Function at 0x18001a65c
Capabilities:
Get hostname
Get session user name

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov ecx, 0x494
call fcn.18001a8e0
mov qword [rsp + 0x40], rax
mov edx, __WSAFDIsSet
mov rcx, qword [rsp + 0x40]
call fcn.18001ac50
mov qword [rsp + 0x48], rax
mov edx, pe_nt_image_headers64
mov rcx, qword [rsp + 0x40]
call fcn.18001ac50
mov qword [rsp + 0x58], rax
mov edx, pe_nt_image_headers64
mov rcx, qword [rsp + 0x40]
call fcn.18001ac50
mov qword [rsp + 0x70], rax
mov edx, pe_nt_image_headers64
mov rcx, qword [rsp + 0x40]
call fcn.18001ac50
mov qword [rsp + 0x68], rax
mov edx, pe_nt_image_headers64
mov rcx, qword [rsp + 0x40]
call fcn.18001ac50
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x34], pe_nt_image_headers64
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], pe_nt_image_headers64
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x34], pe_nt_image_headers64
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.1800105a8
mov dword [rsp + 0x60], eax
mov r8d, pe_nt_image_headers64
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x18001a771
mov edx, 0x5c
mov rcx, qword [rsp + 0x78]
call fcn.18004145c
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18001a771
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18001a785
lea rax, [0x18006ab90]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
mov dword [rax], __WSAFDIsSet
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 4]
mov dword [0x180072450], eax
mov rax, qword [rsp + 0x48]
mov dl, byte [rax + 4]
mov rcx, qword [rsp + 0xa0]
call fcn.18000f18c
mov rax, qword [rsp + 0x48]
mov dl, byte [rax + 8]
mov rcx, qword [rsp + 0xa0]
call fcn.18000f18c
mov rax, qword [rsp + 0x48]
movzx edx, word [rax + 0xc]
mov rcx, qword [rsp + 0xa0]
call fcn.18000f280
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
sar rax, 0x20
mov ecx, 0xffffffff
and rax, rcx
mov edx, eax
mov rcx, qword [rsp + 0xa0]
call fcn.18000f24c
mov edx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0xa0]
call fcn.18000f24c
mov edx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xa0]
call fcn.18000f24c
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0xa0]
call fcn.18000f24c
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x70]
lea r8, str._s_t_s_t_s
mov edx, pe_nt_image_headers64
mov rcx, qword [rsp + 0x58]
call fcn.18003fadc
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
inc qword [rsp + 0x50]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
cmp byte [rax + rcx], 0
jne 0x18001a887
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x3a
jle 0x18001a8b7
mov dword [rsp + 0x30], 0x3a
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa0]
call fcn.18000f1b4
mov rcx, qword [rsp + 0x40]
call fcn.18001aa50
add rsp, 0x98
ret