Function at 0x180001ee4
Capabilities:
Get hostname
Get session user name

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov ecx, dword [0x18000f5c0]
xor eax, eax
xor ebx, ebx
mov byte [rsp + 0x30], bl
mov qword [r11 - 0x27], rax
mov qword [r11 - 0x1f], rax
mov qword [r11 - 0x17], rax
lea rdx, [r11 - 0x28]
mov word [rsp + 0x49], ax
mov byte [rsp + 0x4b], al
call fcn.1800055cc
test eax, eax
je 0x180001f41
mov al, byte [rsp + 0x31]
cmp al, 2
jbe 0x180001f41
movzx eax, al
sub eax, 2
test eax, eax
jle 0x180001f41
lea rcx, [rsp + 0x3c]
mov edx, eax
add ebx, dword [rcx]
add rcx, 4
sub rdx, 1
jne 0x180001f35
test ebx, ebx
mov dword [0x18000f5cc], ebx
jne 0x180001f53
lea eax, [rbx + 5]
jmp 0x18000213f
mov rcx, qword [0x18000f5b0]
xor ebx, 0xcf8558fc
xor edx, edx
mov r8d, 0x86
mov dword [0x18000f5cc], ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, 8
test rax, rax
mov qword [0x18000f630], rax
je 0x180001fb9
lea r8d, [rbx + 0x7e]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x18000f630]
add rcx, 0x5a
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x18000f630]
lea rdx, [0x1800114f5]
mov qword [rax], rdx
xor eax, eax
jmp 0x180001fbb
mov eax, ebx
test eax, eax
jne 0x18000213f
mov rcx, qword [0x18000f5b0]
lea r8d, [rax + 0x43]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov qword [0x18000f620], rax
je 0x180002012
movzx r9d, byte [0x18000f5c5]
movzx r8d, byte [0x18000f5c4]
lea rcx, [0x18001144c]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1800111e7]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
jmp 0x180002014
mov eax, ebx
test eax, eax
jne 0x18000213f
and dword [rsp + 0x60], eax
mov eax, dword [0x18000f5cc]
lea rdx, [rsp + 0x68]
lea rcx, [0x18000f070]
mov dword [rsp + 0x68], eax
call fcn.180003a54
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x1800020a5
mov rcx, qword [0x18000f5b0]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800020a5
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x180002093
mov edx, dword [rsp + 0x60]
mov rcx, rbx
add edx, edx
call fcn.180007238
xor dword [0x18000f070], eax
mov rcx, qword [0x18000f5b0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and dword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x180002114
mov rcx, qword [0x18000f5b0]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180002114
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x180002102
mov edx, dword [rsp + 0x60]
mov rcx, rbx
add edx, edx
call fcn.180007238
xor dword [0x18000f07c], eax
mov rcx, qword [0x18000f5b0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
cpuid
mov r8d, eax
mov eax, dword [0x18000f074]
mov dword [rsp + 0x34], ebx
xor eax, edx
xor eax, ecx
xor eax, r8d
mov dword [0x18000f074], eax
call fcn.1800012b8
call fcn.180001d30
add rsp, 0x50
pop rbx
ret