Function at 0x1800465e0
Capabilities:
Get hostname

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r13d, r9d
movzx eax, r8w
mov word [rsp + 0x90], ax
mov word [rsp + 0x92], dx
mov r15, rcx
movzx ecx, word [rsp + 0x198]
mov word [rsp + 0x94], cx
movzx ecx, word [rsp + 0x1b8]
mov word [rsp + 0x96], cx
mov qword [rsp + 0xf8], r15
mov word [rsp + 0x9a], dx
mov word [rsp + 0x98], ax
mov dword [rsp + 0xb8], r9d
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0xe8], rax
and dword [rsp + 0xa8], 0
and dword [rsp + 0xac], 0
and dword [rsp + 0xa0], 0
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
mov ebx, 0x10
mov dword [rsp + 0xb0], ebx
xor eax, eax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edx, ebx
lea ecx, [rbx + 0x30]
call qword [sym.imp.KERNELBASE.dll_LocalAlloc]
mov r14, rax
mov qword [rsp + 0xf0], rax
test rax, rax
je 0x180046735
lea rdx, [rsp + 0x110]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov ebx, 0xc0000008
mov rcx, r15
call fcn.180015720
mov rdi, rax
mov qword [rsp + 0xe0], rax
mov rcx, r15
call fcn.180045914
mov esi, eax
mov dword [rsp + 0xa4], eax
mov r12d, dword [rsp + 0x1a0]
test rdi, rdi
je 0x1800469a5
movzx eax, word [rsp + 0x1b8]
movzx ecx, word [rsp + 0x198]
movzx edx, word [rsp + 0x90]
movzx r8d, word [rsp + 0x92]
test esi, esi
jne 0x18004681f
mov r9, qword [rsp + 0xd8]
mov qword [rsp + 0x78], r9
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9, rdi
xor r8d, r8d
lea edx, [rsi + 0x1a]
lea rcx, [0x18005e288]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov rbx, rax
mov qword [rsp + 0x100], rax
jmp 0x1800468af
mov r9, qword [rsp + 0xe8]
mov qword [rsp + 0x80], r9
mov r9, qword [rsp + 0xd8]
mov qword [rsp + 0x78], r9
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9, rdi
xor r8d, r8d
lea edx, [r8 + 0x12]
lea rcx, [0x18005e288]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x108], rax
mov ebx, eax
mov dword [rsp + 0x9c], eax
jmp 0x18004693b
cmp ebx, 0xc0030005
jne 0x18004695b
mov rcx, r15
call fcn.18004622c
mov rdi, rax
mov qword [rsp + 0xe0], rax
jmp 0x180046766
cmp ebx, 0xc002002e
jne 0x180046996
test esi, esi
jne 0x180046996
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_RtlTimeToSecondsSince1970]
mov rcx, r15
call fcn.180046a08
mov esi, 1
mov dword [rsp + 0xa4], esi
jmp 0x180046766
xor edi, edi
mov qword [rsp + 0xe0], rdi
jmp 0x180046766
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180017170
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret