Function at 0x100009f34
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x100083218]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor esi, esi
mov rdi, rcx
movabs r14, 0x8001000000000001
mov dword [rsp + 0x20], esi
cmp dword [0x1000844c4], esi
je 0x100009fbc
mov al, byte [0x1000844c8]
cmp al, 4
jb 0x10000a999
test qword [0x1000844b0], r14
je 0x100009fbc
mov rcx, qword [0x1000844b8]
mov rax, rcx
and rax, r14
cmp rax, rcx
jne 0x100009fbc
mov rcx, qword [0x100084a88]
lea rdx, [0x1000793f8]
call fcn.100009bc0
mov rax, qword [rdi + 8]
mov qword [0x1000832b8], rax
mov rax, qword [rdi]
mov qword [0x100083260], rax
call fcn.10000dbb0
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x198
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebp, 1
lea r13, [0x100079408]
lea r12, [0x100083210]
cmp eax, esi
jne 0x10000a9a7
mov dword [0x1000831f0], ebp
call sym.spoolsv.exe_PrvSplIsUpgrade
mov r15d, 0x5c
lea rdx, [rsp + 0x24]
lea rcx, [0x100083a5c]
mov word [0x100083a5a], r15w
mov word [0x100083a58], r15w
mov dword [rsp + 0x24], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, esi
je 0x10000a9d8
call fcn.10000d1d8
mov ecx, eax
call fcn.10000d8a0
cmp eax, esi
mov ebx, eax
jl 0x10000aa2f
lea rdx, [0x100084ab0]
lea rcx, [0x100084ab8]
call sym.spoolsv.exe_PrvBuildOtherNamesFromMachineName
cmp eax, esi
je 0x10000aa88
mov rax, qword [0x100084ab8]
mov word [0x100083b60], r15w
mov word [0x100083b62], r15w
mov r8, qword [rax + 8]
mov edx, 0x102
lea rcx, [0x100083b64]
lea rax, [rdx + 0x7ffffefc]
cmp rax, rsi
je 0x10000a0d3
movzx eax, word [r8]
cmp ax, si
je 0x10000a0d3
mov word [rcx], ax
add r8, 2
add rcx, 2
sub rdx, rbp
jne 0x10000a0ae
cmp rdx, rsi
je 0x10000aac7
mov word [rcx], si
call fcn.10000d514
cmp eax, esi
mov ebx, eax
jl 0x10000aad0
call fcn.10000d3d8
cmp eax, esi
mov ebx, eax
jl 0x10000ab29
call fcn.10000d0e0
cmp eax, esi
jne 0x10000a117
mov ecx, ebp
call fcn.10000d630
cmp eax, esi
mov ebx, eax
jl 0x10000ab82
lea r8, [rsp + 0x20]
lea rcx, [0x100079460]
xor edx, edx
call fcn.100009a0c
mov qword [0x1000832b0], rax
cmp rax, rsi
je 0x10000abd3
mov rcx, qword [rax + 0x10]
call fcn.10000a974
cmp eax, esi
je 0x10000ac20
call fcn.10000b1e8
mov rcx, qword [0x100084a90]
call fcn.100008f30
mov dword [0x1000831ec], ebp
call fcn.10000af10
call fcn.10000be10
call fcn.10000acb4
call fcn.10000adc0
call fcn.10000c25c
call fcn.10000c308
call fcn.10000bfd0
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [0x1000844c4], esi
je 0x10000a1d1
mov al, byte [0x1000844c8]
cmp al, 4
jb 0x10000ac78
test qword [0x1000844b0], r14
je 0x10000a1d1
mov rdx, qword [0x1000844b8]
mov rcx, rdx
and rcx, r14
cmp rcx, rdx
jne 0x10000a1d1
mov rcx, qword [0x100084a88]
lea rdx, [0x100079068]
call fcn.100009bc0
call fcn.10000ae10
int3
cmp al, sil
je 0x100009f8e
jmp 0x100009fbc
mov rcx, qword [0x100083210]
cmp rcx, r12
je 0x10000a019
test byte [rcx + 0x1c], bpl
je 0x10000a019
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 9]
mov r9d, eax
mov r8, r13
call fcn.10001c48c
jmp 0x10000a019
mov rax, qword [0x100083210]
cmp rax, r12
je 0x10000aa0a
test byte [rax + 0x1c], bpl
je 0x10000aa0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100083210]
lea edx, [r15 - 0x51]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c48c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x10007a9a8]
xor r8d, r8d
mov edx, eax
call fcn.100035cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x100083210]
cmp rcx, r12
je 0x10000aa55
test byte [rcx + 0x1c], bpl
je 0x10000aa55
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, eax
mov r8, r13
call fcn.10001c48c
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x10007a9e8]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100035cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x100083210]
cmp rax, r12
je 0x10000aabb
test byte [rax + 0x1c], bpl
je 0x10000aabb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100083210]
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c48c
mov word [0x100083b60], si
jmp 0x10000a0df
sub rcx, 2
jmp 0x10000a0dc
mov rcx, qword [0x100083210]
cmp rcx, r12
je 0x10000aaf6
test byte [rcx + 0x1c], bpl
je 0x10000aaf6
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r9d, eax
mov r8, r13
call fcn.10001c48c
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x10007a9c8]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100035cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x100083210]
cmp rcx, r12
je 0x10000ab4f
test byte [rcx + 0x1c], bpl
je 0x10000ab4f
mov rcx, qword [rcx + 0x10]
mov edx, 0xf
mov r9d, eax
mov r8, r13
call fcn.10001c48c
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x10007a9f8]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100035cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x100083210]
cmp rcx, r12
je 0x10000aba8
test byte [rcx + 0x1c], bpl
je 0x10000aba8
mov rcx, qword [rcx + 0x10]
mov edx, 0x10
mov r9d, eax
mov r8, r13
call fcn.10001c48c
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x10007aa08]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100035cf8
nop
jmp 0x10000a117
mov rcx, qword [0x100083210]
cmp rcx, r12
je 0x10000abfb
test byte [rcx + 0x1c], bpl
je 0x10000abfb
mov r9d, dword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
mov edx, 0x11
mov r8, r13
call fcn.10001c48c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x10007a9b8]
xor r8d, r8d
mov edx, eax
call fcn.100035cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x100083210]
cmp rax, r12
je 0x10000ac53
test byte [rax + 0x1c], bpl
je 0x10000ac53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100083210]
mov edx, 0x12
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c48c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x10007a9b8]
xor r8d, r8d
mov edx, eax
call fcn.100035cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp al, sil
jne 0x10000a1d1
jmp 0x10000a1a3