Function at 0x140006a60
Capabilities:
Get hostname
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x970]
sub rsp, 0xa70
mov rax, qword [0x140030118]
xor rax, rsp
mov qword [rbp + 0x960], rax
mov rbx, rcx
movzx r12d, dl
lea rcx, [rbp + 0x362]
xor esi, esi
xor edx, edx
mov r8d, 0x1fc
mov word [rbp + 0x360], si
call fcn.14000fdf0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x360]
mov dword [rsp + 0x40], 0xff
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r9, [rbx + 0x140]
lea r8, [rbp + 0x360]
lea rdx, str.nova__s__s.nvp
lea rcx, [rbp + 0x560]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbx + 0x140]
lea rdx, str._s.nvp
lea rcx, [rbp + 0x760]
call qword [sym.imp.USER32.dll_wsprintfW]
add rbx, 0x370
mov r8, qword [rbx + 0x18]
cmp r8, 8
jb 0x140006b1f
mov rcx, qword [rbx]
jmp 0x140006b22
mov rcx, rbx
lea rdx, [rbp + 0x160]
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140006b30
mov edx, dword [0x140025878]
movzx r9d, word [0x14002587c]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x160]
lea r10, [rbp + 0x560]
repne scasw ax, word [rdi]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], edx
mov word [rdi + 2], r9w
lea rdi, [rbp + 0x160]
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [r10 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140006b80
cmp r8, 8
jb 0x140006b9c
mov rbx, qword [rbx]
lea rcx, [rsp + 0x60]
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x140006bb0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], edx
mov word [rdi + 2], r9w
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
xor ecx, ecx
lea rdx, [rbp + 0x760]
nop dword [rax]
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140006bf0
test r12b, r12b
je 0x140006c46
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140010fa4
cmp eax, 0xffffffff
jne 0x140006d7f
lea rcx, [rbp + 0x160]
xor edx, edx
call fcn.140010fa4
cmp eax, 0xffffffff
je 0x140006c46
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x140006d7f
mov edx, 0x28
lea ecx, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x140006c81
call fcn.14000aea0
test rax, rax
je 0x140006c81
call fcn.14000aea0
lea r8, str.Cannot_alloc_memory_for_security_descriptor
lea rdx, [0x1400239b8]
mov rcx, rax
call fcn.14000ac50
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x140006cb8
call fcn.14000aea0
test rax, rax
je 0x140006cb8
call fcn.14000aea0
lea r8, str.Cannot_initialize_for_security_descriptor
lea rdx, [0x1400239b8]
mov rcx, rax
call fcn.14000ac50
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x140006cf4
call fcn.14000aea0
test rax, rax
je 0x140006cf4
call fcn.14000aea0
lea r8, str.Cannot_set_dacl_for_security_descriptor
lea rdx, [0x1400239b8]
mov rcx, rax
call fcn.14000ac50
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x48]
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x48], 0x18
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140006d68
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.14000aea0
test rax, rax
je 0x140006d71
call fcn.14000aea0
lea r8, [rsp + 0x60]
lea rdx, str.PdfsInstaller.CopyFiles__FAILED_to_create_public_profiles_file:___s___error___d
mov rcx, rax
mov r9d, esi
call fcn.14000ac50
jmp 0x140006d71
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x140006d7f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov rcx, qword [rbp + 0x960]
xor rcx, rsp
call fcn.14000fd60
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret