Function at 0x180005180
Capabilities:
Get hostname
Get system firmware table

Disassembly:
push rbx
sub rsp, 0x80
mov dword [rsp + 0x78], 0x172
lea rax, [fcn.1800054f0]
add rax, 0x172
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
call fcn.180011c40
mov rax, qword [0x18012e8b0]
xor ebx, ebx
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x2e20]
mov dword [rax + 4], 0xd0f29841
cmp dword [0x18012e8b8], 0xa3e5bee
jne 0x18000532b
xor ecx, ecx
call qword [sym.imp.GDI32.dll_EndPath]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetMapperFlags]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
mov qword [rsp + 0x40], rbx
lea rax, str.x1KjNdSyhdhr6Gh1l4dH
mov qword [rsp + 0x38], rbx
lea r8, str.mjcLIYwZ9JFnrmgg8whBxepA5U7RX
mov qword [rsp + 0x30], rbx
lea rcx, str.6FWgq6zLPoM4atCa
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
lock inc dword [rbx]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetArcDirection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [rsp + 0x68], rbx
xor r9d, r9d
mov dword [rsp + 0x60], ebx
xor r8d, r8d
mov dword [rsp + 0x58], ebx
xor edx, edx
mov dword [rsp + 0x50], ebx
xor ecx, ecx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.GDI32.dll_CreateFontW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GdiComment]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
mov rax, qword [0x18012e8c0]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x18012e8b0]
mov edx, dword [rcx + 0x23c8]
mov rcx, qword [rax + 0x18]
add edx, 0x69f9d439
mov rax, qword [rcx + 0x2e20]
mov dword [rax], edx
cmp dword [0x18012e8b8], 0x7bb1de1d
jne 0x180005499
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov dword [rsp + 0x38], ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetMetaFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreatePolyPolygonRgn]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PatBlt]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_WidenPath]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
xor r9d, r9d
lea rdx, str.g5mLbMi3BpX1ecLR4Dd
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rax, qword [0x18012e8b0]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x18012e8c0]
mov rdx, qword [rcx + 0x2e20]
mov rcx, qword [rax + 0x18]
mov eax, dword [rcx + 0x23c8]
add dword [rdx + 4], eax
mov rax, qword [0x18012e8a8]
mov r8, qword [rax + 0x18]
mov rax, qword [0x18012e8b0]
mov rcx, qword [rax + 0x18]
mov eax, dword [r8 + 0x3b60]
mov rdx, qword [rcx + 0x2e20]
mov dword [rdx + 8], eax
add rsp, 0x80
pop rbx
ret