Function at 0x140082d58
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
movaps xmmword [rsp + 0x290], xmm6
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x288], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rdi
movaps xmm6, xmmword [0x1401940a0]
movups xmmword [rcx], xmm6
cmp byte [rdx + 0x17], 0
js 0x140082db6
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
jmp 0x140082dc8
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rsi
mov rdx, rax
call fcn.140050bae
movzx eax, byte [rsi + 0x17]
test al, al
js 0x140082dfb
test rax, rax
je 0x140083407
cmp eax, 1
je 0x140082e8d
movzx ecx, word [rsi]
cmp ecx, 0x22
je 0x140082e66
cmp ecx, 0x27
jne 0x140082e8d
mov rdx, rsi
mov rcx, rax
jmp 0x140082e41
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140083407
cmp rdx, 1
je 0x140082e8d
mov rcx, qword [rsi]
cmp word [rcx], 0x22
jne 0x140082e2b
cmp word [rcx + rdx*2 - 2], 0x22
je 0x140082e49
test al, al
js 0x140082e2b
cmp cx, 0x27
je 0x140082df3
jmp 0x140082e8d
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14008388d
mov rdx, qword [rsi]
cmp word [rdx], 0x27
jne 0x140082e8d
cmp word [rdx + rcx*2 - 2], 0x27
jne 0x140082e8d
test al, al
jns 0x140082e6e
mov rax, qword [rsi + 8]
test rax, rax
je 0x140083890
dec rax
mov rcx, qword [rsi]
mov qword [rsi + 8], rax
jmp 0x140082e77
cmp word [rsi + rax*2 - 2], 0x22
jne 0x140082e8d
dec rax
mov byte [rsi + 0x17], al
mov rcx, rsi
mov word [rcx + rax*2], 0
mov r8d, 1
mov rcx, rsi
xor edx, edx
call fcn.140051322
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x38], rdi
test rax, rax
je 0x140082ebc
lea rdx, [0x1401a457f]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rbx
xor r14d, r14d
lea r15, [rsp + 0x80]
mov rbx, r14
shl rbx, 4
lea rax, str._windows
mov rbp, qword [rbx + rax]
test rbp, rbp
je 0x140083884
mov rcx, rbp
call fcn.14016c344
movzx edx, byte [rsi + 0x17]
mov rcx, rsi
test dl, dl
jns 0x140082efd
mov rcx, qword [rsi]
test rax, rax
je 0x140082fa7
test dl, dl
jns 0x140082f0e
mov rdx, qword [rsi + 8]
cmp rdx, rax
jl 0x140083127
lea r8, [rcx + rdx*2]
movzx r9d, word [rbp]
lea r10, [rcx + rdx*2]
add r10, 0xfffffffffffffffe
mov r11, rcx
mov r12, rdx
sub r12, rax
inc r12
je 0x140083127
inc rdx
xor r12d, r12d
cmp word [r11 + r12], r9w
je 0x140082f58
add r12, 2
dec rdx
cmp rax, rdx
jne 0x140082f40
jmp 0x140083127
mov r13, r11
add r13, r12
je 0x140083127
xor edx, edx
movzx edi, word [r13 + rdx*2]
cmp di, word [rbp + rdx*2]
jne 0x140082f80
inc rdx
cmp rax, rdx
jne 0x140082f66
jmp 0x140083069
mov rdx, r10
sub rdx, r11
add r11, r12
add r11, 2
sub rdx, r12
sar rdx, 1
cmp rdx, rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
jge 0x140082f2b
jmp 0x140083127
xor r13d, r13d
lea rax, str._windows
add rbx, rax
mov rcx, rbp
call fcn.14016c344
mov rbp, rax
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.14014ead0
mov r8d, dword [rbx + 8]
xor ecx, ecx
mov rdx, r15
xor r9d, r9d
mov rax, qword [rsp + 0x38]
call qword [0x1401b4100]
test eax, eax
jne 0x140082ff4
mov word [rsp + 0x80], 0
mov qword [rsp + 0x70], rdi
movaps xmmword [rsp + 0x60], xmm6
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov rdx, r15
call fcn.140027700
mov al, byte [rsp + 0x77]
movzx ecx, al
test cl, cl
js 0x140083025
test al, al
je 0x140083062
mov r8, rbx
mov rdx, rcx
jmp 0x140083038
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x1400830ef
mov r8, qword [rsp + 0x60]
cmp word [r8 + rdx*2 - 2], 0x5c
jne 0x1400830ef
movzx r8d, byte [rsi + 0x17]
mov rdx, rbp
add rdx, r13
test r8b, r8b
js 0x140083094
mov r9, r8
cmp rdx, r8
jb 0x14008309d
jmp 0x1400830ef
xor eax, eax
jmp 0x1400830ef
cmp r13, r8
movabs rdi, 0xaaaaaaaaaaaaaaaa
je 0x140083127
sub r13, rcx
mov rax, r13
add rax, 2
je 0x140083127
sar r13, 1
jmp 0x140082faa
mov r9, qword [rsi + 8]
cmp r9, rdx
jbe 0x1400830ef
cmp r9, rdx
jb 0x140083887
mov r9, rsi
test r8b, r8b
jns 0x1400830b1
mov r9, qword [rsi]
cmp word [r9 + rdx*2], 0x5c
jne 0x1400830ef
test al, al
js 0x1400830ca
lea rax, [rcx - 1]
mov byte [rsp + 0x77], al
mov rcx, rbx
jmp 0x1400830e5
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x14008388a
dec rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov word [rcx + rax*2], 0
mov al, byte [rsp + 0x77]
test al, al
movzx eax, al
cmovs rax, qword [rsp + 0x68]
mov r9, qword [rsp + 0x60]
cmovns r9, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, r13
mov r8, rbp
call fcn.1400507f4
cmp byte [rsp + 0x77], 0
jns 0x140083127
mov rcx, qword [rsp + 0x60]
call fcn.14014b4e4
inc r14
cmp r14, 7
jne 0x140082ecc
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x14008315b
lea rdx, [0x1401a4622]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14008315e
mov rax, rdi
mov dl, byte [rsi + 0x17]
test dl, dl
mov r12, qword [rsi]
mov r8, qword [rsi + 8]
mov r9, rsi
cmovs r9, r12
movzx ecx, dl
mov r13, rcx
cmovs r13, r8
cmp r13, 0xc
jl 0x14008321a
lea r10, [r9 + r13*2]
lea r11, [r9 + r13*2]
add r11, 0xfffffffffffffffe
mov qword [rsp + 0x38], r11
lea rdi, str._user_name
mov rbx, r9
add r13, 0xfffffffffffffff5
xor ebp, ebp
cmp word [rbx + rbp], 0x24
je 0x1400831b8
add rbp, 2
dec r13
jne 0x1400831a6
jmp 0x140083210
mov r13, rbx
add r13, rbp
je 0x140083210
mov r11, r10
mov qword [rsp + 0x30], rax
mov rax, r14
xor r14d, r14d
movzx r10d, word [r13 + r14]
cmp r10w, word [r14 + rdi]
jne 0x1400831ea
add r14, 2
cmp r14, 0x18
jne 0x1400831ce
jmp 0x1400834b6
mov r13, qword [rsp + 0x38]
sub r13, rbx
add rbx, rbp
add rbx, 2
sub r13, rbp
sar r13, 1
cmp r13, 0xc
mov r14, rax
mov rax, qword [rsp + 0x30]
mov r10, r11
jge 0x1400831a0
movabs rdi, 0xaaaaaaaaaaaaaaaa
test dl, dl
cmovns r12, rsi
cmovs rcx, r8
cmp rcx, 0xf
jge 0x14008325d
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x1400832da
lea rdx, [0x1401a4692]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
jmp 0x1400832df
lea rdx, [r12 + rcx*2]
lea r8, [r12 + rcx*2]
add r8, 0xfffffffffffffffe
lea r9, str._machine_name
mov r10, r12
add rcx, 0xfffffffffffffff2
xor r11d, r11d
cmp word [r10 + r11], 0x24
je 0x14008328d
add r11, 2
dec rcx
jne 0x14008327a
jmp 0x14008322a
mov r15, r10
add r15, r11
je 0x14008322a
xor ecx, ecx
movzx edi, word [r15 + rcx]
cmp di, word [rcx + r9]
jne 0x1400832b2
add rcx, 2
cmp rcx, 0x1e
jne 0x140083297
jmp 0x1400835b6
mov rcx, r8
sub rcx, r10
add r10, r11
add r10, 2
sub rcx, r11
sar rcx, 1
cmp rcx, 0xf
movabs rdi, 0xaaaaaaaaaaaaaaaa
jge 0x140083273
jmp 0x14008322a
mov qword [rsp + 0x38], rdi
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x140083307
lea rdx, [0x1401a46ca]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov dl, byte [rsi + 0x17]
test dl, dl
mov rax, qword [rsi]
mov r8, qword [rsi + 8]
mov r9, rsi
cmovs r9, rax
movzx ecx, dl
mov r13, rcx
cmovs r13, r8
cmp r13, 0xe
jl 0x1400833bd
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rdi
lea r15, [r9 + r13*2]
lea r11, [r9 + r13*2]
add r11, 0xfffffffffffffffe
lea rdi, str._client_name
mov rbx, r9
add r13, 0xfffffffffffffff3
xor r14d, r14d
cmp word [rbx + r14], 0x24
je 0x14008336d
add r14, 2
dec r13
jne 0x14008335a
jmp 0x1400833ae
mov rbp, rbx
add rbp, r14
je 0x1400833ae
xor r13d, r13d
movzx r10d, word [rbp + r13]
cmp r10w, word [r13 + rdi]
jne 0x140083395
add r13, 2
cmp r13, 0x1c
jne 0x140083378
jmp 0x1400836a9
mov r13, r11
sub r13, rbx
add rbx, r14
add rbx, 2
sub r13, r14
sar r13, 1
cmp r13, 0xe
jge 0x140083353
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x30]
test dl, dl
cmovns rax, rsi
cmovs rcx, r8
cmp rcx, 0xf
jge 0x140083436
test r12, r12
je 0x1400833db
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x1400833e9
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x1400833f7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140083407
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.14014c9b0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rax + rcx*2]
lea r8, [rax + rcx*2]
add r8, 0xfffffffffffffffe
lea r9, str._session_name
mov r10, rax
add rcx, 0xfffffffffffffff2
xor r11d, r11d
cmp word [r10 + r11], 0x24
je 0x140083469
add r11, 2
dec rcx
jne 0x140083453
jmp 0x1400833cd
mov rbp, r10
add rbp, r11
je 0x1400833cd
mov rbx, rdi
xor ecx, ecx
movzx edi, word [rbp + rcx]
cmp di, word [rcx + r9]
jne 0x140083495
add rcx, 2
cmp rcx, 0x1e
jne 0x14008347a
jmp 0x1400837a1
mov rcx, r8
sub rcx, r10
add r10, r11
add r10, 2
sub rcx, r11
sar rcx, 1
cmp rcx, 0xf
mov rdi, rbx
jge 0x14008344c
jmp 0x1400833cd
cmp r13, r11
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov r14, rax
je 0x14008321a
sub r13, r9
mov r9, r13
add r9, 2
je 0x14008321a
lea rbp, [rsp + 0x60]
mov dword [rbp], 0
xor ecx, ecx
mov rdx, rbp
mov rbx, qword [rsp + 0x30]
mov rax, rbx
call qword [0x1401b4100]
mov ecx, dword [rbp]
test rcx, rcx
je 0x1400835a4
sar r13, 1
add rcx, rcx
call fcn.14014b51c
mov rbp, rax
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rax, rbx
call qword [0x1401b4100]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
movaps xmmword [rsp + 0x80], xmm6
mov rcx, r15
mov rdx, rbp
call fcn.140027700
movzx eax, byte [rsp + 0x97]
test al, al
jns 0x140083567
mov rax, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, 0xc
mov rcx, rsi
mov rdx, r13
mov r9, r15
call fcn.1400507f4
cmp byte [rsp + 0x97], 0
jns 0x140083597
mov rcx, qword [rsp + 0x80]
call fcn.14014b4e4
test rbp, rbp
je 0x1400835a4
mov rcx, rbp
call fcn.14014b524
mov dl, byte [rsi + 0x17]
mov r12, qword [rsi]
mov r8, qword [rsi + 8]
movzx ecx, dl
jmp 0x14008321a
cmp r15, rdx
movabs rdi, 0xaaaaaaaaaaaaaaaa
je 0x14008322a
sub r15, r12
mov rax, r15
add rax, 2
je 0x14008322a
lea r12, [rsp + 0x60]
mov dword [r12], 0
mov ecx, 5
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [r12]
test rcx, rcx
je 0x14008322a
sar r15, 1
add rcx, rcx
call fcn.14014b51c
mov r12, rax
lea r8, [rsp + 0x60]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x80]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rcx, r13
mov rdx, r12
call fcn.140027700
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x140083663
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, rsi
mov rdx, r15
mov r9, r13
call fcn.1400507f4
cmp byte [rsp + 0x97], 0
jns 0x140083693
mov rcx, qword [rsp + 0x80]
call fcn.14014b4e4
test r12, r12
je 0x14008322a
mov rcx, r12
call fcn.14014b524
jmp 0x14008322a
cmp rbp, r15
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
je 0x1400833b8
sub rbp, r9
mov r9, rbp
add r9, 2
mov r15, qword [rsp + 0x30]
je 0x1400833bd
lea r9, [rsp + 0x60]
mov qword [r9], 0
lea rax, [rsp + 0x5c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
mov rax, qword [rsp + 0x38]
call qword [0x1401b4100]
test eax, eax
je 0x14008378f
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x80]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.140027700
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x140083751
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, 0xe
mov rcx, rsi
mov rdx, rbp
mov r9, r13
call fcn.1400507f4
mov rcx, qword [rsp + 0x60]
mov rax, rdi
call qword [0x1401b4100]
cmp byte [rsp + 0x97], 0
jns 0x14008378f
mov rcx, qword [rsp + 0x80]
call fcn.14014b4e4
mov dl, byte [rsi + 0x17]
mov rax, qword [rsi]
mov r8, qword [rsi + 8]
movzx ecx, dl
jmp 0x1400833bd
cmp rbp, rdx
je 0x1400833cd
sub rbp, rax
mov rax, rbp
add rax, 2
je 0x1400833cd
mov rdi, rbx
lea r9, [rsp + 0x60]
mov qword [r9], 0
lea rax, [rsp + 0x5c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
mov rax, qword [rsp + 0x38]
call qword [0x1401b4100]
test eax, eax
je 0x1400833cd
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x80]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.140027700
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x14008383d
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, rsi
mov rdx, rbp
mov r9, r13
call fcn.1400507f4
mov rcx, qword [rsp + 0x60]
mov rax, rdi
call qword [0x1401b4100]
cmp byte [rsp + 0x97], 0
jns 0x1400833cd
mov rcx, qword [rsp + 0x80]
call fcn.14014b4e4
jmp 0x1400833cd
int3
int3
int3
int3
int3