Function at 0x180013fb0
Capabilities:
Get hostname

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x9c], r9d
movzx eax, r8w
mov word [rsp + 0x90], ax
mov word [rsp + 0x92], dx
mov rsi, rcx
movzx ecx, word [rsp + 0x1a8]
mov word [rsp + 0x96], cx
movzx ecx, word [rsp + 0x1c8]
mov word [rsp + 0x94], cx
mov qword [rsp + 0x100], rsi
mov word [rsp + 0x9a], dx
mov word [rsp + 0x98], ax
mov dword [rsp + 0xc8], r9d
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0xf0], rax
xor r12d, r12d
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0xa8], r12d
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
mov dword [rsp + 0xc0], 0x10
xor edx, edx
lea r8d, [r12 + 0x20]
lea rcx, [rsp + 0x118]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea edx, [r12 + 0x10]
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNELBASE.dll_LocalAlloc]
mov r14, rax
mov qword [rsp + 0xf8], rax
test rax, rax
je 0x180022dc0
lea rdx, [rsp + 0x118]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov ebx, 0xc0000008
mov edi, r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalLock]
test rax, rax
je 0x180014138
cmp dword [rax], 0x456c6643
jne 0x18001412f
mov rdi, qword [rax + 0x38]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov qword [rsp + 0xb8], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalLock]
test rax, rax
je 0x180022d6e
mov r15d, dword [rax + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov r13d, dword [rsp + 0x1b0]
mov dword [rsp + 0xa0], r15d
test rdi, rdi
je 0x180014384
movzx eax, word [rsp + 0x1c8]
movzx ecx, word [rsp + 0x1a8]
movzx edx, word [rsp + 0x90]
movzx r8d, word [rsp + 0x92]
test r15d, r15d
jne 0x180014230
mov r9, qword [rsp + 0xe8]
mov qword [rsp + 0x78], r9
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], ecx
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9, rdi
xor r8d, r8d
lea edx, [r15 + 0x19]
lea rcx, [0x18005e288]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov rbx, rax
mov qword [rsp + 0x108], rax
jmp 0x1800142c6
mov r9, qword [rsp + 0xf0]
mov qword [rsp + 0x80], r9
mov r9, qword [rsp + 0xe8]
mov qword [rsp + 0x78], r9
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], ecx
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x20], eax
mov r9, rdi
xor r8d, r8d
lea edx, [r8 + 0xb]
lea rcx, [0x18005e288]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x110], rax
mov ebx, eax
mov dword [rsp + 0xa4], eax
jmp 0x18001435c
cmp ebx, 0xc0030005
je 0x180022d76
cmp ebx, 0xc002002e
je 0x180022d8e
mov rdi, r12
mov qword [rsp + 0xb8], r12
jmp 0x18001416f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.180017170
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r15d, r12d
jmp 0x18001415f
mov rcx, rsi
call fcn.18004622c
mov rdi, rax
mov qword [rsp + 0xb8], rax
jmp 0x18001416f
test r15d, r15d
jne 0x180014374
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_RtlTimeToSecondsSince1970]
mov rcx, rsi
call fcn.180046a08
mov r15d, 1
jmp 0x180014167
mov eax, 0xc0000017
jmp 0x18001438f