Function at 0x100009568
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x10007f258]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor esi, esi
mov rdi, rcx
movabs r14, 0x8001000000000001
mov dword [rsp + 0x20], esi
cmp dword [0x10008051c], esi
je 0x1000095f0
mov al, byte [0x100080520]
cmp al, 4
jb 0x10000a755
test qword [0x100080508], r14
je 0x1000095f0
mov rcx, qword [0x100080510]
mov rax, rcx
and rax, r14
cmp rax, rcx
jne 0x1000095f0
mov rcx, qword [0x100080860]
lea rdx, [0x100075238]
call fcn.100008c30
mov rax, qword [rdi + 8]
mov qword [0x10007f2f8], rax
mov rax, qword [rdi]
mov qword [0x10007f2a0], rax
call fcn.10000d7c8
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x198
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebp, 1
lea r13, [0x100075248]
lea r12, [0x10007f250]
cmp eax, esi
jne 0x10000a763
mov dword [0x10007f230], ebp
call sym.spoolsv.exe_PrvSplIsUpgrade
mov r15d, 0x5c
lea rdx, [rsp + 0x24]
lea rcx, [0x10007faac]
mov word [0x10007faaa], r15w
mov word [0x10007faa8], r15w
mov dword [rsp + 0x24], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, esi
je 0x10000a794
call fcn.10000cdb4
mov ecx, eax
call fcn.10000d4c0
cmp eax, esi
mov ebx, eax
jl 0x10000a7eb
lea rdx, [0x100080880]
lea rcx, [0x100080888]
call sym.spoolsv.exe_PrvBuildOtherNamesFromMachineName
cmp eax, esi
je 0x10000a844
mov rax, qword [0x100080888]
mov word [0x10007fbb0], r15w
mov word [0x10007fbb2], r15w
mov r8, qword [rax + 8]
mov edx, 0x102
lea rcx, [0x10007fbb4]
lea rax, [rdx + 0x7ffffefc]
cmp rax, rsi
je 0x100009707
movzx eax, word [r8]
cmp ax, si
je 0x100009707
mov word [rcx], ax
add r8, 2
add rcx, 2
sub rdx, rbp
jne 0x1000096e2
cmp rdx, rsi
je 0x10000a883
mov word [rcx], si
call fcn.10000d0f0
cmp eax, esi
mov ebx, eax
jl 0x10000a88c
call fcn.10000cfb4
cmp eax, esi
mov ebx, eax
jl 0x10000a8e5
call fcn.10000ccbc
cmp eax, esi
jne 0x10000974b
mov ecx, ebp
call fcn.10000d250
cmp eax, esi
mov ebx, eax
jl 0x10000a93e
lea r8, [rsp + 0x20]
lea rcx, [0x1000752a0]
xor edx, edx
call fcn.100008e24
mov qword [0x10007f2f0], rax
cmp rax, rsi
je 0x10000a98f
mov rcx, qword [rax + 0x10]
call fcn.10000a730
cmp eax, esi
je 0x10000a9dc
call fcn.10000b074
mov rcx, qword [0x100080858]
call fcn.100007dac
mov dword [0x10007f22c], ebp
call fcn.10000ac98
call fcn.10000bcb0
call fcn.10000aa80
call fcn.10000ab84
call fcn.10000c0ec
call fcn.10000c198
call fcn.10000be6c
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [0x10008051c], esi
je 0x100009805
mov al, byte [0x100080520]
cmp al, 4
jb 0x10000aa34
test qword [0x100080508], r14
je 0x100009805
mov rdx, qword [0x100080510]
mov rcx, rdx
and rcx, r14
cmp rcx, rdx
jne 0x100009805
mov rcx, qword [0x100080860]
lea rdx, [0x100074f70]
call fcn.100008c30
call fcn.10000abd0
int3
cmp al, sil
je 0x1000095c2
jmp 0x1000095f0
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000964d
test byte [rcx + 0x1c], bpl
je 0x10000964d
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 9]
mov r9d, eax
mov r8, r13
call fcn.10001ba70
jmp 0x10000964d
mov rax, qword [0x10007f250]
cmp rax, r12
je 0x10000a7c6
test byte [rax + 0x1c], bpl
je 0x10000a7c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10007f250]
lea edx, [r15 - 0x51]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001ba70
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000767e8]
xor r8d, r8d
mov edx, eax
call fcn.100032cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000a811
test byte [rcx + 0x1c], bpl
je 0x10000a811
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, eax
mov r8, r13
call fcn.10001ba70
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100076828]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100032cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x10007f250]
cmp rax, r12
je 0x10000a877
test byte [rax + 0x1c], bpl
je 0x10000a877
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10007f250]
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001ba70
mov word [0x10007fbb0], si
jmp 0x100009713
sub rcx, 2
jmp 0x100009710
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000a8b2
test byte [rcx + 0x1c], bpl
je 0x10000a8b2
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r9d, eax
mov r8, r13
call fcn.10001ba70
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100076808]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100032cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000a90b
test byte [rcx + 0x1c], bpl
je 0x10000a90b
mov rcx, qword [rcx + 0x10]
mov edx, 0xf
mov r9d, eax
mov r8, r13
call fcn.10001ba70
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100076838]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100032cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000a964
test byte [rcx + 0x1c], bpl
je 0x10000a964
mov rcx, qword [rcx + 0x10]
mov edx, 0x10
mov r9d, eax
mov r8, r13
call fcn.10001ba70
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100076848]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100032cf8
nop
jmp 0x10000974b
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000a9b7
test byte [rcx + 0x1c], bpl
je 0x10000a9b7
mov r9d, dword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
mov edx, 0x11
mov r8, r13
call fcn.10001ba70
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000767f8]
xor r8d, r8d
mov edx, eax
call fcn.100032cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x10007f250]
cmp rax, r12
je 0x10000aa0f
test byte [rax + 0x1c], bpl
je 0x10000aa0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10007f250]
mov edx, 0x12
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001ba70
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000767f8]
xor r8d, r8d
mov edx, eax
call fcn.100032cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp al, sil
jne 0x100009805
jmp 0x1000097d7