Function at 0x140009f60
Capabilities:
Get hostname
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x1d0
mov rbx, rcx
mov ecx, 0x18
call fcn.140028a64
xor esi, esi
mov rdi, rax
test rax, rax
jne 0x140009f8e
mov edi, esi
jmp 0x140009fca
mov ecx, 0x494
call fcn.140028a64
mov rbp, rax
test rax, rax
jne 0x140009fa5
mov rdi, rsi
jmp 0x140009fca
xor edx, edx
mov r8d, 0x494
mov rcx, rbp
call fcn.140022720
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov dword [rdi + 0x10], 0x494
mov dword [rdi + 0x14], 0x494
mov edx, dword [rdi + 0x10]
mov qword [rsp + 0x200], r14
mov qword [rsp + 0x210], r15
cmp edx, 0x94
jge 0x140009ff9
mov r15, rsi
mov rbp, rsi
mov r12, rsi
mov r13, rsi
mov r14, rsi
jmp 0x14000a0c8
mov rcx, qword [rdi + 8]
lea r8d, [rdx - 0x94]
mov dword [rdi + 0x10], r8d
mov r15, rcx
lea rax, [rcx + 0x94]
mov qword [rdi + 8], rax
cmp r8d, 0x100
jge 0x14000a030
mov rbp, rsi
mov r12, rsi
mov r13, rsi
mov r14, rsi
jmp 0x14000a0c8
mov rdx, rax
add r8d, 0xffffff00
add rax, 0x100
mov dword [rdi + 0x10], r8d
mov qword [rdi + 8], rax
mov rbp, rdx
cmp r8d, 0x100
jge 0x14000a05f
mov r12, rsi
mov r13, rsi
mov r14, rsi
jmp 0x14000a0c8
mov r9, rax
add r8d, 0xffffff00
add rax, 0x100
mov dword [rdi + 0x10], r8d
mov qword [rdi + 8], rax
mov r12, r9
cmp r8d, 0x100
jge 0x14000a08b
mov r13, rsi
mov r14, rsi
jmp 0x14000a0c8
add r8d, 0xffffff00
mov r13, rax
add rax, 0x100
mov dword [rdi + 0x10], r8d
mov qword [rdi + 8], rax
cmp r8d, 0x100
jge 0x14000a0b1
mov r14, rsi
jmp 0x14000a0c8
mov r14, rax
add rax, 0x100
mov qword [rdi + 8], rax
lea eax, [r8 - 0x100]
mov dword [rdi + 0x10], eax
lea rdx, [rsp + 0x208]
mov dword [rsp + 0x208], 0x100
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x208]
mov dword [rsp + 0x208], 0x100
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp dword [0x14005d048], 1
je 0x14000a12b
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
js 0x14000a3b8
mov dword [0x14005d048], 1
mov edx, 0x100
mov rcx, r14
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x14000a160
mov rcx, r14
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14000a160
cmp word [rax + 0x10], 2
jne 0x14000a160
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000a160
mov esi, dword [rcx]
mov r8d, 0x100
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000a191
mov edx, 0x5c
mov rcx, r14
call fcn.1400221e0
test rax, rax
je 0x14000a191
lea r14, [rax + 1]
cmp rax, 0xffffffffffffffff
jne 0x14000a198
lea r14, [0x14004becf]
mov rcx, r15
mov dword [r15], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
movsxd rax, dword [rbx + 8]
mov r8d, dword [r15 + 4]
mov dword [0x14005d450], r8d
lea edx, [rax + 1]
cmp edx, dword [rbx + 0xc]
jg 0x14000a1db
mov rcx, rax
mov dword [rbx + 8], edx
mov rax, qword [rbx]
mov byte [rcx + rax], r8b
lea ecx, [rdx - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
movsxd rax, dword [rbx + 8]
movzx r8d, byte [r15 + 8]
lea edx, [rax + 1]
cmp edx, dword [rbx + 0xc]
jg 0x14000a208
mov rcx, rax
mov dword [rbx + 8], edx
mov rax, qword [rbx]
mov byte [rcx + rax], r8b
lea ecx, [rdx - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
movzx ecx, word [r15 + 0xc]
call qword [sym.imp.WS2_32.dll_htons]
movsxd rcx, dword [rbx + 8]
lea r8d, [rcx + 2]
cmp r8d, dword [rbx + 0xc]
jg 0x14000a23f
mov rdx, rcx
mov dword [rbx + 8], r8d
mov rcx, qword [rbx]
mov word [rdx + rcx], ax
lea ecx, [r8 - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
shr rcx, 0x20
call qword [sym.imp.WS2_32.dll_htonl]
movsxd rcx, dword [rbx + 8]
lea r8d, [rcx + 4]
cmp r8d, dword [rbx + 0xc]
jg 0x14000a27b
mov rdx, rcx
mov dword [rbx + 8], r8d
mov rcx, qword [rbx]
mov dword [rdx + rcx], eax
lea ecx, [r8 - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call qword [sym.imp.WS2_32.dll_htonl]
movsxd rcx, dword [rbx + 8]
lea r8d, [rcx + 4]
cmp r8d, dword [rbx + 0xc]
jg 0x14000a2b2
mov rdx, rcx
mov dword [rbx + 8], r8d
mov rcx, qword [rbx]
mov dword [rdx + rcx], eax
lea ecx, [r8 - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call qword [sym.imp.WS2_32.dll_htonl]
movsxd rdx, dword [rbx + 8]
lea ecx, [rdx + 4]
cmp ecx, dword [rbx + 0xc]
jg 0x14000a2e6
mov r8, rdx
mov dword [rbx + 8], ecx
mov rdx, qword [rbx]
add ecx, 0xfffffff8
mov dword [r8 + rdx], eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov rdx, qword [rbx]
mov dword [rdx + 4], eax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htonl]
movsxd rcx, dword [rbx + 8]
lea r10d, [rcx + 4]
cmp r10d, dword [rbx + 0xc]
jg 0x14000a31a
mov r8, rcx
mov dword [rbx + 8], r10d
mov rcx, qword [rbx]
mov dword [r8 + rcx], eax
lea ecx, [r10 - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
mov qword [rsp + 0x28], r14
lea r8, str._s_t_s_t_s
mov r9, r12
mov qword [rsp + 0x20], r13
mov edx, 0x100
mov rcx, rbp
call fcn.140001df0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + rbp], 0
jne 0x14000a342
mov ecx, 0x3a
cmp eax, ecx
cmovg eax, ecx
movsxd rcx, dword [rbx + 8]
lea esi, [rcx + rax]
cmp esi, dword [rbx + 0xc]
jg 0x14000a381
add rcx, qword [rbx]
mov rdx, rbp
movsxd r8, eax
call fcn.140022ae0
lea ecx, [rsi - 8]
mov dword [rbx + 8], esi
call qword [sym.imp.WS2_32.dll_ntohl]
mov rdx, qword [rbx]
mov dword [rdx + 4], eax
mov rcx, qword [rdi]
call fcn.140028a50
mov rcx, rdi
call fcn.140028a50
mov r15, qword [rsp + 0x210]
mov r14, qword [rsp + 0x200]
mov rbx, qword [rsp + 0x218]
add rsp, 0x1d0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 1
call fcn.14002a76c
int3