Function at 0x14019e910
Capabilities:
Get hostname
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
push r15
lea rbp, [r11 - 0x658]
sub rsp, 0x738
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp + 0x610], rax
movzx eax, word [rcx]
mov r12d, r8d
mov r15, rdx
mov rdi, rcx
test ax, ax
je 0x14019ec7b
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x30], r13
xor r13d, r13d
mov qword [r11 - 0x38], r14
movzx edx, ax
lea rcx, [0x14020c8a0]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x14019e99a
nop word [rax + rax]
movzx edx, word [rdi + 2]
lea rcx, [0x14020c8a0]
add rdi, 2
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x14019e980
cmp word [rdi], r13w
je 0x14019ec5b
lea rcx, [rdi + 2]
lea rdx, [0x14020c8a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscspn]
mov rdx, rdi
lea rcx, [rbp]
lea rsi, [rax + 1]
lea rbx, [rsi + rsi]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 0x200
jae 0x14019ec98
add rdi, rbx
mov word [rbp + rbx], r13w
cmp rsi, 1
jbe 0x14019ec4f
mov dword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [r15 + rax*2], r13w
jne 0x14019ea00
add eax, eax
lea rdx, [rbp]
mov r9, r15
mov dword [rsp + 0x20], eax
xor r8d, r8d
xor ecx, ecx
call fcn.1401bf6f0
test eax, eax
je 0x14019ec4f
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x48], r13b
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rcx, [rsp + 0x48]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], r13b
jne 0x14019ea50
lfence
mov edx, 0x404
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x200]
cmp rax, rdx
jae 0x14019ea7a
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
jmp 0x14019ea8d
mov r9d, 0x403
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov byte [rbp + 0x603], r13b
lea rax, [rbp + 0x200]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r13b
jne 0x14019eaa0
inc rbx
lea rsi, [rbp + 0x200]
mov r14d, 0x404
sub r14, rbx
add rsi, rbx
je 0x14019eaf5
test r14, r14
je 0x14019eaf5
mov qword [rsp + 0x38], r13
lea r8, [rbp]
mov qword [rsp + 0x30], r13
mov r9d, 0xffffffff
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [r14 + rsi - 1], r13b
jmp 0x14019eb1d
mov qword [rsp + 0x38], r13
lea r8, [rbp]
mov qword [rsp + 0x30], r13
mov r9d, 0xffffffff
mov dword [rsp + 0x28], r13d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], r13b
jne 0x14019eb24
lea r14, [rbx + 1]
mov esi, 0x404
add r14, rax
lea rbx, [rbp + 0x200]
add rbx, r14
sub rsi, r14
test r12b, 1
jne 0x14019eb5c
mov r8, rsi
mov rdx, rbx
mov rcx, r15
call fcn.1401af1b0
jmp 0x14019ebba
test rbx, rbx
je 0x14019eb93
test rsi, rsi
je 0x14019eb93
mov qword [rsp + 0x38], r13
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r13
mov r8, r15
mov dword [rsp + 0x28], esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [rsi + rbx - 1], r13b
jmp 0x14019ebba
mov qword [rsp + 0x38], r13
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r13
mov r8, r15
mov dword [rsp + 0x28], r13d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rax, 0xffffffffffffffff
cmp byte [rbx + rax + 1], r13b
lea rax, [rax + 1]
jne 0x14019ebc1
mov edx, 0x50
lea esi, [rax + r14]
lea rax, [rbp]
lea r9, str._smailslotmessngr
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
lea r8, [rdx - 0x51]
call fcn.1400138a0
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x60]
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [case.0x1401ba071.53]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14019ec4f
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], r13
lea r8d, [rsi + 1]
mov rcx, rax
lea rdx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [case.0x1401b9e8b.6]
movzx eax, word [rdi]
test ax, ax
jne 0x14019e960
mov r14, qword [rsp + 0x720]
mov rsi, qword [rsp + 0x730]
mov rbx, qword [rsp + 0x770]
mov r13, qword [rsp + 0x728]
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x738
pop r15
pop r12
pop rdi
pop rbp
ret
call fcn.1401c54a4
int3