Function at 0x1000dd110
Capabilities:
Get hostname

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov r12, rcx
lea r14, [0x100152eb8]
mov ebx, 5
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000dd166
test byte [rcx + 0x1c], 1
je 0x1000dd166
cmp byte [rcx + 0x19], bl
jb 0x1000dd166
lea edx, [rbx + 8]
mov r9, r12
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.100034814
xor r13d, r13d
cmp dword [r12 + 0x48], r13d
je 0x1000dd18c
mov edx, dword [r12 + 0x48]
cmp edx, r13d
je 0x1000dd18c
mov rcx, qword [0x100157a38]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov dword [r12 + 0x48], r13d
mov qword [rsp + 0xb0], r13
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1000262a0]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x100026290]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
mov ebp, 2
cmp eax, r13d
jge 0x1000dd21f
mov rdi, qword [0x100152eb8]
cmp rdi, r14
je 0x1000dd1fc
test byte [rdi + 0x1c], bpl
je 0x1000dd1fc
cmp byte [rdi + 0x19], bpl
jb 0x1000dd1fc
lea edx, [rbp + 0xc]
mov r9d, eax
lea r8, [0x10001dc88]
mov rcx, qword [rdi + 0x10]
call fcn.100036328
mov rdi, qword [0x100152eb8]
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x1000dd6f2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [0x100152eb8]
jmp 0x1000dd6f2
mov r8, qword [rsp + 0xb0]
lea rdx, [0x1000262a0]
lea rcx, [r12 + 0x48]
call fcn.100107dac
mov esi, eax
cmp eax, r13d
jge 0x1000dd25e
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x1000dd2b8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [0x100152eb8]
jmp 0x1000dd6f2
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000dd28a
test byte [rcx + 0x1c], bpl
je 0x1000dd28a
cmp byte [rcx + 0x19], bl
jb 0x1000dd28a
mov edx, 0xf
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.100034764
mov rcx, r12
call fcn.1000dd760
mov esi, eax
cmp eax, r13d
jge 0x1000dd2c4
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x1000dd2b8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [0x100152eb8]
jmp 0x1000dd6f2
mov rdi, qword [0x100152eb8]
jmp 0x1000dd6f2
lea rcx, [0x100151100]
mov rax, qword [0x100151100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xb8], rbx
mov r14d, 0x10
mov dword [rsp + 0xa0], r14d
lea ecx, [r14 - 0xf]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1000dd318
mov edx, r14d
lea rcx, [rsp + 0xb8]
call fcn.100036140
mov rbx, qword [rsp + 0xb8]
cmp dword [rbx - 0xc], r14d
jl 0x1000dd73d
mov dword [rbx - 0x10], r14d
mov word [rbx + 0x20], r13w
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
or r15, 0xffffffffffffffff
cmp eax, r13d
je 0x1000dd3c3
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, r13d
jl 0x1000dd3b8
cmp ecx, dword [rbx - 0xc]
jg 0x1000dd3b8
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r13w
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000dd42e
test byte [rcx + 0x1c], bpl
je 0x1000dd440
cmp byte [rcx + 0x19], 5
jb 0x1000dd437
mov edx, r14d
mov r9, rbx
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.100034788
lea r14, [0x100152eb8]
jmp 0x1000dd447
mov ecx, 0x80070057
call fcn.100036264
int3
cmp dword [rbx - 0xc], r13d
jl 0x1000dd732
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
cmp eax, r13d
cmovle esi, eax
mov ecx, 0x80004005
cmp esi, r13d
cmovge esi, ecx
mov rcx, qword [0x100152eb8]
lea r14, [0x100152eb8]
cmp rcx, r14
je 0x1000dd447
test byte [rcx + 0x1c], bpl
je 0x1000dd447
cmp byte [rcx + 0x19], bpl
jb 0x1000dd447
mov edx, 0x11
mov r9d, eax
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x1000dd447
lea r14, [0x100152eb8]
jmp 0x1000dd447
lea r14, [0x100152eb8]
jmp 0x1000dd447
lea r14, [0x100152eb8]
lea rcx, [rsp + 0xb8]
call fcn.100069790
lea rcx, [0x100151100]
mov rax, qword [0x100151100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xa8], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x105
sub eax, edi
or eax, ecx
jge 0x1000dd49e
mov edx, edi
lea rcx, [rsp + 0xa8]
call fcn.100036140
mov rbx, qword [rsp + 0xa8]
cmp dword [rbx - 0xc], edi
jl 0x1000dd727
mov dword [rbx - 0x10], edi
mov word [rbx + 0x20a], r13w
mov r8d, edi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, r13d
je 0x1000dd5a2
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, r13d
jl 0x1000dd597
cmp ecx, dword [rbx - 0xc]
jg 0x1000dd597
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], r13w
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbx + rcx*2]
cmp rax, rbx
je 0x1000dd51a
cmp word [rax], 0x5c
je 0x1000dd523
sub rax, rbp
cmp rax, rbx
jne 0x1000dd50c
cmp word [rax], 0x5c
je 0x1000dd523
mov rax, r13
cmp rax, r13
je 0x1000dd5a2
sub rax, rbx
sar rax, 1
cmp eax, r15d
je 0x1000dd5a2
mov r8d, dword [rbx - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xa8]
call fcn.100086af0
nop
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.100035ed8
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r13d
jg 0x1000dd58d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0xa8]
jmp 0x1000dd5a2
mov rbx, qword [rsp + 0xa8]
jmp 0x1000dd5a2
mov ecx, 0x80070057
call fcn.100036264
int3
lea rcx, [0x100151100]
mov rax, qword [0x100151100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov r9, qword [rsp + 0xb8]
mov r8, rbx
lea rdx, [0x100026228]
lea rcx, [rsp + 0x30]
call fcn.100039d9c
mov rdi, qword [rsp + 0x30]
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000dd611
test byte [rcx + 0x1c], bpl
je 0x1000dd618
mov ebx, 5
cmp byte [rcx + 0x19], bl
jb 0x1000dd61d
lea edx, [rbx + 0xd]
mov r9, rdi
lea r8, [0x10001dc88]
mov rcx, qword [rcx + 0x10]
call fcn.100034788
jmp 0x1000dd61d
mov ebx, 5
jmp 0x1000dd61d
mov ebx, 5
mov rcx, qword [r12 + 0x80]
cmp rdi, rcx
je 0x1000dd65e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp rdi, r13
je 0x1000dd656
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r12 + 0x80], rax
cmp rax, r13
jne 0x1000dd65e
mov ecx, 0x8007000e
call fcn.100036264
int3
mov qword [r12 + 0x80], r13
mov eax, 0x8007000e
cmp qword [r12 + 0x80], r13
cmove esi, eax
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r13d
jg 0x1000dd68c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r13d
jg 0x1000dd6b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r13d
jg 0x1000dd6d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x1000dd6eb
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [0x100152eb8]
cmp rdi, r14
je 0x1000dd723
test byte [rdi + 0x1c], 1
je 0x1000dd723
movzx eax, byte [rdi + 0x19]
cmp esi, r13d
cmovge ebp, ebx
cmp eax, ebp
jl 0x1000dd723
mov edx, 0x13
mov r9d, esi
lea r8, [0x10001dc88]
mov rcx, qword [rdi + 0x10]
call fcn.100036328
mov eax, esi
jmp 0x1000dd748
mov ecx, 0x80070057
call fcn.100036264
nop
mov ecx, 0x80070057
call fcn.100036264
int3
mov ecx, 0x80070057
call fcn.100036264
nop
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret