Function at 0x10040a2f0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rcx, rdx
mov edx, 0x3a
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
xor ebp, ebp
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x20a
mov rbx, rax
mov edi, ebp
lea esi, [rbp + 1]
call sub.VCRUNTIME140.dll_memset
test rbx, rbx
je 0x10040a350
lea edx, [rbp + 0x3a]
lea rcx, [rbx + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbx, rax
mov qword [rsp + 0x490], r14
mov ecx, 0xb3c
mov qword [rsp + 0x4a0], r15
call fcn.100411ce0
mov qword [0x10044bfd0], rax
test rbx, rbx
je 0x10040a610
lea r14, [0x100400000]
lea r15, [0x10044bdc4]
nop dword [rax + rax]
cmp esi, 1
jne 0x10040a583
add rbx, 2
lea edx, [rsi + 0x5b]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov word [rsp + 0x40], bp
mov r9, rax
test rax, rax
je 0x10040a42a
mov r8, rax
sub r8, rbx
sar r8, 1
cmp r8, 0x7ffffffe
jbe 0x10040a3d6
mov r10d, 0x80070057
mov rbx, rax
jmp 0x10040a479
add r8, 0xfffffffffffffefb
lea rax, [rsp + 0x40]
sub rbx, rax
lea rcx, [rsp + 0x40]
mov edx, 0x105
mov r10d, ebp
lea rax, [r8 + rdx]
test rax, rax
je 0x10040a413
movzx eax, word [rbx + rcx]
test ax, ax
je 0x10040a413
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10040a3f2
jmp 0x10040a418
test rdx, rdx
jne 0x10040a422
sub rcx, 2
mov r10d, 0x8007007a
mov word [rcx], bp
mov rbx, r9
jmp 0x10040a479
lea rcx, [rsp + 0x40]
mov edx, 0x105
sub rbx, rcx
lea rax, [rsp + 0x40]
mov r10d, ebp
nop
lea rcx, [rdx + 0x7ffffef9]
test rcx, rcx
je 0x10040a464
movzx ecx, word [rbx + rax]
test cx, cx
je 0x10040a464
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x10040a440
jmp 0x10040a469
test rdx, rdx
jne 0x10040a473
sub rax, 2
mov r10d, 0x8007007a
mov word [rax], bp
mov rbx, rbp
test r10d, r10d
jne 0x10040a5f0
cmp edi, 5
ja case.default.0x10040a498
mov eax, edi
mov ecx, dword [r14 + rax*4 + 0xa654]
add rcx, r14
jmp rcx
lea rdx, [0x10044bdb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je case.default.0x10040a498
lea rdx, str.Transaction_guid_format_is_incorrect
call fcn.10040a220
mov esi, ebp
jmp case.default.0x10040a498
lea r8, [rsp + 0x40]
mov edx, 0x105
sub r8, r15
mov rcx, r15
mov r9d, ebp
nop word [rax + rax]
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x10040a505
movzx eax, word [r8 + rcx]
test ax, ax
je 0x10040a505
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10040a4e0
jmp 0x10040a50a
test rdx, rdx
jne 0x10040a514
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], bp
test r9d, r9d
je case.default.0x10040a498
lea rdx, str.Originator_format_is_incorrect
call fcn.10040a220
mov esi, ebp
jmp case.default.0x10040a498
lea r8, [0x100427db8]
lea rdx, [0x1004192d0]
jmp 0x10040a56e
lea r8, [0x10044bdc0]
lea rdx, [0x1004192d8]
jmp 0x10040a56e
mov r8, qword [0x10044bfd0]
lea rdx, [0x1004192e0]
add r8, 4
jmp 0x10040a56e
lea r8, [0x10044bda4]
lea rdx, [0x1004192e8]
lea rcx, [rsp + 0x40]
call fcn.1004015a0
inc edi
test rbx, rbx
jne 0x10040a390
test esi, esi
je 0x10040a590
cmp edi, 6
jne 0x10040a610
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x10040a600
lea rax, [rsp + 0x250]
mov r9, r15
lea r8, str._s__s_
mov qword [rsp + 0x20], rax
mov edx, 0x105
lea rcx, [0x10042771a]
call fcn.100401090
mov eax, esi
jmp 0x10040a61e
lea rdx, str.Argument_for_remote_dump_invoke_is_incorrect
call fcn.10040a220
mov esi, ebp
jmp 0x10040a590
lea rdx, str.Cant_get_ComputerName
call fcn.10040a220
mov eax, esi
jmp 0x10040a61e
lea rdx, str.Wrong_number_of_parameters_in_remote_dump_invokation
call fcn.10040a220
mov eax, ebp
mov r15, qword [rsp + 0x4a0]
mov r14, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1004119e0
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret