Function at 0x14000a1a0
Capabilities:
Get hostname
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x868]
sub rsp, 0x968
xor esi, esi
mov r15, rcx
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x8b8], rsi
mov r12d, esi
mov qword [rbp + 0x8c0], rsi
mov dword [rsp + 0x40], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r8, qword [r15 + 0x18]
test r8, r8
je 0x14000a202
mov rcx, qword [0x14001e780]
lea edx, [rsi + 8]
call qword [0x14001e798]
mov qword [r15 + 0x18], rsi
mov rcx, qword [str.mhtC_EFnLhpO]
lea rdx, [rbp + 0x60]
call fcn.14000deb0
movzx eax, byte [rbp + 0x60]
lea r11, [rbp + 0x60]
lea rcx, [rbp + 0x460]
test al, al
je 0x14000a246
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x14000a230
xor r9d, r9d
mov word [rcx], si
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x460]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rbp + 0x8b0], esi
mov rdi, rsi
mov r13d, esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov ebx, 2
cmp rax, 0xffffffffffffffff
je 0x14000a333
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov dword [rbp + 0x8b0], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r11d, dword [rbp + 0x8b0]
test r11d, r11d
jne 0x14000a2cf
lea r13d, [rbx - 1]
jmp 0x14000a32a
mov rcx, r11
xor edx, edx
call fcn.14000e210
mov rdi, rax
test rax, rax
je 0x14000a32a
mov r8d, dword [rbp + 0x8b0]
lea r9, [rbp + 0x8b0]
mov rdx, rax
mov rcx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000a30c
mov r13d, 1
jmp 0x14000a32a
mov rcx, qword [0x14001e780]
mov r8, rdi
mov edx, 8
call qword [0x14001e798]
mov rdi, rsi
mov dword [rbp + 0x8b0], esi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x8b0]
mov qword [rbp + 0x8c8], rdi
mov qword [rbp + 0x8b8], rax
test r13d, r13d
jne 0x14000a444
lea rcx, [rbp + 0x8c0]
call fcn.14000bc60
mov r12, qword [rbp + 0x8c0]
test r12, r12
je 0x14000a399
mov rcx, r12
cmp word [r12], si
je 0x14000a37a
add rcx, rbx
cmp word [rcx], si
jne 0x14000a372
cmp rcx, r12
jbe 0x14000a399
nop
test ebx, ebx
je 0x14000a409
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x14000a394
dec ebx
cmp rcx, r12
ja 0x14000a380
xor edx, edx
mov ecx, 0x208
mov qword [rbp + 0x8b8], 0x104
call fcn.14000e210
mov rbx, rax
test rax, rax
je 0x14000a67e
lea rdx, [rbp + 0x8b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, qword [rbp + 0x8b8]
mov rdx, rbx
add rcx, 0x32
mov qword [rbp + 0x8b8], rcx
add rcx, rcx
test eax, eax
jne 0x14000a47d
call fcn.14000e210
lea rdx, [rbp + 0x8b8]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x14000a48e
cmp rcx, r12
jbe 0x14000a399
lea rdx, [rbp + 0x460]
add rcx, 2
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rbp + 0x8b8]
lea rdx, [rbp + 0x8c8]
mov rcx, r12
call fcn.14000cc90
test eax, eax
je 0x14000a399
mov rdi, qword [rbp + 0x8c8]
mov esi, 1
test r12, r12
je 0x14000a463
mov rcx, qword [0x14001e780]
mov r8, r12
mov edx, 8
call qword [0x14001e798]
mov eax, esi
mov qword [r15 + 0x18], rdi
add rsp, 0x968
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000e210
mov rbx, rax
test rax, rax
je 0x14000a67e
mov rcx, rbx
call fcn.14000ca80
mov rcx, qword [str.QL8KAUAOQEp_lb]
lea rdx, [rbp + 0x60]
call fcn.14000deb0
movzx eax, byte [rbp + 0x60]
lea r11, [rbp + 0x60]
lea rcx, [rbp + 0x460]
test al, al
je 0x14000a4d6
nop dword [rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x14000a4c0
mov eax, dword [rsp + 0x4c]
mov rdx, qword [rbp + 0x8b8]
mov word [rcx], si
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
lea r8, [rbp + 0x460]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x44]
mov r9, rbx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140002880
test eax, eax
js 0x14000a664
test rbx, rbx
je 0x14000a565
mov r8, qword [rbp + 0x8b8]
cmp r8, 0x7fffffff
ja 0x14000a565
mov rcx, r8
mov rax, rbx
mov edx, esi
test r8, r8
je 0x14000a542
cmp word [rax], dx
je 0x14000a554
add rax, 2
dec rcx
jne 0x14000a534
mov edx, 0x80070057
mov qword [rbp + 0x8b8], rsi
test edx, edx
jns 0x14000a579
jmp 0x14000a56a
test rcx, rcx
je 0x14000a542
sub r8, rcx
mov qword [rbp + 0x8b8], r8
jmp 0x14000a54e
mov edx, 0x80070057
mov qword [rbp + 0x8b8], rsi
test edx, edx
js 0x14000a664
mov edi, 0x20
mov r13d, 0xffe9
call qword [sym.imp.msvcrt.dll_rand]
mov r11d, eax
and r11d, 0x8000000f
jge 0x14000a5a0
dec r11d
or r11d, 0xfffffff0
inc r11d
mov rax, qword [rbp + 0x8b8]
add r11w, 0x41
mov word [rbx + rax*2], r11w
mov rax, qword [rbp + 0x8b8]
cmp word [rbx + rax*2], 0x46
jbe 0x14000a5cb
add word [rbx + rax*2], r13w
mov rax, qword [rbp + 0x8b8]
inc rax
dec rdi
mov qword [rbp + 0x8b8], rax
jne 0x14000a584
mov word [rbx + rax*2], si
mov rax, qword [rbp + 0x8b8]
mov rdx, rbx
lea rcx, [rax + rax + 2]
mov qword [rbp + 0x8b8], rcx
call fcn.14000e210
mov rdi, rax
test rax, rax
je 0x14000a67e
mov rcx, qword [str.mhtC_EFnLhpO]
lea rdx, [rbp + 0x60]
call fcn.14000deb0
movzx eax, byte [rbp + 0x60]
lea r11, [rbp + 0x60]
lea rcx, [rbp + 0x460]
test al, al
je 0x14000a646
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x14000a630
mov r8, qword [rbp + 0x8b8]
mov word [rcx], si
lea rcx, [rbp + 0x460]
mov rdx, rdi
call fcn.14000cc00
jmp 0x14000a444
test rbx, rbx
je 0x14000a67e
mov rcx, qword [0x14001e780]
mov r8, rbx
mov edx, 8
call qword [0x14001e798]
mov rdi, rsi
jmp 0x14000a449