Function at 0x1400f1ea0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x408], rax
mov r12, rdx
mov rbx, rcx
xor r13b, r13b
xor edx, edx
mov r8d, 0x308
lea rcx, [rbp + 0xd0]
call fcn.14035c350
lea rcx, [rbp + 0xd0]
call fcn.1401ce640
nop
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], r15b
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], r15b
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400f6ad0
mov rax, qword [rbp + 0x1d8]
lea rcx, [rbp + 0x1d8]
mov rax, qword [rax + 0x10]
call qword [case.0x1401cd220.0]
mov rdi, rax
lea rax, [rbp + 0xd0]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], r15
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov dword [rdi + 0x30], r15d
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x58], r15
lea rax, vtable.tinyxml2::XMLElement.0
mov qword [rdi], rax
mov dword [rdi + 0x68], r15d
mov qword [rdi + 0x70], r15
lea rax, [rbp + 0x1d8]
mov qword [rdi + 0x60], rax
mov rdx, rdi
lea rcx, [rbp + 0x178]
call fcn.1401d0af0
test dword [rdi + 0x18], 0x200
je 0x1400f1fc7
mov rcx, qword [rdi + 0x20]
call fcn.140359090
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov ecx, 7
call fcn.140359a1c
mov rcx, rax
mov qword [rdi + 0x20], rax
mov eax, dword [str.Report]
mov dword [rcx], eax
movzx eax, word [0x1405f7bd0]
mov word [rcx + 4], ax
movzx eax, byte [0x1405f7bd2]
mov byte [rcx + 6], al
mov rax, qword [rdi + 0x20]
add rax, 6
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], 0x200
mov r8, rbx
lea rdx, [0x1405f638c]
mov rcx, rdi
call fcn.1400f6e90
mov rsi, r15
mov rbx, qword [rdi + 0x70]
test rbx, rbx
je 0x1400f207a
lea r14, str.type
nop dword [rax]
lea rcx, [rbx + 8]
call fcn.1401cc190
cmp rax, r14
je 0x1400f20e8
mov r8d, 0x7fffffff
mov rdx, r14
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400f2075
mov rsi, rbx
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x1400f207a
jmp 0x1400f2040
test rbx, rbx
jne 0x1400f20e8
mov rcx, rdi
call fcn.1401ce2a0
mov rbx, rax
test rsi, rsi
je 0x1400f2090
mov qword [rsi + 0x40], rax
jmp 0x1400f2094
mov qword [rdi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400f20a6
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], r15d
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov ecx, 5
call fcn.140359a1c
mov rcx, rax
mov qword [rbx + 0x10], rax
mov eax, dword [str.type]
mov dword [rcx], eax
movzx eax, byte [0x1405f56bc]
mov byte [rcx + 4], al
mov rax, qword [rbx + 0x10]
add rax, 4
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
test dword [rbx + 0x20], 0x200
je 0x1400f20fa
mov rcx, qword [rbx + 0x28]
call fcn.140359090
mov dword [rbx + 0x20], r15d
mov qword [rbx + 0x28], r15
mov qword [rbx + 0x30], r15
mov ecx, 0xd
call fcn.140359a1c
mov rcx, rax
mov qword [rbx + 0x28], rax
movsd xmm0, qword [str.Installation]
movsd qword [rax], xmm0
mov eax, dword [0x1405f7bf0]
mov dword [rcx + 8], eax
movzx eax, byte [0x1405f7bf4]
mov byte [rcx + 0xc], al
mov rax, qword [rbx + 0x28]
add rax, 0xc
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x20], 0x200
lea rcx, [rbp + 0x3e0]
call fcn.14006b440
nop
cmp byte [rax + 0x20], 0
je 0x1400f217e
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
jmp 0x1400f21ab
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [0x1405e4ea8]
lea rcx, [rsp + 0x20]
call fcn.140073120
nop
lea r14, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae r14, qword [rsp + 0x20]
mov rsi, r15
mov rbx, qword [rdi + 0x70]
test rbx, rbx
je 0x1400f2204
lea rcx, [rbx + 8]
call fcn.1401cc190
lea rcx, [0x1405f6d8c]
cmp rax, rcx
je 0x1400f2268
mov r8d, 0x7fffffff
mov rdx, rcx
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400f21ff
mov rsi, rbx
mov rbx, qword [rbx + 0x40]
jmp 0x1400f21c3
test rbx, rbx
jne 0x1400f2268
mov rcx, rdi
call fcn.1401ce2a0
mov rbx, rax
test rsi, rsi
je 0x1400f221a
mov qword [rsi + 0x40], rax
jmp 0x1400f221e
mov qword [rdi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400f2230
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], r15d
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov ecx, 4
call fcn.140359a1c
mov rcx, rax
mov qword [rbx + 0x10], rax
mov eax, dword [0x1405f6d8c]
mov dword [rcx], eax
mov rax, qword [rbx + 0x10]
add rax, 3
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
lea rcx, [rbx + 0x20]
mov rdx, r14
call fcn.1401cc010
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400f22b3
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f22ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f2afe
call fcn.140359090
nop
cmp byte [rbp + 0x400], 0
je 0x1400f22c8
lea rcx, [rbp + 0x3e0]
call fcn.140073500
lea r14, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r14, qword [rsp + 0x48]
mov rsi, r15
mov rbx, qword [rdi + 0x70]
test rbx, rbx
je 0x1400f2321
lea rcx, [rbx + 8]
call fcn.1401cc190
lea rcx, [0x1405f7be0]
cmp rax, rcx
je 0x1400f2391
mov r8d, 0x7fffffff
mov rdx, rcx
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400f231c
mov rsi, rbx
mov rbx, qword [rbx + 0x40]
jmp 0x1400f22e0
test rbx, rbx
jne 0x1400f2391
mov rcx, rdi
call fcn.1401ce2a0
mov rbx, rax
test rsi, rsi
je 0x1400f2337
mov qword [rsi + 0x40], rax
jmp 0x1400f233b
mov qword [rdi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400f234d
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], r15d
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov ecx, 3
call fcn.140359a1c
mov rcx, rax
mov qword [rbx + 0x10], rax
movzx eax, word [0x1405f7be0]
mov word [rcx], ax
movzx eax, byte [0x1405f7be2]
mov byte [rcx + 2], al
mov rax, qword [rbx + 0x10]
add rax, 2
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
lea rcx, [rbx + 0x20]
mov rdx, r14
call fcn.1401cc010
call fcn.1401ecb40
mov r14, rax
mov rsi, r15
mov rbx, qword [rdi + 0x70]
test rbx, rbx
je 0x1400f23ed
lea rcx, [rbx + 8]
call fcn.1401cc190
lea rcx, [0x1405f6d88]
cmp rax, rcx
je 0x1400f2451
mov r8d, 0x7fffffff
mov rdx, rcx
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400f23e8
mov rsi, rbx
mov rbx, qword [rbx + 0x40]
jmp 0x1400f23ac
test rbx, rbx
jne 0x1400f2451
mov rcx, rdi
call fcn.1401ce2a0
mov rbx, rax
test rsi, rsi
je 0x1400f2403
mov qword [rsi + 0x40], rax
jmp 0x1400f2407
mov qword [rdi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400f2419
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], r15d
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov ecx, 4
call fcn.140359a1c
mov rcx, rax
mov qword [rbx + 0x10], rax
mov eax, dword [0x1405f6d88]
mov dword [rcx], eax
mov rax, qword [rbx + 0x10]
add rax, 3
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
lea rcx, [rbx + 0x20]
mov rdx, r14
call fcn.1401cc010
mov dword [rsp + 0x40], 0x10
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1400f2498
lea rdx, [rbp + 0x3e0]
lea rcx, [rsp + 0x20]
call fcn.140097490
mov r15, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
jmp 0x1400f24b4
mov qword [rsp + 0x20], r15
mov rax, r15
mov qword [rsp + 0x30], rax
mov r15d, 0xf
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x20], al
test rax, rax
je 0x1400f259a
lea r14, [rsp + 0x20]
cmp r15, 0x10
cmovae r14, qword [rsp + 0x20]
xor r15d, r15d
mov esi, r15d
mov rbx, qword [rdi + 0x70]
test rbx, rbx
je 0x1400f2517
lea rcx, [rbx + 8]
call fcn.1401cc190
lea rcx, str.computer
cmp rax, rcx
je 0x1400f2589
mov r8d, 0x7fffffff
mov rdx, rcx
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400f2512
mov rsi, rbx
mov rbx, qword [rbx + 0x40]
jmp 0x1400f24d6
test rbx, rbx
jne 0x1400f2589
mov rcx, rdi
call fcn.1401ce2a0
mov rbx, rax
test rsi, rsi
je 0x1400f252d
mov qword [rsi + 0x40], rax
jmp 0x1400f2531
mov qword [rdi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400f2543
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], r15d
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov ecx, 9
call fcn.140359a1c
mov rcx, rax
mov qword [rbx + 0x10], rax
movsd xmm0, qword [str.computer]
movsd qword [rax], xmm0
movzx eax, byte [0x1405f6da8]
mov byte [rcx + 8], al
mov rax, qword [rbx + 0x10]
add rax, 8
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
lea rcx, [rbx + 0x20]
mov rdx, r14
call fcn.1401cc010
mov r15, qword [rsp + 0x38]
call fcn.140109600
mov ecx, eax
sub ecx, 2
je 0x1400f25d9
sub ecx, 1
je 0x1400f25d0
sub ecx, 1
je 0x1400f25c7
cmp ecx, 1
je 0x1400f25be
lea r14, str.Full
jmp 0x1400f25e0
lea r14, str.SophosServer
jmp 0x1400f25e0
lea r14, str.SophosHome
jmp 0x1400f25e0
lea r14, str.Sophos
jmp 0x1400f25e0
lea r14, [0x1405f7c00]
xor esi, esi
mov rbx, qword [rdi + 0x70]
test rbx, rbx
je 0x1400f2627
lea rcx, [rbx + 8]
call fcn.1401cc190
lea rcx, str.mode
cmp rax, rcx
je 0x1400f2696
mov r8d, 0x7fffffff
mov rdx, rcx
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400f2622
mov rsi, rbx
mov rbx, qword [rbx + 0x40]
jmp 0x1400f25e6
test rbx, rbx
jne 0x1400f2696
mov rcx, rdi
call fcn.1401ce2a0
mov rbx, rax
test rsi, rsi
je 0x1400f263d
mov qword [rsi + 0x40], rax
jmp 0x1400f2641
mov qword [rdi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400f2653
mov rcx, qword [rax + 0x10]
call fcn.140359090
xor esi, esi
mov dword [rbx + 8], esi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
lea ecx, [rsi + 5]
call fcn.140359a1c
mov rcx, rax
mov qword [rbx + 0x10], rax
mov eax, dword [str.mode]
mov dword [rcx], eax
movzx eax, byte [0x1405f7c30]
mov byte [rcx + 4], al
mov rax, qword [rbx + 0x10]
add rax, 4
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
jmp 0x1400f2698
xor esi, esi
lea rcx, [rbx + 0x20]
mov rdx, r14
call fcn.1401cc010
mov r8, qword [rdi + 8]
cmp r8, qword [rbp + 0xd8]
jne 0x1400f27aa
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400f2710
mov rax, qword [rcx + 0x38]
cmp rdi, rax
jne 0x1400f26cf
mov rax, qword [rax + 0x50]
mov qword [rcx + 0x38], rax
mov rax, qword [rcx + 0x40]
cmp rdi, rax
jne 0x1400f26e0
mov rax, qword [rax + 0x48]
mov qword [rcx + 0x40], rax
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x1400f26f1
mov rax, qword [rdi + 0x50]
mov qword [rcx + 0x50], rax
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x1400f2702
mov rax, qword [rdi + 0x48]
mov qword [rcx + 0x48], rax
mov qword [rdi + 0x50], rsi
mov qword [rdi + 0x48], rsi
mov qword [rdi + 0x10], rsi
jmp 0x1400f2765
mov ecx, esi
mov rax, rsi
movsxd r9, dword [r8 + 0x104]
test r9, r9
jle 0x1400f2754
mov rdx, qword [r8 + 0xa8]
cmp rdi, qword [rdx + rax*8]
je 0x1400f273a
inc ecx
inc rax
cmp rax, r9
jl 0x1400f2728
jmp 0x1400f2754
movsxd rax, dword [r8 + 0x104]
movsxd rcx, ecx
mov rax, qword [rdx + rax*8 - 8]
mov qword [rdx + rcx*8], rax
dec dword [r8 + 0x104]
mov rcx, qword [rdi + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1401cd220.0]
mov rax, qword [rbp + 0x110]
test rax, rax
je 0x1400f2789
mov qword [rax + 0x50], rdi
mov rax, qword [rbp + 0x110]
mov qword [rdi + 0x48], rax
mov qword [rbp + 0x110], rdi
jmp 0x1400f279b
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x108], rdi
mov qword [rdi + 0x48], rsi
mov qword [rdi + 0x50], rsi
lea rax, [rbp + 0xd0]
mov qword [rdi + 0x10], rax
cmp r15, 0x10
jb 0x1400f27e3
lea rdx, [r15 + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f27de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f2b04
call fcn.140359090
xor edx, edx
mov r8d, 0x138
lea rcx, [rbp - 0x70]
call fcn.14035c350
lea rcx, [rbp - 0x70]
call fcn.1401ceda0
nop
mov rax, qword [rbp - 0x70]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x70]
mov rax, qword [rax + 0x10]
call qword [case.0x1401cd220.0]
test al, al
je 0x1400f2851
mov rbx, qword [rbp + 0x108]
test rbx, rbx
je 0x1400f2851
nop word [rax + rax]
mov rax, qword [rbx]
lea rdx, [rbp - 0x70]
mov rcx, rbx
mov rax, qword [rax + 0x70]
call qword [case.0x1401cd220.0]
test al, al
je 0x1400f2851
mov rbx, qword [rbx + 0x50]
test rbx, rbx
jne 0x1400f2830
mov rax, qword [rbp - 0x70]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x70]
mov rax, qword [rax + 0x20]
call qword [case.0x1401cd220.0]
test al, al
je 0x1400f2977
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
movsxd r8, dword [rbp + 0xc0]
mov rdx, qword [rbp + 0xa0]
lea rcx, [rsp + 0x20]
call fcn.140073120
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rdx, qword [rsp + 0x20]
lea rcx, [rbp + 0x3e0]
call fcn.1400ae230
mov rbx, rax
cmp r12, rax
je 0x1400f28f0
mov rcx, r12
call fcn.140073b90
movups xmm0, xmmword [rbx]
movups xmmword [r12], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r12 + 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 8
jb 0x1400f2936
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2931
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f2b0a
call fcn.140359090
mov r13b, 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400f2977
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2971
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f2b10
call fcn.140359090
nop
lea rax, vtable.tinyxml2::XMLPrinter.0
mov qword [rbp - 0x70], rax
lea rax, [rbp + 0xa8]
mov rcx, qword [rbp + 0xa0]
cmp rcx, rax
je 0x1400f299a
call fcn.140359090
lea rax, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x1400f29ac
call fcn.140359090
lea rax, vtable.tinyxml2::XMLVisitor.0
mov qword [rbp - 0x70], rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400f29f4
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f29ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f2b16
call fcn.140359090
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400f2a32
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2a2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f2af8
call fcn.140359090
nop
lea rax, vtable.tinyxml2::XMLDocument.0
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.1401ce8a0
lea rcx, [rbp + 0x358]
call fcn.1401d00e0
lea rcx, [rbp + 0x2d8]
call fcn.1401d02e0
lea rcx, [rbp + 0x258]
call fcn.1401d04f0
lea rcx, [rbp + 0x1d8]
call fcn.1401d06a0
lea rax, [rbp + 0x180]
mov rcx, qword [rbp + 0x178]
cmp rcx, rax
je 0x1400f2a94
call fcn.140359090
test dword [rbp + 0x148], 0x200
je 0x1400f2aac
mov rcx, qword [rbp + 0x150]
call fcn.140359090
mov dword [rbp + 0x148], esi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp + 0xd0]
call fcn.1401cc8d0
nop
movzx eax, r13b
mov rcx, qword [rbp + 0x408]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x560]
add rsp, 0x510
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3