Function at 0x140069a20
Capabilities:
Get common file path
Get hostname
Get user security identifier
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xbb0
mov rax, qword [0x1400e6470]
xor rax, rsp
mov qword [rsp + 0xba0], rax
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x7c], 0x104
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x68], 0x44
movzx eax, word [0x1400e878c]
mov word [rsp + 0x98], ax
lea rax, [rsp + 0x9a]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e
rep stosb byte [rdi], al
mov dword [rsp + 0x44], setsockopt
mov dword [rsp + 0x40], 0
call fcn.1400825b0
mov dword [rax], 0
call fcn.14006a100
test eax, eax
je 0x140069ad5
xor eax, eax
jmp 0x140069f38
cmp qword [rsp + 0xbc0], 0
je 0x140069b59
mov rcx, qword [rsp + 0xbc0]
call fcn.14008808c
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140069b25
call fcn.1400825b0
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
mov r8, qword [rsp + 0xbc0]
lea rdx, [0x1400e4f48]
lea rcx, str._s_failed_to_duplicate__s
call fcn.140002d00
jmp 0x140069f0a
lea rdx, [0x1400e4ef4]
mov rcx, qword [rsp + 0x48]
call fcn.140076de8
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x140069b59
mov eax, 0x5c
mov rcx, qword [rsp + 0x80]
mov word [rcx], ax
cmp qword [rsp + 0xbc8], 0
je 0x140069b81
mov r8, qword [rsp + 0xbc8]
lea rdx, [rsp + 0xe0]
mov ecx, 0x44
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
jmp 0x140069bec
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xe0]
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
test eax, eax
jne 0x140069bec
call fcn.1400825b0
mov dword [rax], 2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1400e4f78]
lea rcx, str._s:_LookupAccountName___failed:__d.
call fcn.140002df0
jmp 0x140069f0a
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xe0]
call sub.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW
test eax, eax
jne 0x140069c23
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.14006b380
mov dword [rsp + 0x6c], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x6c]
mov dword [rax], ecx
jmp 0x140069f0a
mov dword [rsp + 0x70], 0x101
mov dword [rsp + 0x44], setsockopt
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x360]
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountSidW]
test eax, eax
jne 0x140069cb2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.14006b380
mov dword [rsp + 0x74], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x74]
mov dword [rax], ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1400e4fb0]
lea rcx, str._s:_LookupAccountSid___failed:__d.
call fcn.140002df0
jmp 0x140069f0a
cmp dword [rsp + 0x40], 1
je 0x140069ce1
call fcn.1400825b0
mov dword [rax], 2
mov r8d, dword [rsp + 0x40]
lea rdx, str.get_passwd
lea rcx, str._s:_Invalid_account_type:__d.
call fcn.140002e50
jmp 0x140069f0a
mov dword [rsp + 0x78], setsockopt
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_GetComputerNameW]
test eax, eax
jne 0x140069d05
jmp 0x140069f0a
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x98]
call fcn.140084c64
test eax, eax
jne 0x140069d3a
lea r8, [rsp + 0x360]
mov edx, 0x111
lea rcx, [rsp + 0x130]
call fcn.1400855d4
jmp 0x140069d68
lea rax, [rsp + 0x360]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
lea r8, str._s_s
mov edx, 0x111
lea rcx, [rsp + 0x130]
call fcn.140054bc0
mov r9, qword [rsp + 0x58]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList_ls
mov edx, 0x104
lea rcx, [rsp + 0x990]
call fcn.140054bc0
cmp eax, 0xffffffff
je 0x140069e28
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20101
xor r8d, r8d
lea rdx, [rsp + 0x990]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140069e28
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x570]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProfileImagePath
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140069e28
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x570]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
cmp eax, 0x104
ja 0x140069e28
mov r8d, 0x104
lea rdx, [rsp + 0x780]
lea rcx, [rsp + 0x570]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140069e63
mov edx, 0x104
lea rcx, [rsp + 0x780]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140069e63
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400e50d8]
call fcn.140002e50
call fcn.1400825b0
mov dword [rax], 0x83
jmp 0x140069f0a
lea rax, [rsp + 0x130]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
inc qword [rsp + 0x50]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
cmp word [rax + rcx*2], 0
jne 0x140069e7c
mov rax, qword [rsp + 0x50]
inc rax
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140085578
lea rcx, [rsp + 0x130]
call fcn.14005f390
mov qword [0x1400e8790], rax
cmp qword [0x1400e8790], 0
je 0x140069ee9
lea rcx, [rsp + 0x780]
call fcn.14005f390
mov qword [0x1400e87b0], rax
cmp qword [0x1400e87b0], 0
jne 0x140069efb
call fcn.1400699d0
call fcn.1400825b0
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
jmp 0x140069f0a
lea rax, [0x1400e8790]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x58], 0
je 0x140069f1d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
cmp qword [rsp + 0x60], 0
je 0x140069f30
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xba0]
xor rcx, rsp
call fcn.140075860
add rsp, 0xbb0
pop rdi
ret