Function at 0x180004ec8
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
and dword [rax + 0x20], 0
mov rbx, rcx
lea rcx, [0x18001bcac]
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov r14d, 1
test eax, eax
jne 0x180004f0a
lea edx, [rax + 7]
jmp 0x180004f3e
mov rdx, rdi
lea rcx, [0x18001bcb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x180004f23
mov edx, r14d
jmp 0x180004f3e
mov rdx, rdi
lea rcx, [0x18001bcb4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x180005140
lea edx, [rax + 4]
or r12d, 0xffffffff
mov dword [rbx], edx
cmp edx, 7
jne 0x180004f58
and word [rbx + 0x308], 0
mov dword [rbx + 0x30c], r12d
sub edx, r14d
je 0x180005004
sub edx, 3
je 0x180004fb6
cmp edx, 3
jne 0x180005140
lea rcx, [rbx + 0x208]
mov edx, 0x100
lea r8, str.1433
sub r8, rcx
lea rax, [rdx + 0x7ffffefe]
test rax, rax
je 0x180004fa3
mov al, byte [r8 + rcx]
test al, al
je 0x180004fa3
mov byte [rcx], al
add rcx, r14
sub rdx, r14
jne 0x180004f85
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
jmp 0x180005134
lea rcx, [rbx + 0x208]
xor r8d, r8d
sub rsi, rcx
mov edx, 0x200
lea rax, [rdx + 0x7ffffdfe]
test rax, rax
je 0x180004fe5
mov al, byte [rsi + rcx]
test al, al
je 0x180004fe5
mov byte [rcx], al
add rcx, r14
sub rdx, r14
jne 0x180004fc8
test rdx, rdx
jne 0x180004ff3
sub rcx, r14
mov r8d, 0x8007007a
mov byte [rcx], 0
test r8d, r8d
js 0x180005140
jmp 0x180005134
lea r8, [rsp + 0x68]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180005140
mov ecx, eax
call fcn.180014580
mov rdi, rax
test rax, rax
je 0x180005140
mov ecx, dword [rsp + 0x68]
lea r8, [rsp + 0x68]
dec ecx
mov rdx, rax
mov byte [rcx + rax], 0
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x180005138
add rbx, 0x208
lea r8, [0x18001b954]
mov r15d, 0x105
mov rcx, rbx
mov edx, r15d
sub r8, rbx
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x180005091
mov al, byte [r8 + rcx]
test al, al
je 0x180005091
mov byte [rcx], al
add rcx, r14
sub rdx, r14
jne 0x180005073
test rdx, rdx
mov dword [rsp + 0x28], r12d
lea rax, [rcx - 1]
mov r9d, r12d
cmovne rax, rcx
lea r14, [0x1800238e0]
mov r8, rsi
mov qword [rsp + 0x20], r14
mov edx, 0x20001
mov ecx, 0x800
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x180005104
mov dword [rsp + 0x28], r12d
mov r9d, r12d
mov r8, r14
mov qword [rsp + 0x20], rdi
mov edx, 0x20001
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x180005104
lea r8, [0x18001b8f0]
mov rdx, r15
mov rcx, rbx
call fcn.180002988
jmp 0x180005116
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call fcn.180002988
test eax, eax
js 0x180005138
lea r8, str.PIPE_sqlquery
mov rdx, r15
mov rcx, rbx
call fcn.180002988
test eax, eax
js 0x180005138
mov rcx, rdi
call fcn.180014578
xor eax, eax
jmp 0x180005143
mov rcx, rdi
call fcn.180014578
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret