Function at 0x1400646c0
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x298
movaps xmmword [rsp + 0x280], xmm6
mov rsi, rcx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x278], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], r15
movaps xmm6, xmmword [section..rdata]
movups xmmword [rcx], xmm6
test byte [rdx], 1
jne 0x14006471d
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
jmp 0x14006472d
mov r8, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov rcx, rsi
call fcn.140025c20
test byte [rsi], 1
jne 0x14006473c
mov rcx, rsi
call fcn.140001c9e
jmp 0x140064740
mov rax, qword [rsi + 8]
test rax, rax
je 0x140064d6d
test byte [rsi], 1
jne 0x140064758
mov rcx, rsi
call fcn.140001c9e
jmp 0x14006475c
mov rax, qword [rsi + 8]
cmp rax, 2
jb 0x140064800
mov rcx, rsi
call fcn.140065196
cmp word [rax], 0x22
jne 0x140064782
mov rcx, rsi
call fcn.140012aa6
cmp word [rax], 0x22
je 0x14006479e
mov rcx, rsi
call fcn.140065196
cmp word [rax], 0x27
jne 0x140064800
mov rcx, rsi
call fcn.140012aa6
cmp word [rax], 0x27
jne 0x140064800
test byte [rsi], 1
jne 0x1400647ad
mov rcx, rsi
call fcn.140001c9e
jmp 0x1400647b1
mov rax, qword [rsi + 8]
test rax, rax
je 0x14006513c
test byte [rsi], 1
jne 0x1400647d5
mov rcx, rsi
call fcn.140001c9e
mov rbx, rax
test byte [rsi], 1
jne 0x1400647d9
lea rdi, [rsi + 2]
jmp 0x1400647dd
mov rbx, qword [rsi + 8]
mov rdi, qword [rsi + 0x10]
lea rdx, [rbx - 1]
mov rcx, rsi
call fcn.140001c52
mov word [rdi + rbx*2 - 2], 0
mov r8d, 1
mov rcx, rsi
xor edx, edx
call fcn.1400287b4
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
mov qword [rsp + 0x38], r15
test rax, rax
je 0x14006482f
lea rdx, [0x1400e47b2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
lea rax, [rsi + 2]
mov qword [rsp + 0x28], rax
xor r12d, r12d
lea r14, str._windows
mov qword [rsp + 0x30], r15
mov rdi, r12
shl rdi, 4
mov rbp, qword [rdi + r14]
test rbp, rbp
je 0x140065110
mov rcx, rbp
call fcn.1400c47c0
mov rbx, rax
test byte [rsi], 1
jne 0x140064884
mov rcx, rsi
call fcn.140001c9e
test byte [rsi], 1
mov rcx, qword [rsp + 0x28]
jne 0x140064888
jmp 0x14006488c
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
test rbx, rbx
je 0x14006492f
cmp rax, rbx
jl 0x140064a87
lea rdx, [rcx + rax*2]
movzx r8d, word [rbp]
lea r9, [rcx + rax*2]
add r9, 0xfffffffffffffffe
mov r10, rcx
mov r11, rax
sub r11, rbx
inc r11
je 0x140064a87
inc rax
xor r11d, r11d
cmp word [r10 + r11], r8w
je 0x1400648df
add r11, 2
dec rax
cmp rbx, rax
jne 0x1400648c7
jmp 0x140064a87
mov r13, r10
add r13, r11
je 0x140064a87
xor eax, eax
movzx r15d, word [r13 + rax*2]
cmp r15w, word [rbp + rax*2]
jne 0x140064908
inc rax
cmp rbx, rax
jne 0x1400648ed
jmp 0x1400649cb
mov rax, r9
sub rax, r10
add r10, r11
add r10, 2
sub rax, r11
sar rax, 1
cmp rax, rbx
movabs r15, 0xaaaaaaaaaaaaaaaa
jge 0x1400648b2
jmp 0x140064a87
xor r13d, r13d
mov rcx, rbp
call fcn.1400c47c0
mov rbp, rax
mov r8d, 0x208
lea rbx, [rsp + 0x70]
mov rcx, rbx
mov dl, 0xaa
call fcn.1400a8280
mov r8d, dword [rdi + r14 + 8]
xor ecx, ecx
mov rdx, rbx
xor r9d, r9d
mov rax, qword [rsp + 0x38]
call qword [0x140117008]
test eax, eax
jne 0x140064975
mov word [rsp + 0x70], 0
mov qword [rsp + 0x60], r15
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.140001888
movzx eax, byte [rsp + 0x50]
test al, 1
je 0x14006499c
mov rax, qword [rsp + 0x58]
jmp 0x14006499f
shr rax, 1
test rax, rax
je 0x140064a63
lea rcx, [rsp + 0x50]
call fcn.140012aa6
cmp word [rax], 0x5c
jne 0x140064a63
test byte [rsi], 1
jne 0x1400649f6
mov rcx, rsi
call fcn.140001c9e
jmp 0x1400649fa
cmp r13, rdx
movabs r15, 0xaaaaaaaaaaaaaaaa
je 0x140064a87
sub r13, rcx
mov rax, r13
add rax, 2
je 0x140064a87
sar r13, 1
jmp 0x140064932
mov rax, qword [rsi + 8]
mov rdx, rbp
add rdx, r13
cmp rax, rdx
jbe 0x140064a63
mov rcx, rsi
call fcn.140012a16
cmp word [rax], 0x5c
jne 0x140064a63
movzx eax, byte [rsp + 0x50]
test al, 1
jne 0x140064a42
cmp al, 2
jb 0x14006513c
shr rax, 1
dec rax
cmp rax, 0xb
jae 0x140065168
lea ecx, [rax + rax]
mov byte [rsp + 0x50], cl
lea rcx, [rsp + 0x52]
jmp 0x140064a5d
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14006513c
mov rcx, qword [rsp + 0x60]
dec rax
mov qword [rsp + 0x58], rax
mov word [rcx + rax*2], 0
mov rcx, rsi
mov rdx, r13
mov r8, rbp
lea r9, [rsp + 0x50]
call fcn.1400651fc
test byte [rsp + 0x50], 1
je 0x140064a87
mov rcx, qword [rsp + 0x60]
call fcn.1400a4d04
inc r12
cmp r12, 7
jne 0x14006484c
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x140064abc
lea rdx, [0x1400e4862]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov cl, byte [rsi]
test cl, 1
jne 0x140064ad9
mov rcx, rsi
call fcn.140001c9e
mov cl, byte [rsi]
mov rdx, qword [rsp + 0x28]
test cl, 1
jne 0x140064add
jmp 0x140064ae1
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
cmp rax, 0xc
jge 0x140064b04
test cl, 1
jne 0x140064b7a
mov rcx, rsi
call fcn.140001c9e
test byte [rsi], 1
mov rcx, qword [rsp + 0x28]
jne 0x140064b7e
jmp 0x140064b82
lea r8, [rdx + rax*2]
lea r9, [rdx + rax*2]
add r9, 0xfffffffffffffffe
lea r10, str._user_name
mov r11, rdx
add rax, 0xfffffffffffffff5
je 0x140064ae7
xor edi, edi
cmp word [r11 + rdi], 0x24
je 0x140064b35
add rdi, 2
dec rax
jne 0x140064b22
jmp 0x140064ae7
mov rbx, r11
add rbx, rdi
je 0x140064ae7
xor eax, eax
movzx ebp, word [rbx + rax]
cmp bp, word [rax + r10]
jne 0x140064b59
add rax, 2
cmp rax, 0x18
jne 0x140064b3f
jmp 0x140064e21
mov rbx, r9
sub rbx, r11
add r11, rdi
add r11, 2
sub rbx, rdi
mov rax, rbx
shr rax, 1
cmp rbx, 0x18
jge 0x140064b1a
jmp 0x140064ae7
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rax, 0xf
jge 0x140064bb9
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x140064c30
lea rdx, [0x1400e48d2]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
jmp 0x140064c3a
lea rdx, [rcx + rax*2]
lea r8, [rcx + rax*2]
add r8, 0xfffffffffffffffe
lea r9, str._machine_name
mov r10, rcx
add rax, 0xfffffffffffffff2
je 0x140064b88
xor r11d, r11d
cmp word [r10 + r11], 0x24
je 0x140064beb
add r11, 2
dec rax
jne 0x140064bd8
jmp 0x140064b88
mov rbx, r10
add rbx, r11
je 0x140064b88
xor eax, eax
movzx edi, word [rbx + rax]
cmp di, word [rax + r9]
jne 0x140064c0f
add rax, 2
cmp rax, 0x1e
jne 0x140064bf5
jmp 0x140064eda
mov rdi, r8
sub rdi, r10
add r10, r11
add r10, 2
sub rdi, r11
mov rax, rdi
shr rax, 1
cmp rdi, 0x1e
jge 0x140064bcf
jmp 0x140064b88
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x140064c64
lea rdx, [0x1400e490a]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
mov cl, byte [rsi]
test cl, 1
jne 0x140064c81
mov rcx, rsi
call fcn.140001c9e
mov cl, byte [rsi]
mov rdx, qword [rsp + 0x28]
test cl, 1
jne 0x140064c85
jmp 0x140064c89
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
cmp rax, 0xe
jge 0x140064caa
test cl, 1
jne 0x140064d20
mov rcx, rsi
call fcn.140001c9e
test byte [rsi], 1
jne 0x140064d24
jmp 0x140064d2d
lea r8, [rdx + rax*2]
lea r9, [rdx + rax*2]
add r9, 0xfffffffffffffffe
lea r10, str._client_name
mov r11, rdx
add rax, 0xfffffffffffffff3
je 0x140064c8f
xor edi, edi
cmp word [r11 + rdi], 0x24
je 0x140064cdb
add rdi, 2
dec rax
jne 0x140064cc8
jmp 0x140064c8f
mov rbx, r11
add rbx, rdi
je 0x140064c8f
xor eax, eax
movzx ebp, word [rbx + rax]
cmp bp, word [rax + r10]
jne 0x140064cff
add rax, 2
cmp rax, 0x1c
jne 0x140064ce5
jmp 0x140064f9e
mov rbx, r9
sub rbx, r11
add r11, rdi
add r11, 2
sub rbx, rdi
mov rax, rbx
shr rax, 1
cmp rbx, 0x1c
jge 0x140064cc0
jmp 0x140064c8f
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x28], rcx
cmp rax, 0xf
jge 0x140064d9c
test r12, r12
je 0x140064d41
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x140064d4f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x140064d5d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140064d6d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1400a5060
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x280]
add rsp, 0x298
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r9, qword [rsp + 0x28]
lea rcx, [r9 + rax*2]
lea rdx, [r9 + rax*2]
add rdx, 0xfffffffffffffffe
lea r8, str._session_name
add rax, 0xfffffffffffffff2
je 0x140064d33
xor r10d, r10d
cmp word [r9 + r10], 0x24
je 0x140064dd7
add r10, 2
dec rax
jne 0x140064dc1
jmp 0x140064d33
mov rbx, r9
add rbx, r10
je 0x140064d33
xor eax, eax
movzx r11d, word [rbx + rax]
cmp r11w, word [rax + r8]
jne 0x140064e00
add rax, 2
cmp rax, 0x1e
jne 0x140064de5
jmp 0x140065052
mov r11, rdx
sub r11, r9
add r9, r10
add r9, 2
sub r11, r10
mov rax, r11
shr rax, 1
cmp r11, 0x1e
jge 0x140064db4
jmp 0x140064d33
cmp rbx, r8
je 0x140064ae7
sub rbx, rdx
mov rax, rbx
add rax, 2
je 0x140064ae7
lea r12, [rsp + 0x50]
mov dword [r12], 0
xor ecx, ecx
mov rdx, r12
mov rax, r15
call qword [0x140117008]
mov ecx, dword [r12]
test rcx, rcx
je 0x140064ed3
sar rbx, 1
add rcx, rcx
call fcn.1400a4d3c
mov r12, rax
lea rdx, [rsp + 0x50]
mov rcx, rax
mov rax, r15
call qword [0x140117008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x70]
mov qword [r15 + 0x10], rax
movaps xmmword [r15], xmm6
mov rcx, r15
mov rdx, r12
call fcn.140001888
mov r8d, 0xc
mov rcx, rsi
mov rdx, rbx
mov r9, r15
call fcn.1400651fc
test byte [r15], 1
je 0x140064ec6
mov rcx, qword [rsp + 0x80]
call fcn.1400a4d04
test r12, r12
je 0x140064ed3
mov rcx, r12
call fcn.1400a4d44
mov cl, byte [rsi]
jmp 0x140064ae7
cmp rbx, rdx
je 0x140064b88
sub rbx, rcx
mov rax, rbx
add rax, 2
je 0x140064b88
lea r15, [rsp + 0x50]
mov dword [r15], 0
mov ecx, 5
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [r15]
test rcx, rcx
je 0x140064b88
sar rbx, 1
add rcx, rcx
call fcn.1400a4d3c
mov r15, rax
lea r8, [rsp + 0x50]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x70]
mov qword [r12 + 0x10], rax
movaps xmmword [r12], xmm6
mov rcx, r12
mov rdx, r15
call fcn.140001888
mov r8d, 0xf
mov rcx, rsi
mov rdx, rbx
mov r9, r12
call fcn.1400651fc
test byte [r12], 1
je 0x140064f88
mov rcx, qword [rsp + 0x80]
call fcn.1400a4d04
test r15, r15
je 0x140064b88
mov rcx, r15
call fcn.1400a4d44
jmp 0x140064b88
cmp rbx, r8
je 0x140064c8f
sub rbx, rdx
mov rax, rbx
add rax, 2
je 0x140064c8f
lea r9, [rsp + 0x50]
mov qword [r9], 0
lea rax, [rsp + 0x4c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
mov rax, r13
call qword [0x140117008]
test eax, eax
je 0x14006504b
sar rbx, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x10], rax
movaps xmmword [rbp], xmm6
mov rdx, qword [rsp + 0x50]
mov rcx, rbp
call fcn.140001888
mov r8d, 0xe
mov rcx, rsi
mov rdx, rbx
mov r9, rbp
call fcn.1400651fc
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140117008]
test byte [rbp], 1
je 0x14006504b
mov rcx, qword [rsp + 0x80]
call fcn.1400a4d04
mov cl, byte [rsi]
jmp 0x140064c8f
cmp rbx, rcx
je 0x140064d33
sub rbx, qword [rsp + 0x28]
mov rax, rbx
add rax, 2
je 0x140064d33
lea r9, [rsp + 0x50]
mov qword [r9], 0
lea rax, [rsp + 0x4c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
mov rax, r13
call qword [0x140117008]
test eax, eax
je 0x140064d33
sar rbx, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x70]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.140001888
mov r8d, 0xf
mov rcx, rsi
mov rdx, rbx
mov r9, r13
call fcn.1400651fc
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140117008]
test byte [r13], 1
je 0x140064d33
mov rcx, qword [rsp + 0x80]
call fcn.1400a4d04
jmp 0x140064d33
lea rax, str.string::find__:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str.__s___nullptr
mov r8d, 0xd00
call fcn.140005584
lea rax, [0x1400da670]
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str._empty__
mov r8d, 0xc07
call fcn.140005584
lea rax, str.__s_should_never_be_greater_than_or_equal_to_the_short_string_capacity
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str.__s_____min_cap
mov r8d, 0x6c6
call fcn.140005584
int3