Function at 0x1400a34bc
Capabilities:
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r14, rcx
mov qword [rsp + 0x60], rcx
lea rdi, [rcx + 0x140]
call fcn.14009b2b0
comisd xmm0, xmmword [0x140372390]
jbe 0x1400a3517
xor ecx, ecx
call fcn.140347774
mov rcx, qword [rdi]
mov qword [rcx + 0x2f8], rax
mov qword [rsp + 0x58], rdi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], eax
mov rax, qword [rdi]
xor esi, esi
cmp byte [rax + 0x2e8], sil
je 0x1400a3a7a
mov byte [rax + 0x2e8], sil
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov rcx, rax
call fcn.140088c38
mov ecx, dword [rax + 0x60]
mov rax, qword [rdi]
mov dword [rax + 0x448], ecx
mov dword [rsp + 0x20], 0x10
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
lea rax, [rsp + 0x120]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], si
jne 0x1400a35a6
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x70]
call fcn.140003b88
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.1400af92c
mov rcx, qword [rdi]
add rcx, 0x360
mov rdx, rax
call fcn.140015734
mov rdx, qword [rsp + 0xa8]
mov r15d, 0x1000
cmp rdx, 0x10
jb 0x1400a362c
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x1400a3627
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3f1b
call fcn.1403357a8
movdqa xmm0, xmmword [0x140372210]
movdqu xmmword [rsp + 0xa0], xmm0
mov byte [rsp + 0x90], sil
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a3686
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x1400a3681
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3f21
call fcn.1403357a8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
lea rax, [rsp + 0x120]
inc rbx
cmp word [rax + rbx*2], si
jne 0x1400a36b5
mov r8, rbx
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x70]
call fcn.140003b88
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.1400af92c
mov rcx, qword [rdi]
add rcx, 0x380
mov rdx, rax
call fcn.140015734
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x1400a3737
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x1400a3732
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3f27
call fcn.1403357a8
movdqa xmm0, xmmword [0x140372210]
movdqu xmmword [rsp + 0xa0], xmm0
mov byte [rsp + 0x90], sil
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a3791
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x1400a378c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3f2d
call fcn.1403357a8
xor ecx, ecx
call fcn.140347774
mov rcx, rax
call fcn.1403458c0
mov rax, qword [rdi]
mov dword [rax + 0x444], 6
lea rcx, [rsp + 0x40]
call fcn.1400acabc
nop
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1400af92c
mov rcx, qword [rdi]
add rcx, 0x3a0
mov rdx, rax
call fcn.140015734
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x1400a381b
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x1400a3816
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3f33
call fcn.1403357a8
mov rdx, qword [rsp + 0x40]
add rdx, 0x20
lea rcx, [rsp + 0x90]
call fcn.1400af92c
mov rcx, qword [rdi]
add rcx, 0x3c0
mov rdx, rax
call fcn.140015734
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x1400a3882
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x1400a387d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3f39
call fcn.1403357a8
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.140021134
lea rbx, [0x140370c0d]
mov rdx, rbx
cmp qword [rax + 0x10], rsi
cmovne rdx, qword [rax + 0x10]
mov rcx, qword [rdi]
add rcx, 0x320
call fcn.1400421e0
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov rdx, rbx
cmp qword [rax + 0x20], rsi
cmovne rdx, qword [rax + 0x20]
mov rcx, qword [rdi]
add rcx, 0x340
call fcn.1400421e0
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov rdx, rbx
cmp qword [rax + 0x30], rsi
cmovne rdx, qword [rax + 0x30]
mov rcx, qword [rdi]
add rcx, 0x3e0
call fcn.1400421e0
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.140021134
cmp qword [rax + 0x40], rsi
cmovne rbx, qword [rax + 0x40]
mov rcx, qword [rdi]
add rcx, 0x400
mov rdx, rbx
call fcn.1400421e0
mov rax, qword [rdi]
lea rbx, [rax + 0x7f8]
lea rdx, [rax + 0x3e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400a395c
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
call fcn.140012c04
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400af684
mov rax, qword [rdi]
lea rbx, [rax + 0x810]
lea rdx, [rax + 0x400]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400a39aa
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
call fcn.140012c04
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400af684
mov rax, qword [rdi]
lea rbx, [rax + 0x828]
lea rdx, [rax + 0x320]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400a39f8
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
call fcn.140012c04
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400af684
mov rcx, r14
call fcn.14009a028
mov rax, qword [rdi]
lea rbx, [rax + 0x840]
lea rdx, [rax + 0x340]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400a3a4e
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
call fcn.140012c04
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400af684
mov rcx, r14
call fcn.140097a2c
nop
lea rcx, [rsp + 0x40]
call fcn.140096058
jmp 0x1400a3a80
mov r15d, 0x1000
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov r12d, esi
cmp dword [rax + 8], 0x64
cmovbe r12d, dword [rax + 8]
mov dword [rsp + 0x38], r12d
mov rcx, qword [rdi]
mov r13d, dword [rcx + 0x448]
mov dword [rsp + 0x28], r13d
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov rcx, rax
call fcn.140088c38
mov ecx, dword [rax + 0x60]
mov dword [rsp + 0x20], ecx
cmp dword [rsp + 0x30], esi
jle 0x1400a3b39
xor ecx, ecx
call fcn.140347774
mov rcx, qword [rdi]
mov rdx, qword [rcx + 0x860]
add rdx, 0x1e
cmp rax, rdx
jle 0x1400a3b10
call fcn.1400adc2c
mov ebx, eax
mov rcx, qword [rdi]
cmp dword [rcx + 0x858], eax
je 0x1400a3b10
xor ecx, ecx
call fcn.140347774
mov rcx, qword [rdi]
mov qword [rcx + 0x860], rax
mov rcx, qword [rdi]
mov dword [rcx + 0x858], ebx
xor ecx, ecx
call fcn.140347774
mov r8, qword [rdi]
imul ecx, dword [rsp + 0x30], 0x3c
movsxd rdx, ecx
add rdx, qword [r8 + 0x860]
cmp rax, rdx
jle 0x1400a3b39
cmp dword [r8 + 0x858], esi
mov cl, 1
jne 0x1400a3b3c
mov cl, sil
mov rax, qword [rdi]
mov byte [rax + 0x2e9], cl
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov bl, byte [rax + 0x70]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov r8, qword [rdi]
add r8, 0x810
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
lea r9, [r8 + 8]
mov rdx, qword [r9]
sub rdx, qword [r8]
sar rdx, 5
lea rcx, [rsp + 0x70]
call fcn.14008b858
nop
mov r8, qword [rdi]
add r8, 0x7f8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
lea r9, [r8 + 8]
mov rdx, qword [r9]
sub rdx, qword [r8]
sar rdx, 5
lea rcx, [rsp + 0x40]
call fcn.14008b858
nop
mov r9b, bl
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1400aee70
mov rcx, qword [rdi]
add rcx, 0x420
mov rdx, rax
call fcn.140015734
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x1400a3c2e
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x1400a3c29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3f3f
call fcn.1403357a8
mov rbx, qword [rdi]
lea rcx, [rbx + 0x420]
lea rdx, str.none
call fcn.14008b2e8
test al, al
je 0x1400a3c6b
mov byte [rbx + 0x2ea], 1
xor edx, edx
mov rcx, r14
call fcn.1400a294c
mov rax, qword [rdi]
mov dword [rax + 0x444], 4
jmp 0x1400a3cf1
mov rbx, qword [rbx + 0x2f8]
xor ecx, ecx
call fcn.140347774
mov rdx, rbx
mov rcx, rax
call fcn.140347744
comisd xmm0, xmmword [0x1403c9278]
jb 0x1400a3cb3
xor ecx, ecx
call fcn.140347774
mov rcx, qword [rdi]
mov qword [rcx + 0x2f8], rax
xor edx, edx
mov rcx, r14
call fcn.1400a294c
mov dl, 1
mov rcx, r14
call fcn.1400a294c
mov rax, qword [rdi]
mov byte [rax + 0x2ea], sil
mov rax, qword [rdi]
cmp byte [rax + 0x2e9], sil
je 0x1400a3d3f
test r12d, r12d
jg 0x1400a3d44
mov dl, sil
mov rcx, r14
call fcn.1400a294c
mov rdx, qword [rdi]
mov al, byte [rdx + 0x2e9]
neg al
sbb ecx, ecx
neg ecx
add ecx, 2
mov dword [rdx + 0x444], ecx
mov rax, qword [rdi]
mov rbx, qword [rax + 0x2f0]
xor ecx, ecx
call fcn.140347774
mov rdx, rbx
mov rcx, rax
call fcn.140347744
comisd xmm0, xmmword [0x1403c9270]
jb 0x1400a3d5e
xor ecx, ecx
call fcn.140347774
mov rcx, qword [rdi]
mov qword [rcx + 0x2f0], rax
mov rcx, r14
call fcn.140097a2c
nop
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
nop
jmp 0x1400a3d5e
test r13d, r13d
jle 0x1400a3cce
mov dl, 1
jmp 0x1400a3cd1
mov eax, dword [rsp + 0x20]
mov rcx, qword [rdi]
cmp byte [rcx + 0x2e9], sil
je 0x1400a3d92
cmp eax, r12d
je 0x1400a3eee
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov rcx, rax
call fcn.140088c38
mov dword [rax + 0x60], r12d
mov eax, dword [rsp + 0x20]
jmp 0x1400a3d9b
cmp eax, r13d
je 0x1400a3eee
mov rcx, qword [rdi]
cmp byte [rcx + 0x2e9], sil
jne 0x1400a3dc1
cmp eax, r13d
je 0x1400a3dc1
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov rcx, rax
call fcn.140088c38
mov dword [rax + 0x60], r13d
mov rcx, qword [rdi]
cmp byte [rcx + 0x2e9], sil
je 0x1400a3dd7
test r12d, r12d
jg 0x1400a3de0
jmp 0x1400a3eee
test r13d, r13d
jle 0x1400a3eee
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov rcx, rax
call fcn.140088c38
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0x90]
call fcn.140088224
lea rcx, [rbx + 0x30]
mov rdx, rax
call fcn.140092b74
lea rcx, [rsp + 0x90]
call fcn.140088674
xor r9d, r9d
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0xc0]
call fcn.14001e974
nop
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.140021134
mov rdx, qword [rax]
mov r8, qword [rdx + 0x28]
lea rdx, [rsp + 0xc0]
mov rcx, rax
call r8
mov rax, qword [rdi]
lea rdx, [rsp + 0xc0]
mov rcx, qword [rax + 0x30]
call fcn.1400216e0
mov rax, qword [rdi]
cmp byte [rax + 0x2ea], sil
jne 0x1400a3e9a
mov dl, 1
mov rcx, r14
call fcn.1400a294c
nop
mov rbx, qword [rsp + 0xd8]
test rbx, rbx
je 0x1400a3ecf
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov word [rsp + 0xce], si
mov rcx, rbx
call fcn.14001ebe8
mov edx, 0x18
mov rcx, rbx
call fcn.1403357a8
mov rcx, qword [rsp + 0xf0]
call fcn.14033ce60
mov edx, 1
mov rcx, qword [rsp + 0xe8]
call fcn.1403357a8
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1403358f0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14033cba4
nop
call fcn.14033cba4
nop
call fcn.14033cba4
nop
call fcn.14033cba4
nop
call fcn.14033cba4
int3
call fcn.14033cba4
nop
call fcn.14033cba4
int3