Function at 0x14000ef30
Capabilities:
Get hostname
Get user security identifier

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x17], rax
movzx eax, word [0x14005c404]
lea r9, [rbp - 0x39]
mov word [rbp - 0x29], ax
xor edi, edi
xor eax, eax
mov dword [rbp - 0x39], edi
mov qword [rbp - 0x17], rax
mov r13, rdx
mov dword [rbp - 0xf], eax
mov r12, r8
mov word [rbp - 0xb], ax
mov rsi, rcx
lea rax, [rbp - 0x35]
mov dword [rbp - 0x31], setsockopt
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
lea rax, [rbp - 0x31]
mov rdx, rcx
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x29]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r15d, edi
movups xmmword [rbp - 0x27], xmm0
mov r14d, edi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov eax, dword [rbp - 0x39]
test eax, eax
jne 0x14000f02e
lea rdx, str.administrators
mov rcx, rsi
call fcn.14003e674
test eax, eax
jne 0x14000f02b
lea r9, [rbp - 0x39]
xor r8d, r8d
xor edx, edx
mov ecx, 0x1a
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov r14d, 1
lea rax, str.resolveAsAdminsSid:_d
mov dword [rsp + 0x38], r14d
lea rdx, str.lookup_sid
mov qword [rsp + 0x30], rax
lea rcx, str.C:__w1_scontribwin32win32compatmisc.c
mov qword [rsp + 0x28], rdi
mov r9d, r14d
mov r8d, 0x66f
mov dword [rsp + 0x20], 7
call fcn.14001ae20
mov eax, dword [rbp - 0x39]
mov qword [rsp + 0x108], rbx
test eax, eax
jne 0x14000f0f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xe
jg 0x14000f08a
je 0x14000f076
mov ecx, eax
sub ecx, 1
je 0x14000f0dc
sub ecx, 1
je 0x14000f0b4
sub ecx, 1
je 0x14000f0b4
cmp ecx, 2
je 0x14000f0a0
call fcn.14003d440
mov dword [rax], ebx
mov rax, rdi
jmp 0x14000f458
mov ebx, 0xc
call fcn.14003d440
mov dword [rax], ebx
mov rax, rdi
jmp 0x14000f458
cmp eax, 0x32
je 0x14000f0dc
cmp eax, 0x50
je 0x14000f0c8
cmp eax, 0x7b
je 0x14000f0b4
cmp eax, 0x522
jne 0x14000f0e1
mov ebx, 0xd
call fcn.14003d440
mov dword [rax], ebx
mov rax, rdi
jmp 0x14000f458
mov ebx, 2
call fcn.14003d440
mov dword [rax], ebx
mov rax, rdi
jmp 0x14000f458
mov ebx, setsockopt
call fcn.14003d440
mov dword [rax], ebx
mov rax, rdi
jmp 0x14000f458
mov ebx, 0x82
call fcn.14003d440
mov dword [rax], ebx
mov rax, rdi
jmp 0x14000f458
mov rbx, r13
test r13, r13
jne 0x14000f155
mov ecx, eax
call fcn.14003d014
mov r15, rax
test rax, rax
jne 0x14000f152
call fcn.14003d440
mov r9d, 1
lea rdx, str.lookup_sid
mov r8d, 0x67b
lea rcx, str.C:__w1_scontribwin32win32compatmisc.c
mov dword [rax], 0xc
lea rax, str.Failed_to_allocate_memory
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
call fcn.14001ae20
mov rax, rdi
jmp 0x14000f458
mov rbx, rax
lea r9, [rbp - 0x39]
mov r8, rbx
test r14d, r14d
je 0x14000f170
xor edx, edx
mov ecx, 0x1a
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
jmp 0x14000f196
lea rax, [rbp - 0x35]
mov rdx, rsi
mov qword [rsp + 0x30], rax
xor ecx, ecx
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x14000f270
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov ebx, 2
mov qword [rsp + 0x38], rsi
lea rdx, str.lookup_sid
lea rax, str.Failed_to_retrieve_SID_for_user:_S_error:_d
mov r9d, 1
mov qword [rsp + 0x30], rax
lea rcx, str.C:__w1_scontribwin32win32compatmisc.c
mov qword [rsp + 0x28], rdi
mov r8d, 0x687
mov dword [rsp + 0x20], ebx
call fcn.14001ae20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe
jg 0x14000f219
je 0x14000f208
mov edx, eax
sub edx, 1
je 0x14000f25f
sub edx, 1
je 0x14000f264
sub edx, 1
je 0x14000f264
cmp edx, ebx
jmp 0x14000f22d
mov ebx, 0xc
call fcn.14003d440
mov dword [rax], ebx
jmp 0x14000f433
cmp eax, 0x32
je 0x14000f25f
cmp eax, 0x50
je 0x14000f24e
cmp eax, 0x7b
je 0x14000f264
cmp eax, 0x522
je 0x14000f23d
mov ebx, eax
call fcn.14003d440
mov dword [rax], ebx
jmp 0x14000f433
mov ebx, 0xd
call fcn.14003d440
mov dword [rax], ebx
jmp 0x14000f433
mov ebx, setsockopt
call fcn.14003d440
mov dword [rax], ebx
jmp 0x14000f433
mov ebx, 0x82
call fcn.14003d440
mov dword [rax], ebx
jmp 0x14000f433
cmp dword [rbp - 0x35], 3
jne 0x14000f449
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x2d], setsockopt
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x14000f2da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
mov r9d, 1
mov r8d, 0x693
lea rdx, str.lookup_sid
lea rax, str.GetComputerNameW___failed_with_error:_d
mov qword [rsp + 0x30], rax
lea rcx, str.C:__w1_scontribwin32win32compatmisc.c
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
call fcn.14001ae20
jmp 0x14000f433
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.14003e674
test eax, eax
je 0x14000f33b
call fcn.14003d440
mov qword [rsp + 0x40], rsi
lea rdx, str.lookup_sid
mov ebx, 2
lea rcx, str.C:__w1_scontribwin32win32compatmisc.c
mov r9d, 1
mov r8d, 0x699
mov dword [rax], ebx
mov eax, dword [rbp - 0x35]
mov dword [rsp + 0x38], eax
lea rax, str.Invalid_account_type:__d_for_user:_S
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebx
call fcn.14001ae20
jmp 0x14000f433
lea rax, str.local_user_name_is_same_as_machine_name
mov r9d, 1
mov qword [rsp + 0x30], rax
lea rdx, str.lookup_sid
mov qword [rsp + 0x28], rdi
lea rcx, str.C:__w1_scontribwin32win32compatmisc.c
mov r8d, 0x69d
mov dword [rsp + 0x20], 7
call fcn.14001ae20
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rsi + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x14000f380
lea r14, [rax*2 + 2]
lea rcx, [r14 + r14]
call fcn.14003d014
mov rbx, rax
test rax, rax
jne 0x14000f3e9
call fcn.14003d440
mov r9d, 1
lea rdx, str.lookup_sid
mov r8d, 0x6a3
lea rcx, str.C:__w1_scontribwin32win32compatmisc.c
mov dword [rax], 0xc
lea rax, str.Failed_to_allocate_memory
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
call fcn.14001ae20
jmp 0x14000f433
mov r8, rsi
mov word [rax], di
mov rdx, r14
mov rcx, rbx
call fcn.14003edc8
lea r8, [0x14005d008]
mov rdx, r14
mov rcx, rbx
call fcn.14003edc8
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.14003edc8
mov r8, r12
mov rdx, r13
mov rcx, rbx
call fcn.14000ef30
mov rdi, rax
mov rcx, rbx
call fcn.14003d000
test r15, r15
je 0x14000f0e8
mov rcx, r15
call fcn.14003d000
mov rax, rdi
jmp 0x14000f458
test r12, r12
je 0x14000f455
mov ecx, dword [rbp - 0x39]
mov dword [r12], ecx
mov rax, rbx
mov rbx, qword [rsp + 0x108]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400313f0
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret