Function at 0x14006f200
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x520
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov dword [rsp + 0x44], r8d
mov r13, rdx
mov rsi, rcx
mov dword [rsp + 0x60], 0
mov ebx, 2
mov dword [rsp + 0x40], ebx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov rax, qword [rcx + 0x50]
mov rcx, qword [rax + 0xb0]
mov r15d, dword [rcx + 0x7468]
lea r14d, [rbx - 1]
cmp dword [rcx + 0x695c], r12d
je 0x14006f28a
mov r12d, r14d
mov dword [rsp + 0x48], r14d
xor ebx, ebx
mov dword [rsp + 0x40], ebx
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.1400b1290
nop
mov dword [rsp + 0x60], r14d
mov rax, qword [rax]
cmp qword [rax - 0x10], 0
jne 0x14006f2b2
cmp r15d, 4
je 0x14006f2b2
mov dil, 1
jmp 0x14006f2b5
xor dil, dil
mov eax, r14d
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x50]
call fcn.1400ca400
test dil, dil
je 0x14006f2e8
mov rax, qword [rsi]
lea r8, str.SendMailMsg:_Null_destination_address.__Reporting_successful_send.
mov edx, r14d
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x14006f906
mov rcx, qword [rsi + 0x50]
call fcn.140041340
test eax, eax
jne 0x14006f30f
mov rax, qword [rsi]
lea r8, str.SendMail::SendMailMsg:_Internet_connection_not_available.
mov edx, r14d
mov rcx, rsi
call qword [rax + 0x10]
mov eax, ebx
jmp 0x14006f906
mov dword [rsp + 0x64], 0
mov rax, qword [rsi + 0x50]
mov r8, qword [rax + 0xb0]
add r8, 0x6738
lea rdx, str.X_SpectorSerial
mov rcx, r13
call fcn.1400b1190
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rdx + 0xb0]
add rcx, 0x684d
lea rdx, [rsp + 0x410]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x14006f352
lea rdi, [rsp + 0x410]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str._on]
mov dword [rdi - 1], eax
movzx eax, byte [0x140210a78]
mov byte [rdi + 3], al
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x410]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov eax, 0x100
sub rax, rcx
mov dword [rsp + 0x64], eax
lea rcx, [rsp + rcx + 0x410]
lea rdx, [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea r8, [rsp + 0x410]
lea rdx, str.X_SpectorMachineID
mov rcx, r13
call fcn.1400b1190
mov rax, qword [rsi + 0x50]
mov r8, qword [rax + 0xb0]
add r8, 0x6749
lea rdx, str.X_SpectorComputerID
mov rcx, r13
call fcn.1400b1190
mov rdx, qword [rsi + 0x50]
mov rax, qword [rdx + 0xb0]
mov r8d, dword [rax + 0x1710]
lea rdx, [0x1401eb2e0]
lea rcx, [rsp + 0x410]
call fcn.14010d754
lea r8, [rsp + 0x410]
lea rdx, str.X_SpectorBuild
mov rcx, r13
call fcn.1400b1190
mov edx, r14d
mov edi, dword [rsp + 0x44]
test r12d, r12d
jne 0x14006f8fe
test r15d, r15d
je 0x14006f8fe
test edx, edx
je 0x14006f8fe
mov ecx, r15d
dec ecx
je 0x14006f815
dec ecx
je 0x14006f6dc
dec ecx
je 0x14006f4d5
dec ecx
jne 0x14006f8f7
lea rcx, [rsp + 0x140]
call fcn.1400c4df0
nop
mov rdx, r13
lea rcx, [rsp + 0x140]
call fcn.1400c32b0
mov rdx, qword [rsi + 0x50]
mov rdx, qword [rdx + 0xb0]
add rdx, 0x757c
lea rcx, [rsp + 0x140]
call fcn.1400c4f00
test eax, eax
je 0x14006f4b7
xor ebx, ebx
mov dword [rsp + 0x40], ebx
jmp 0x14006f4bb
test ebx, ebx
jne 0x14006f4c3
mov r12d, r14d
mov dword [rsp + 0x48], r14d
lea rcx, [rsp + 0x140]
call fcn.1400c47c0
jmp 0x14006f8f7
mov rax, qword [rsi + 0x50]
mov rcx, qword [rax + 0xb0]
cmp byte [rcx + 0x6c14], 0
je 0x14006f8f7
mov rax, qword [rsi + 0x48]
cmp dword [rax + 0x84], 0
je 0x14006f8f7
mov rax, qword [rsi]
lea r8, str.Using_Relay_SMTP
mov edx, 3
mov rcx, rsi
call qword [rax + 0x10]
lea rdx, [0x14024d112]
lea rcx, [rsp + 0x50]
call fcn.1400cc800
nop
lea rdx, [0x14024d112]
lea rcx, [rsp + 0x70]
call fcn.1400cc800
nop
lea rdx, [0x14024d112]
lea rcx, [rsp + 0x68]
call fcn.1400cc800
nop
mov rax, qword [rsi + 0x50]
mov rdx, qword [rax + 0xb0]
add rdx, 0x6c14
lea rcx, [rsp + 0x50]
call fcn.1400ca6a0
mov rdx, qword [rsi + 0x50]
mov rdx, qword [rdx + 0xb0]
add rdx, 0x6d18
lea rcx, [rsp + 0x70]
call fcn.1400ca6a0
mov rdx, qword [rsi + 0x50]
mov rdx, qword [rdx + 0xb0]
add rdx, 0x6e1c
lea rcx, [rsp + 0x68]
call fcn.1400ca6a0
mov rdx, qword [rsi + 0x50]
mov rax, qword [rdx + 0xb0]
mov ebx, dword [rax + 0x15fc]
mov edi, dword [rax + 0x7578]
mov eax, dword [rax + 0x7570]
mov dword [0x1402c207c], eax
mov rax, qword [rsi + 0x50]
mov rcx, qword [rax + 0xb0]
mov eax, dword [rcx + 0x7574]
mov dword [0x1402c2078], eax
mov eax, dword [r13 + 0x1ac]
mov dword [rsp + 0x78], eax
mov dword [r13 + 0x1ac], r14d
xor r9d, r9d
mov r8, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x48]
lea rcx, [rsp + 0x1e0]
call fcn.1400bf3d0
nop
mov dword [rsp + 0x30], edi
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, qword [rsp + 0x50]
xor edx, edx
lea rcx, [rsp + 0x1e0]
call fcn.1400bf070
mov rdx, r13
lea rcx, [rsp + 0x1e0]
call fcn.1400bf150
mov rdx, qword [rsp + 0x240]
mov edi, dword [rsp + 0x44]
mov dword [rdx + 0x1490], edi
lea rcx, [rsp + 0x1e0]
call fcn.1400bfb20
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x14006f682
cmp dword [rsi + 0x30], eax
je 0x14006f682
lea rcx, [rsp + 0x1e0]
call fcn.1400bfc30
mov ebx, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x1e0]
call fcn.1400bef80
mov edx, dword [rsp + 0x78]
mov dword [r13 + 0x1ac], edx
test ebx, ebx
cmove r12d, r14d
mov dword [rsp + 0x48], r12d
lea rcx, [rsp + 0x1e0]
call fcn.1400bf4e0
nop
lea rcx, [rsp + 0x68]
call fcn.1400ca400
nop
lea rcx, [rsp + 0x70]
call fcn.1400ca400
nop
lea rcx, [rsp + 0x50]
call fcn.1400ca400
mov edi, dword [rsp + 0x44]
jmp 0x14006f8f7
mov rax, qword [0x1402b9cc8]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.1400b1390
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400ca5a0
nop
lea rcx, [rsp + 0x98]
call fcn.1400ca400
lea rdx, [0x14024d112]
mov rcx, r13
call fcn.1400b6760
lea rdx, [rsp + 0x80]
mov rcx, r13
call fcn.1400b1290
nop
mov r9d, edi
mov r8, r13
mov rdx, qword [rax]
mov rcx, rsi
call fcn.14006ee20
mov ebx, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x80]
call fcn.1400ca400
test ebx, ebx
jne 0x14006f7f2
mov r12d, r14d
mov dword [rsp + 0x48], r14d
lea rdx, [rsp + 0x88]
mov rcx, r13
call fcn.1400b1310
nop
mov rax, qword [rax]
cmp qword [rax - 0x10], 0
setne dil
lea rcx, [rsp + 0x88]
call fcn.1400ca400
test dil, dil
je 0x14006f7cd
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.1400b1310
nop
mov edi, dword [rsp + 0x44]
mov r9d, edi
mov r8, r13
mov rdx, qword [rax]
mov rcx, rsi
call fcn.14006ee20
nop
lea rcx, [rsp + 0x90]
call fcn.1400ca400
jmp 0x14006f7d1
mov edi, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x58]
cmp qword [rdx - 0x10], 0
je 0x14006f7f9
mov r9d, edi
mov r8, r13
mov rcx, rsi
call fcn.14006ee20
mov rdx, qword [rsp + 0x58]
jmp 0x14006f7f9
mov rdx, qword [rsp + 0x58]
jmp 0x14006f7fd
mov edi, dword [rsp + 0x44]
mov rcx, r13
call fcn.1400b6760
nop
lea rcx, [rsp + 0x58]
call fcn.1400ca400
jmp 0x14006f8f7
mov rax, qword [rsi + 0x50]
mov rcx, qword [rax + 0xb0]
mov rax, qword [rsi]
cmp dword [rcx + 0x6960], 0
mov rcx, rsi
jne 0x14006f8dc
lea r8, str.Using_Default_method
mov edx, 3
call qword [rax + 0x10]
lea rdx, str.X_SpectorSerial
mov rcx, r13
call fcn.1400b4e20
lea rdx, str.X_SpectorMachineID
mov rcx, r13
call fcn.1400b4e20
lea rdx, str.X_SpectorComputerID
mov rcx, r13
call fcn.1400b4e20
xor edx, edx
lea rcx, [rsp + 0xa8]
call fcn.1400a3e30
nop
mov r9, qword [rsi + 0x48]
mov r8, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x50]
lea rcx, [rsp + 0xd0]
call fcn.1400414d0
nop
mov rdx, r13
lea rcx, [rsp + 0xd0]
call fcn.1400417d0
xor ebx, ebx
test eax, eax
sete bl
mov dword [rsp + 0x40], ebx
test ebx, ebx
cmove r12d, r14d
mov dword [rsp + 0x48], r12d
lea rcx, [rsp + 0xd0]
call fcn.140040fe0
nop
lea rcx, [rsp + 0xa8]
call fcn.1400a4630
jmp 0x14006f8f7
lea r8, str.SendMailMsg:_Internal_email_disabled.
mov edx, r14d
call qword [rax + 0x10]
mov r12d, r14d
mov dword [rsp + 0x48], r14d
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor edx, edx
jmp 0x14006f435
jmp 0x14006f904
mov eax, ebx
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.14010d170
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret