Function at 0x10000a060
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x10007f258]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor esi, esi
mov rdi, rcx
movabs r14, 0x8001000000000001
mov dword [rsp + 0x20], esi
cmp dword [0x100080514], esi
je 0x10000a0e8
mov al, byte [0x100080518]
cmp al, 4
jb 0x10000aac9
test qword [0x100080500], r14
je 0x10000a0e8
mov rcx, qword [0x100080508]
mov rax, rcx
and rax, r14
cmp rax, rcx
jne 0x10000a0e8
mov rcx, qword [0x100080ad8]
lea rdx, [0x100076208]
call fcn.100009c78
mov rax, qword [rdi + 8]
mov qword [0x10007f2f8], rax
mov rax, qword [rdi]
mov qword [0x10007f2a0], rax
call fcn.10000ddc8
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x198
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebp, 1
lea r13, [0x100076218]
lea r12, [0x10007f250]
cmp eax, esi
jne 0x10000aad7
mov dword [0x10007f230], ebp
call sym.spoolsv.exe_PrvSplIsUpgrade
mov r15d, 0x5c
lea rdx, [rsp + 0x24]
lea rcx, [0x10007faac]
mov word [0x10007faaa], r15w
mov word [0x10007faa8], r15w
mov dword [rsp + 0x24], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, esi
je 0x10000ab08
call fcn.10000d3c4
mov ecx, eax
call fcn.10000dac0
cmp eax, esi
mov ebx, eax
jl 0x10000ab5f
lea rdx, [0x100080b00]
lea rcx, [0x100080b08]
call sym.spoolsv.exe_PrvBuildOtherNamesFromMachineName
cmp eax, esi
je 0x10000abb8
mov rax, qword [0x100080b08]
mov word [0x10007fbb0], r15w
mov word [0x10007fbb2], r15w
mov r8, qword [rax + 8]
mov edx, 0x102
lea rcx, [0x10007fbb4]
lea rax, [rdx + 0x7ffffefc]
cmp rax, rsi
je 0x10000a1ff
movzx eax, word [r8]
cmp ax, si
je 0x10000a1ff
mov word [rcx], ax
add r8, 2
add rcx, 2
sub rdx, rbp
jne 0x10000a1da
cmp rdx, rsi
je 0x10000abf7
mov word [rcx], si
call fcn.10000d700
cmp eax, esi
mov ebx, eax
jl 0x10000ac00
call fcn.10000d5c4
cmp eax, esi
mov ebx, eax
jl 0x10000ac59
call fcn.10000d2cc
cmp eax, esi
jne 0x10000a243
mov ecx, ebp
call fcn.10000d850
cmp eax, esi
mov ebx, eax
jl 0x10000acb2
lea r8, [rsp + 0x20]
lea rcx, [0x100076270]
xor edx, edx
call fcn.100009ad8
mov qword [0x10007f2f0], rax
cmp rax, rsi
je 0x10000ad03
mov rcx, qword [rax + 0x10]
call fcn.10000aaa4
cmp eax, esi
je 0x10000ad50
call fcn.10000b3a4
mov rcx, qword [0x100080ae0]
call fcn.100008ff0
mov dword [0x10007f22c], ebp
call fcn.10000b018
call fcn.10000bfd0
call fcn.10000adf0
call fcn.10000af00
call fcn.10000c428
call fcn.10000c4dc
call fcn.10000c190
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [0x100080514], esi
je 0x10000a2fd
mov al, byte [0x100080518]
cmp al, 4
jb 0x10000ada8
test qword [0x100080500], r14
je 0x10000a2fd
mov rdx, qword [0x100080508]
mov rcx, rdx
and rcx, r14
cmp rcx, rdx
jne 0x10000a2fd
mov rcx, qword [0x100080ad8]
lea rdx, [0x100075e78]
call fcn.100009c78
call fcn.10000af50
int3
cmp al, sil
je 0x10000a0ba
jmp 0x10000a0e8
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000a145
test byte [rcx + 0x1c], bpl
je 0x10000a145
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 9]
mov r9d, eax
mov r8, r13
call fcn.10001c0b4
jmp 0x10000a145
mov rax, qword [0x10007f250]
cmp rax, r12
je 0x10000ab3a
test byte [rax + 0x1c], bpl
je 0x10000ab3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10007f250]
lea edx, [r15 - 0x51]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c0b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000777b8]
xor r8d, r8d
mov edx, eax
call fcn.100033314
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000ab85
test byte [rcx + 0x1c], bpl
je 0x10000ab85
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, eax
mov r8, r13
call fcn.10001c0b4
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x1000777f8]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100033314
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x10007f250]
cmp rax, r12
je 0x10000abeb
test byte [rax + 0x1c], bpl
je 0x10000abeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10007f250]
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c0b4
mov word [0x10007fbb0], si
jmp 0x10000a20b
sub rcx, 2
jmp 0x10000a208
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000ac26
test byte [rcx + 0x1c], bpl
je 0x10000ac26
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r9d, eax
mov r8, r13
call fcn.10001c0b4
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x1000777d8]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100033314
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000ac7f
test byte [rcx + 0x1c], bpl
je 0x10000ac7f
mov rcx, qword [rcx + 0x10]
mov edx, 0xf
mov r9d, eax
mov r8, r13
call fcn.10001c0b4
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100077808]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100033314
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000acd8
test byte [rcx + 0x1c], bpl
je 0x10000acd8
mov rcx, qword [rcx + 0x10]
mov edx, 0x10
mov r9d, eax
mov r8, r13
call fcn.10001c0b4
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100077818]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100033314
nop
jmp 0x10000a243
mov rcx, qword [0x10007f250]
cmp rcx, r12
je 0x10000ad2b
test byte [rcx + 0x1c], bpl
je 0x10000ad2b
mov r9d, dword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
mov edx, 0x11
mov r8, r13
call fcn.10001c0b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000777c8]
xor r8d, r8d
mov edx, eax
call fcn.100033314
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x10007f250]
cmp rax, r12
je 0x10000ad83
test byte [rax + 0x1c], bpl
je 0x10000ad83
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10007f250]
mov edx, 0x12
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c0b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000777c8]
xor r8d, r8d
mov edx, eax
call fcn.100033314
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp al, sil
jne 0x10000a2fd
jmp 0x10000a2cf