Function at 0x1800165b0
Capabilities:
Get hostname
Get session user name

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x68
xor edi, edi
mov rax, r8
mov qword [r11 - 0x40], rdi
mov dword [rsp + 0x38], edi
mov r13, rdi
mov dword [rsp + 0x30], edi
mov qword [r11 - 0x58], rdi
mov r12, rdi
mov dword [rsp + 0x34], edi
mov qword [r11 - 0x50], rdi
mov r15d, edi
mov rbx, rdi
mov rsi, rdi
mov qword [r11 - 0x48], rdi
mov dword [rsp + 0x3c], edi
test rdx, rdx
jne 0x180016618
mov eax, 0x80070057
add rsp, 0x68
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test rax, rax
je 0x180016605
cmp qword [rcx + 0x20], rbx
je 0x18001692c
cmp dword [rcx + 0x28], ebx
jle 0x18001692c
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0x60], r14
call fcn.1800161f0
mov r14, qword [rsp + 0x58]
movsxd rbp, dword [rsp + 0x38]
mov edi, eax
test eax, eax
js 0x180016883
test ebp, ebp
jg 0x18001666e
mov edi, 0xe0010003
jmp 0x180016883
cmp dword [rsp + 0xc0], 1
jne 0x1800167f9
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, dword [rsp + 0x30]
mov rcx, 0xffffffffffffffff
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.180036df8
mov r13, rax
test rax, rax
jne 0x1800166ba
mov edi, 0x8007000e
jmp 0x180016883
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
add r8, r8
call fcn.180037390
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.180025100
mov edi, eax
test eax, eax
js 0x180016883
lea rdx, [rsp + 0x34]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edx, dword [rsp + 0x34]
mov rcx, 0xffffffffffffffff
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.180036df8
mov r12, rax
test rax, rax
jne 0x180016734
mov edi, 0x8007000e
jmp 0x180016883
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov rcx, rax
add r8, r8
call fcn.180037390
lea rdx, [rsp + 0x34]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.180025100
mov edi, eax
test eax, eax
js 0x180016883
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
add ecx, eax
lea r15d, [rcx + rbp + 4]
lea eax, [r15 + 1]
mov ecx, eax
mov edi, eax
call fcn.180036df8
mov rbx, rax
test rax, rax
jne 0x18001679e
mov edi, 0x8007000e
jmp 0x180016883
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.180037390
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
lea edx, [rax + rdx + 5]
mov rax, qword [rsp + 0x48]
lea r8, str._s_s_
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.180039350
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
mov rdx, rbp
mov r9, rbp
repne scasb al, byte [rdi]
mov r8, r14
not rcx
dec rcx
add rcx, rbx
call fcn.18003767c
jmp 0x180016834
lea eax, [rbp + 1]
mov r15d, ebp
mov ecx, eax
mov edi, eax
call fcn.180036df8
mov rbx, rax
test rax, rax
jne 0x180016817
mov edi, 0x8007000e
jmp 0x180016883
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.180037390
mov edx, ebp
mov r9d, ebp
mov r8, r14
mov rcx, rbx
call fcn.18003767c
mov r8d, dword [rsp + 0xb8]
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x50]
mov edx, r15d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.180011700
mov edi, eax
test eax, eax
js 0x18001687e
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x50]
xor edi, edi
mov qword [rcx], rax
mov rcx, qword [rsp + 0xb0]
mov eax, dword [rsp + 0x3c]
mov dword [rcx], eax
jmp 0x180016883
mov rsi, qword [rsp + 0x50]
test r14, r14
je 0x18001689d
mov r8, rbp
xor edx, edx
mov rcx, r14
call fcn.180037390
mov rcx, r14
call fcn.18003747c
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa0]
test rsi, rsi
je 0x1800168b7
mov rcx, rsi
call fcn.18003747c
test r13, r13
je 0x1800168c4
mov rcx, r13
call fcn.18003747c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800168dc
call fcn.18003747c
mov qword [rsp + 0x40], 0
test r12, r12
je 0x1800168e9
mov rcx, r12
call fcn.18003747c
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180016901
call fcn.18003747c
mov qword [rsp + 0x48], 0
test rbx, rbx
je 0x18001691c
lea r8d, [r15 + 1]
xor edx, edx
mov rcx, rbx
call fcn.180037390
mov rcx, rbx
call fcn.18003747c
mov eax, edi
add rsp, 0x68
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, 0xe0010003
add rsp, 0x68
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret