Function at 0x14009f1c4
Capabilities:
Get hostname
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xa0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1401411c8]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov word [rbp - 0x61], r8w
movzx edi, dx
mov rbx, rcx
mov qword [rbp - 0x39], rcx
mov rsi, qword [rbp + 0x7f]
xor r15d, r15d
mov dword [rcx], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 1]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [rbx + 8], rax
lea r14d, [r15 + 7]
mov qword [rbp + 7], r14
mov qword [rbp - 1], r15
mov word [rbp - 0x11], r15w
lea r8d, [r15 + 3]
lea rdx, [0x14010b2a8]
lea rcx, [rbp - 0x11]
call fcn.140007004
nop
lea r8d, [r15 + 0x10]
lea rdx, str.._wdp._tcp.local
lea rcx, [rbp - 0x11]
call fcn.140008328
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x21], r15
mov word [rbp - 0x31], r15w
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.1400085a4
lea rcx, [rbx + 0x10]
mov qword [rcx + 0x18], r14
mov qword [rcx + 0x10], r15
mov word [rcx], r15w
lea rdx, [rbp - 0x31]
call fcn.1400085a4
nop
cmp qword [rbp - 0x19], 8
jb 0x14009f2a5
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
cmp qword [rbp + 7], 8
jb 0x14009f2b6
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov word [rbx + 0x230], di
lea r12, [rbx + 0x232]
xor eax, eax
mov qword [r12], rax
mov dword [r12 + 8], eax
lea rdi, [rbx + 0x240]
mov qword [rdi + 0x18], r14
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
lea r14, [rbx + 0x260]
mov qword [rbp - 0x51], r14
mov qword [r14], r15
mov qword [r14 + 8], r15
xor r8d, r8d
xor edx, edx
call fcn.140013cac
mov qword [r14], rax
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r15
mov qword [r14 + 0x20], r15
mov dword [r14 + 0x38], 0x3f800000
mov edx, 8
mov rcx, r14
call fcn.1400a00ac
nop
mov qword [rbx + 0x2a0], r15
mov qword [rbx + 0x2a8], r15
lea r13, [rbx + 0x2b0]
xor eax, eax
mov qword [r13], rax
mov qword [r13 + 8], rax
mov dword [r13 + 0x10], eax
mov qword [rbx + 0x2c8], r15
lea rcx, [rbx + 0x2d0]
xor edx, edx
lea r8d, [rax + 0x30]
call sub.msvcrt.dll_memset
xor eax, eax
mov qword [rbx + 0x300], rax
mov rcx, qword [rbp + 0x57]
cmp qword [rbx + 8], r15
je 0x14009f5b0
mov dword [rbp - 0x49], 0x100
lea r8, [rbp - 0x49]
lea rdx, [rbx + 0x30]
lea ecx, [rax + 1]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetComputerNameExW]
mov rcx, qword [rbp + 0x57]
test eax, eax
je 0x14009f5c2
lea r8, str..local
mov edx, 0x100
lea rcx, [rbx + 0x30]
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov rcx, qword [rbp + 0x57]
xor r15d, r15d
test eax, eax
jne 0x14009f5d4
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], r15
mov word [rbp - 0x31], r15w
mov dword [rbp - 0x51], r15d
mov dword [rbp - 0x59], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x51]
call qword [sym.imp.ntdll.dll_RtlConvertDeviceFamilyInfoToString]
cmp eax, 0xc0000023
je 0x14009f3ff
mov rcx, qword [rbp + 0x57]
test eax, eax
js 0x14009f5dd
mov edx, dword [rbp - 0x51]
shr rdx, 1
cmp rdx, qword [rdi + 0x10]
ja 0x14009f425
mov qword [rdi + 0x10], rdx
cmp qword [rdi + 0x18], 8
jb 0x14009f41b
mov rax, qword [rdi]
jmp 0x14009f41e
mov rax, rdi
mov word [rax + rdx*2], r15w
jmp 0x14009f434
xor r8d, r8d
sub rdx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14001fbec
mov edx, dword [rbp - 0x59]
shr rdx, 1
cmp rdx, qword [rbp - 0x21]
ja 0x14009f459
mov qword [rbp - 0x21], rdx
lea rax, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rax, qword [rbp - 0x31]
mov word [rax + rdx*2], r15w
jmp 0x14009f469
xor r8d, r8d
sub rdx, qword [rbp - 0x21]
lea rcx, [rbp - 0x31]
call fcn.14001fbec
lea r9, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae r9, qword [rbp - 0x31]
cmp qword [rdi + 0x18], 8
jb 0x14009f481
mov rdi, qword [rdi]
mov r8, rdi
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x51]
call qword [sym.imp.ntdll.dll_RtlConvertDeviceFamilyInfoToString]
mov rcx, qword [rbp + 0x57]
test eax, eax
js 0x14009f5eb
cmp qword [rbp - 0x19], 8
jb 0x14009f4af
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rcx, qword [rbx + 0x250]
call fcn.1400a0cf4
mov rax, qword [rbx + 0x250]
add rax, 3
add qword [rbx + 0x2a8], rax
mov rdi, qword [rbp + 0x57]
mov r8d, 0xa
mov rdx, r13
lea rcx, [0x14010ae30]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14009f59b
test rsi, rsi
je 0x14009f50a
cmp qword [rsi + 8], r15
jbe 0x14009f50a
cmp r14, rsi
je 0x14009f50a
mov rdx, rsi
mov rcx, r14
call fcn.1400a0140
add qword [rbx + 0x2a8], 3
movzx ecx, word [rbp - 0x61]
mov r9d, 0xa
lea r8d, [r9 - 4]
mov rdx, r12
call qword [sym.imp.msvcrt.dll__ltow_s]
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], r15w
jne 0x14009f52d
add rax, 3
add qword [rbx + 0x2a8], rax
lea rax, [0x14009fce0]
mov qword [rbx + 0x2e0], rax
mov dword [rbx + 0x2d0], 1
mov dword [rbx + 0x2f8], r15d
mov qword [rbx + 0x2e8], rbx
mov rcx, rbx
call fcn.14009f880
nop
mov rax, rbx
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1400c20a0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, str.onecoreuap_adminwebbdiscoverywdpserviceregistration.cpp
mov edx, 0x39
mov rcx, rdi
call fcn.1400294b0
int3
lea r8, str.onecoreuap_adminwebbdiscoverywdpserviceregistration.cpp
mov edx, 0x2b
call fcn.1400294b0
int3
lea r8, str.onecoreuap_adminwebbdiscoverywdpserviceregistration.cpp
mov edx, 0x2f
call fcn.1400294b0
int3
mov r9d, eax
call fcn.1400a0d34
nop
mov r9d, eax
mov edx, 0x16
call fcn.1400a0ddc
int3
mov r9d, eax
mov edx, 0x22
call fcn.1400a0ddc
int3