Function at 0x1400435a0
Capabilities:
Get hostname
Rebuild import table

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rax, vtable.vncClient.0
mov qword [rcx], rax
add rcx, 0xc
xor edx, edx
mov r8d, 0x100
call fcn.140135010
lea rcx, [rsi + 0x268]
xor edx, edx
mov r8d, 0xff
call fcn.140135010
mov word [rsi + 0x3c9], 0x101
mov byte [rsi + 0x3cb], 1
xorps xmm0, xmm0
movups xmmword [rsi + 0x3ec], xmm0
xor ebp, ebp
mov dword [rsi + 0x4d0], ebp
mov qword [rsi + 0x400], rbp
mov qword [rsi + 0x410], rbp
mov qword [rsi + 0x408], rbp
mov qword [rsi + 0x4b0], rbp
mov qword [rsi + 0x3e0], rbp
mov dword [rsi + 0x3e8], ebp
mov dword [rsi + 0x3fc], ebp
mov byte [rsi + 0x428], bpl
mov qword [rsi + 0x430], rbp
mov byte [rsi + 0x438], bpl
mov byte [rsi + 0x4d4], bpl
mov qword [rsi + 0x440], rbp
mov qword [rsi + 0x448], rbp
mov byte [rsi + 0x450], bpl
mov qword [rsi + 0x458], rbp
mov byte [rsi + 0x460], bpl
mov qword [rsi + 0x468], rbp
mov byte [rsi + 0x418], bpl
mov qword [rsi + 0x420], rbp
mov dword [rsi + 0x470], 6
mov qword [rsi + 0x474], 0xffffffffffffffff
mov qword [rsi + 0x47c], 2
mov qword [rsi + 0x484], rbp
mov qword [rsi + 0x4a4], rbp
mov qword [rsi + 0x520], rbp
mov qword [rsi + 0x528], rbp
lea rcx, [rsi + 0x540]
call fcn.140026690
lea rax, vtable.vncClient::ClientUpdateTracker.0
mov qword [rsi + 0x540], rax
mov qword [rsi + 0x588], rbp
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rsi + 0x5a0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rsi + 0x598], rax
lea rdi, [rsi + 0x5b0]
mov qword [rsp + 0x48], rdi
mov byte [rdi], bpl
mov dword [rdi + 4], 0xa00000
mov dword [rdi + 8], 0x200000
mov qword [rdi + 0xc], 0x200000
mov dword [rdi + 0x14], 0xa00000
mov dword [rdi + 0x18], 0x200000
mov qword [rdi + 0x1c], 0x200000
mov eax, dword [0x1401c2fe0]
mov dword [rdi + 0x24], eax
mov qword [rdi + 0x28], 0x1300000f
mov qword [rdi + 0x30], rbp
mov qword [rdi + 0x40], rbp
mov qword [rdi + 0x48], setsockopt
mov byte [rdi + 0x30], bpl
mov word [rdi + 0x50], bp
mov dword [rdi + 0x54], ebp
mov qword [rdi + 0x58], rbp
mov dword [rdi + 0x60], ebp
mov qword [rdi + 0x68], rbp
mov qword [rdi + 0x70], rbp
mov r8b, 1
lea edx, [rbp + 4]
lea rcx, [rdi + 0x58]
call fcn.1400153c0
add qword [rdi + 0x68], 4
mov qword [rdi + 0x78], rbp
mov dword [rdi + 0x80], ebp
mov qword [rdi + 0x88], rbp
mov qword [rdi + 0x90], rbp
mov r8b, 1
lea edx, [rbp + 4]
lea rcx, [rdi + 0x78]
call fcn.1400153c0
add qword [rdi + 0x88], 4
mov qword [rsi + 0x840], rbp
mov qword [rsi + 0x848], rbp
lea rbx, [rsi + 0x998]
mov qword [rsp + 0x48], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
lea rcx, str.USER32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 8], rax
test rax, rax
je 0x140043812
lea rdx, [0x1401ca6c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
mov qword [rsi + 0x9a8], rbp
mov qword [rsi + 0x9b8], rbp
mov qword [rsi + 0x9c0], 0xf
mov byte [rsi + 0x9a8], 0
lea r8, [0x1401ca6d0]
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov qword [rsi + 0x110], rbp
mov qword [rsi + 0x3b0], rbp
mov qword [rsi + 0x4f0], rbp
mov qword [rsi + 0x4f8], rbp
mov qword [rsi + 0x4e8], rbp
mov dword [rsi + 0x530], ebp
mov byte [rsi + 0x535], 0
mov dword [rsi + 0x536], ebp
mov qword [rsi + 0x500], rbp
mov qword [rsi + 0x5a8], rbp
mov qword [rsi + 0x590], rbp
mov qword [rsi + 0x588], rsi
mov dword [rsi + 0x51c], 1
mov qword [rsi + 0x648], rbp
mov qword [rsi + 0x650], rbp
mov qword [rsi + 0x380], rbp
mov qword [rsi + 0x388], rbp
mov word [rsi + 0x858], 0
mov byte [rsi + 0x85a], 0
mov dword [rsi + 0x67c], ebp
mov ecx, 0xe8
call fcn.140132648
mov qword [rsp + 0x48], rax
lea rcx, vtable.CZipUnZip32.0
mov qword [rax], rcx
mov qword [rax + 0x44], rbp
mov qword [rax + 0x4c], 1
mov qword [rax + 0x54], rbp
mov dword [rax + 0x64], ebp
mov qword [rax + 0x68], 1
mov qword [rax + 0x70], rbp
mov qword [rax + 0x78], rbp
mov qword [rax + 0x80], rbp
mov qword [rax + 0x88], rbp
mov qword [rax + 0x90], rbp
mov qword [rax + 0x98], rbp
mov qword [rax + 0xa8], 1
mov qword [rax + 0x28], rbp
mov qword [rax + 0x5c], rbp
mov byte [rax + 0xb0], gethostbyname
mov qword [rax + 0xa0], rbp
mov qword [rsi + 0x680], rax
mov qword [rsi + 0x7f0], rbp
mov qword [rsi + 0x7f8], rbp
mov qword [rsi + 0x800], rbp
mov dword [rsi + 0x808], ebp
mov word [rsi + 0x80c], 0
mov byte [rsi + 0x80f], 0
mov qword [rsi + 0x810], 0xffffffffffffffff
mov byte [rsi + 0x818], 0
mov qword [rsi + 0x81c], rbp
mov dword [rsi + 0x824], ebp
mov word [rsi + 0x828], 0
mov byte [rsi + 0x82a], 0
mov qword [rsi + 0x830], rbp
mov qword [rsi + 0x838], rbp
mov qword [rsi + 0x664], rbp
mov qword [rsi + 0x66c], rbp
mov qword [rsi + 0x674], rbp
mov qword [rsi + 0x990], rbp
mov qword [rsi + 0x870], rbp
mov dword [rsi + 0x878], ebp
mov qword [rsi + 0x860], rbp
mov dword [rsi + 0x868], ebp
mov byte [rsi + 0x889], 0
mov ecx, WSACleanup
call fcn.140132648
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rax, vtable.TextChat.0
mov qword [rbx], rax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 8], rsi
mov byte [rbx + 0x20], 0
mov byte [rbx + 0x60], 0
mov ecx, 0x4000
call fcn.14013268c
mov qword [rbx + 0x28], rax
xor edx, edx
mov r8d, 0x4000
mov rcx, rax
call fcn.140135010
mov ecx, 0x4000
call fcn.14013268c
mov qword [rbx + 0x30], rax
xor edx, edx
mov r8d, 0x4000
mov rcx, rax
call fcn.140135010
mov ecx, 0x4000
call fcn.14013268c
mov qword [rbx + 0x38], rax
xor edx, edx
mov r8d, 0x4000
mov rcx, rax
call fcn.140135010
mov ecx, 0x80
call fcn.14013268c
mov qword [rbx + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov ecx, 0x80
call fcn.14013268c
mov qword [rbx + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov ecx, 0x4000
call fcn.14013268c
mov qword [rbx + 0x50], rax
xor edx, edx
mov r8d, 0x4000
mov rcx, rax
call fcn.140135010
mov dword [rsp + 0x48], 0x80
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x140043b46
cmp dword [rsp + 0x48], 0x80
jb 0x140043b46
mov rax, qword [rbx + 0x48]
mov byte [rax + 0x7c], 0x2e
mov rax, qword [rbx + 0x48]
mov byte [rax + 0x7d], 0x2e
mov rax, qword [rbx + 0x48]
mov byte [rax + 0x7e], 0x2e
mov rax, qword [rbx + 0x48]
mov byte [rax + 0x7f], 0
lea rcx, str.RICHED32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x58], rax
test rax, rax
jne 0x140043b73
lea r9d, [rax + 0x30]
lea r8, [0x1401fb6e0]
lea rdx, [0x1401fb6a0]
call fcn.140020f00
mov qword [rbx + 0x68], 0xffffffffffffffff
mov qword [rsi + 0x880], rbx
mov byte [rsi + 0x888], 1
mov byte [rsi + 0x3c8], 0
mov dword [rsi + 0x394], ebp
mov dword [rsi + 0x3a8], ebp
mov word [rsi + 0x3ac], 0
mov dword [rsi + 0x9c8], 0
mov word [rsi + 0x9cc], 0
mov byte [rsi + 0x80e], 0
mov qword [rsi + 0x7e0], rbp
mov qword [rsi + 0x7e8], rbp
mov qword [rsi + 0x658], rbp
mov dword [rsi + 0x660], ebp
mov qword [rsi + 0x508], rbp
mov qword [rsi + 0x510], rbp
mov dword [rsi + 0x518], ebp
mov byte [rsi + 0x378], 0
mov dword [rsi + 0x854], 1
mov dword [rsi + 8], ebp
mov qword [rsi + 0x260], rbp
mov byte [rsi + 0x3ae], 0
mov word [rsi + 0x4d8], 0x100
mov byte [rsi + 0x4da], 1
mov byte [rsi + 0x3b8], 0
mov qword [rsi + 0x3c0], rbp
mov byte [rsi + 0x10c], 0
mov qword [rsi + 0x368], rbp
mov rax, rsi
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret