]
lea rax, [rdx + 0x7ffffefc]
cmp rax, rsi
je 0x10000a26f
movzx eax, word [r8]
cmp ax, si
je 0x10000a26f
mov word [rcx], ax
add r8, 2
add rcx, 2
sub rdx, rbp
jne 0x10000a24a
cmp rdx, rsi
je 0x10000ac77
mov word [rcx], si
call fcn.10000d770
cmp eax, esi
mov ebx, eax
jl 0x10000ac80
call fcn.10000d634
cmp eax, esi
mov ebx, eax
jl 0x10000acd9
call fcn.10000d33c
cmp eax, esi
jne 0x10000a2b3
mov ecx, ebp
call fcn.10000d8b4
cmp eax, esi
mov ebx, eax
jl 0x10000ad32
lea r8, [rsp + 0x20]
lea rcx, [0x100076280]
xor edx, edx
call fcn.100009b48
mov qword [0x1000802f0], rax
cmp rax, rsi
je 0x10000ad83
mov rcx, qword [rax + 0x10]
call fcn.10000ab24
cmp eax, esi
je 0x10000add0
call fcn.10000b414
mov rcx, qword [0x100081ae0]
call fcn.100009058
mov dword [0x10008022c], ebp
call fcn.10000b098
call fcn.10000c050
call fcn.10000ae70
call fcn.10000af80
call fcn.10000c490
call fcn.10000c53c
call fcn.10000c210
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [0x100081514], esi
je 0x10000a36d
mov al, byte [0x100081518]
cmp al, 4
jb 0x10000ae28
test qword [0x100081500], r14
je 0x10000a36d
mov rdx, qword [0x100081508]
mov rcx, rdx
and rcx, r14
cmp rcx, rdx
jne 0x10000a36d
mov rcx, qword [0x100081ad8]
lea rdx, [0x100075e88]
call fcn.100009ce8
call fcn.10000afd0
int3
cmp al, sil
je 0x10000a12a
jmp 0x10000a158
mov rcx, qword [0x100080250]
cmp rcx, r12
je 0x10000a1b5
test byte [rcx + 0x1c], bpl
je 0x10000a1b5
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 9]
mov r9d, eax
mov r8, r13
call fcn.10001c124
jmp 0x10000a1b5
mov rax, qword [0x100080250]
cmp rax, r12
je 0x10000abba
test byte [rax + 0x1c], bpl
je 0x10000abba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100080250]
lea edx, [r15 - 0x51]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c124
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000777c8]
xor r8d, r8d
mov edx, eax
call fcn.1000333b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x100080250]
cmp rcx, r12
je 0x10000ac05
test byte [rcx + 0x1c], bpl
je 0x10000ac05
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, eax
mov r8, r13
call fcn.10001c124
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100077808]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.1000333b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x100080250]
cmp rax, r12
je 0x10000ac6b
test byte [rax + 0x1c], bpl
je 0x10000ac6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100080250]
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c124
mov word [0x100080bb0], si
jmp 0x10000a27b
sub rcx, 2
jmp 0x10000a278
mov rcx, qword [0x100080250]
cmp rcx, r12
je 0x10000aca6
test byte [rcx + 0x1c], bpl
je 0x10000aca6
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r9d, eax
mov r8, r13
call fcn.10001c124
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x1000777e8]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.1000333b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x100080250]
cmp rcx, r12
je 0x10000acff
test byte [rcx + 0x1c], bpl
je 0x10000acff
mov rcx, qword [rcx + 0x10]
mov edx, 0xf
mov r9d, eax
mov r8, r13
call fcn.10001c124
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100077818]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.1000333b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x100080250]
cmp rcx, r12
je 0x10000ad58
test byte [rcx + 0x1c], bpl
je 0x10000ad58
mov rcx, qword [rcx + 0x10]
mov edx, 0x10
mov r9d, eax
mov r8, r13
call fcn.10001c124
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100077828]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.1000333b4
nop
jmp 0x10000a2b3
mov rcx, qword [0x100080250]
cmp rcx, r12
je 0x10000adab
test byte [rcx + 0x1c], bpl
je 0x10000adab
mov r9d, dword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
mov edx, 0x11
mov r8, r13
call fcn.10001c124
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000777d8]
xor r8d, r8d
mov edx, eax
call fcn.1000333b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x100080250]
cmp rax, r12
je 0x10000ae03
test byte [rax + 0x1c], bpl
je 0x10000ae03
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100080250]
mov edx, 0x12
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c124
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000777d8]
xor r8d, r8d
mov edx, eax
call fcn.1000333b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp al, sil
jne 0x10000a36d
jmp 0x10000a33f