Function at 0x1000dd4d4
Capabilities:
Get hostname

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov r12, rcx
lea r14, [0x100153eb8]
mov ebx, 5
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000dd52a
test byte [rcx + 0x1c], 1
je 0x1000dd52a
cmp byte [rcx + 0x19], bl
jb 0x1000dd52a
lea edx, [rbx + 8]
mov r9, r12
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.100034834
xor r13d, r13d
cmp dword [r12 + 0x48], r13d
je 0x1000dd550
mov edx, dword [r12 + 0x48]
cmp edx, r13d
je 0x1000dd550
mov rcx, qword [0x100158a38]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov dword [r12 + 0x48], r13d
mov qword [rsp + 0xb0], r13
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1000262b0]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1000262a0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
mov ebp, 2
cmp eax, r13d
jge 0x1000dd5e3
mov rdi, qword [0x100153eb8]
cmp rdi, r14
je 0x1000dd5c0
test byte [rdi + 0x1c], bpl
je 0x1000dd5c0
cmp byte [rdi + 0x19], bpl
jb 0x1000dd5c0
lea edx, [rbp + 0xc]
mov r9d, eax
lea r8, [0x10001dc88]
mov rcx, qword [rdi + 0x10]
call fcn.100036510
mov rdi, qword [0x100153eb8]
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x1000ddab6
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [0x100153eb8]
jmp 0x1000ddab6
mov r8, qword [rsp + 0xb0]
lea rdx, [0x1000262b0]
lea rcx, [r12 + 0x48]
call fcn.1001082a0
mov esi, eax
cmp eax, r13d
jge 0x1000dd622
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x1000dd67c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [0x100153eb8]
jmp 0x1000ddab6
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000dd64e
test byte [rcx + 0x1c], bpl
je 0x1000dd64e
cmp byte [rcx + 0x19], bl
jb 0x1000dd64e
mov edx, 0xf
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.100034784
mov rcx, r12
call fcn.1000ddb24
mov esi, eax
cmp eax, r13d
jge 0x1000dd688
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x1000dd67c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [0x100153eb8]
jmp 0x1000ddab6
mov rdi, qword [0x100153eb8]
jmp 0x1000ddab6
lea rcx, [0x100152100]
mov rax, qword [0x100152100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xb8], rbx
mov r14d, 0x10
mov dword [rsp + 0xa0], r14d
lea ecx, [r14 - 0xf]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1000dd6dc
mov edx, r14d
lea rcx, [rsp + 0xb8]
call fcn.100036160
mov rbx, qword [rsp + 0xb8]
cmp dword [rbx - 0xc], r14d
jl 0x1000ddb01
mov dword [rbx - 0x10], r14d
mov word [rbx + 0x20], r13w
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
or r15, 0xffffffffffffffff
cmp eax, r13d
je 0x1000dd787
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, r13d
jl 0x1000dd77c
cmp ecx, dword [rbx - 0xc]
jg 0x1000dd77c
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r13w
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000dd7f2
test byte [rcx + 0x1c], bpl
je 0x1000dd804
cmp byte [rcx + 0x19], 5
jb 0x1000dd7fb
mov edx, r14d
mov r9, rbx
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.1000347a8
lea r14, [0x100153eb8]
jmp 0x1000dd80b
mov ecx, 0x80070057
call fcn.100036284
int3
cmp dword [rbx - 0xc], r13d
jl 0x1000ddaf6
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
cmp eax, r13d
cmovle esi, eax
mov ecx, 0x80004005
cmp esi, r13d
cmovge esi, ecx
mov rcx, qword [0x100153eb8]
lea r14, [0x100153eb8]
cmp rcx, r14
je 0x1000dd80b
test byte [rcx + 0x1c], bpl
je 0x1000dd80b
cmp byte [rcx + 0x19], bpl
jb 0x1000dd80b
mov edx, 0x11
mov r9d, eax
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1000dd80b
lea r14, [0x100153eb8]
jmp 0x1000dd80b
lea r14, [0x100153eb8]
jmp 0x1000dd80b
lea r14, [0x100153eb8]
lea rcx, [rsp + 0xb8]
call fcn.1000699ec
lea rcx, [0x100152100]
mov rax, qword [0x100152100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xa8], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x105
sub eax, edi
or eax, ecx
jge 0x1000dd862
mov edx, edi
lea rcx, [rsp + 0xa8]
call fcn.100036160
mov rbx, qword [rsp + 0xa8]
cmp dword [rbx - 0xc], edi
jl 0x1000ddaeb
mov dword [rbx - 0x10], edi
mov word [rbx + 0x20a], r13w
mov r8d, edi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, r13d
je 0x1000dd966
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, r13d
jl 0x1000dd95b
cmp ecx, dword [rbx - 0xc]
jg 0x1000dd95b
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r13w
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbx + rcx*2]
cmp rax, rbx
je 0x1000dd8de
cmp word [rax], 0x5c
je 0x1000dd8e7
sub rax, rbp
cmp rax, rbx
jne 0x1000dd8d0
cmp word [rax], 0x5c
je 0x1000dd8e7
mov rax, r13
cmp rax, r13
je 0x1000dd966
sub rax, rbx
sar rax, 1
cmp eax, r15d
je 0x1000dd966
mov r8d, dword [rbx - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xa8]
call fcn.100086bf4
nop
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.100035ef8
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r13d
jg 0x1000dd951
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0xa8]
jmp 0x1000dd966
mov rbx, qword [rsp + 0xa8]
jmp 0x1000dd966
mov ecx, 0x80070057
call fcn.100036284
int3
lea rcx, [0x100152100]
mov rax, qword [0x100152100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov r9, qword [rsp + 0xb8]
mov r8, rbx
lea rdx, [0x100026238]
lea rcx, [rsp + 0x30]
call fcn.100039dd4
mov rdi, qword [rsp + 0x30]
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000dd9d5
test byte [rcx + 0x1c], bpl
je 0x1000dd9dc
mov ebx, 5
cmp byte [rcx + 0x19], bl
jb 0x1000dd9e1
lea edx, [rbx + 0xd]
mov r9, rdi
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.1000347a8
jmp 0x1000dd9e1
mov ebx, 5
jmp 0x1000dd9e1
mov ebx, 5
mov rcx, qword [r12 + 0x80]
cmp rdi, rcx
je 0x1000dda22
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp rdi, r13
je 0x1000dda1a
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r12 + 0x80], rax
cmp rax, r13
jne 0x1000dda22
mov ecx, 0x8007000e
call fcn.100036284
int3
mov qword [r12 + 0x80], r13
mov eax, 0x8007000e
cmp qword [r12 + 0x80], r13
cmove esi, eax
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r13d
jg 0x1000dda50
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r13d
jg 0x1000dda76
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r13d
jg 0x1000dda9c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x1000ddaaf
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [0x100153eb8]
cmp rdi, r14
je 0x1000ddae7
test byte [rdi + 0x1c], 1
je 0x1000ddae7
movzx eax, byte [rdi + 0x19]
cmp esi, r13d
cmovge ebp, ebx
cmp eax, ebp
jl 0x1000ddae7
mov edx, 0x13
mov r9d, esi
lea r8, [0x10001dc88]
mov rcx, qword [rdi + 0x10]
call fcn.100036510
mov eax, esi
jmp 0x1000ddb0c
mov ecx, 0x80070057
call fcn.100036284
nop
mov ecx, 0x80070057
call fcn.100036284
int3
mov ecx, 0x80070057
call fcn.100036284
nop
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret