Function at 0x1401b63b0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x448
mov qword [rsp + 0x428], 0xfffffffffffffffe
mov rax, qword [0x14025e510]
xor rax, rsp
mov qword [rsp + 0x430], rax
cmp qword [rsp + 0x458], 0xffffffff80000000
je 0x1401b6400
cmp qword [rsp + 0x458], 0xffffffff80000001
jne 0x1401b6441
cmp qword [rsp + 0x460], 0
jne 0x1401b6430
mov rcx, qword [rsp + 0x450]
mov rax, qword [rsp + 0x458]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x450]
mov dword [rax + 0x18], 0
jmp 0x1401b643f
mov rax, qword [rsp + 0x450]
mov dword [rax + 0x18], 6
jmp 0x1401b6472
mov r8, qword [rsp + 0x450]
add r8, 0x10
mov rdx, qword [rsp + 0x458]
mov rcx, qword [rsp + 0x460]
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov r11d, eax
mov rax, qword [rsp + 0x450]
mov dword [rax + 0x18], r11d
mov rax, qword [rsp + 0x450]
cmp dword [rax + 0x18], 0
jne 0x1401b696b
cmp qword [rsp + 0x460], 0
jne 0x1401b652b
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1401b64c2
mov rcx, qword [rsp + 0x450]
add rcx, 0x28
call fcn.140004bf0
jmp 0x1401b6529
mov rax, qword [rsp + 0x450]
add rax, 0x28
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x260], rax
cmp qword [rsp + 0x260], 0
jne 0x1401b64fb
mov dword [rsp + 0x268], 0
jmp 0x1401b650f
mov rcx, qword [rsp + 0x260]
call fcn.14002f9b0
mov dword [rsp + 0x268], eax
mov r8d, dword [rsp + 0x268]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x270]
call fcn.140005080
jmp 0x1401b6588
mov rax, qword [rsp + 0x450]
add rax, 0x28
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x460], 0
jne 0x1401b6557
mov dword [rsp + 0x278], 0
jmp 0x1401b656b
mov rcx, qword [rsp + 0x460]
call fcn.14002f9b0
mov dword [rsp + 0x278], eax
mov r8d, dword [rsp + 0x278]
mov rdx, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x280]
call fcn.140005080
cmp qword [rsp + 0x458], 0xffffffff80000002
jne 0x1401b6606
mov rax, qword [rsp + 0x450]
add rax, 0x38
mov qword [rsp + 0x298], rax
lea rax, str.HKEY_LOCAL_MACHINE
mov qword [rsp + 0x288], rax
cmp qword [rsp + 0x288], 0
jne 0x1401b65d1
mov dword [rsp + 0x290], 0
jmp 0x1401b65e5
mov rcx, qword [rsp + 0x288]
call fcn.14002f9b0
mov dword [rsp + 0x290], eax
mov r8d, dword [rsp + 0x290]
lea rdx, str.HKEY_LOCAL_MACHINE
mov rcx, qword [rsp + 0x298]
call fcn.140005080
jmp 0x1401b6962
cmp qword [rsp + 0x458], 0xffffffff80000000
jne 0x1401b6684
mov rax, qword [rsp + 0x450]
add rax, 0x38
mov qword [rsp + 0x2b0], rax
lea rax, str.HKEY_CLASSES_ROOT
mov qword [rsp + 0x2a0], rax
cmp qword [rsp + 0x2a0], 0
jne 0x1401b664f
mov dword [rsp + 0x2a8], 0
jmp 0x1401b6663
mov rcx, qword [rsp + 0x2a0]
call fcn.14002f9b0
mov dword [rsp + 0x2a8], eax
mov r8d, dword [rsp + 0x2a8]
lea rdx, str.HKEY_CLASSES_ROOT
mov rcx, qword [rsp + 0x2b0]
call fcn.140005080
jmp 0x1401b6962
cmp qword [rsp + 0x458], 0xffffffff80000003
jne 0x1401b6702
mov rax, qword [rsp + 0x450]
add rax, 0x38
mov qword [rsp + 0x2c8], rax
lea rax, str.HKEY_USERS
mov qword [rsp + 0x2b8], rax
cmp qword [rsp + 0x2b8], 0
jne 0x1401b66cd
mov dword [rsp + 0x2c0], 0
jmp 0x1401b66e1
mov rcx, qword [rsp + 0x2b8]
call fcn.14002f9b0
mov dword [rsp + 0x2c0], eax
mov r8d, dword [rsp + 0x2c0]
lea rdx, str.HKEY_USERS
mov rcx, qword [rsp + 0x2c8]
call fcn.140005080
jmp 0x1401b6962
cmp qword [rsp + 0x458], 0xffffffff80000001
jne 0x1401b6780
mov rax, qword [rsp + 0x450]
add rax, 0x38
mov qword [rsp + 0x308], rax
lea rax, str.HKEY_CURRENT_USER
mov qword [rsp + 0x2d0], rax
cmp qword [rsp + 0x2d0], 0
jne 0x1401b674b
mov dword [rsp + 0x2d8], 0
jmp 0x1401b675f
mov rcx, qword [rsp + 0x2d0]
call fcn.14002f9b0
mov dword [rsp + 0x2d8], eax
mov r8d, dword [rsp + 0x2d8]
lea rdx, str.HKEY_CURRENT_USER
mov rcx, qword [rsp + 0x308]
call fcn.140005080
jmp 0x1401b6962
cmp qword [rsp + 0x458], 0xffffffff80000004
jne 0x1401b67fe
mov rax, qword [rsp + 0x450]
add rax, 0x38
mov qword [rsp + 0x348], rax
lea rax, str.HKEY_PERFORMANCE_DATA
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x310], 0
jne 0x1401b67c9
mov dword [rsp + 0x318], 0
jmp 0x1401b67dd
mov rcx, qword [rsp + 0x310]
call fcn.14002f9b0
mov dword [rsp + 0x318], eax
mov r8d, dword [rsp + 0x318]
lea rdx, str.HKEY_PERFORMANCE_DATA
mov rcx, qword [rsp + 0x348]
call fcn.140005080
jmp 0x1401b6962
cmp qword [rsp + 0x458], 0xffffffff80000005
jne 0x1401b687c
mov rax, qword [rsp + 0x450]
add rax, 0x38
mov qword [rsp + 0x388], rax
lea rax, str.HKEY_CURRENT_CONFIG
mov qword [rsp + 0x350], rax
cmp qword [rsp + 0x350], 0
jne 0x1401b6847
mov dword [rsp + 0x358], 0
jmp 0x1401b685b
mov rcx, qword [rsp + 0x350]
call fcn.14002f9b0
mov dword [rsp + 0x358], eax
mov r8d, dword [rsp + 0x358]
lea rdx, str.HKEY_CURRENT_CONFIG
mov rcx, qword [rsp + 0x388]
call fcn.140005080
jmp 0x1401b6962
cmp qword [rsp + 0x458], 0xffffffff80000006
jne 0x1401b68f7
mov rax, qword [rsp + 0x450]
add rax, 0x38
mov qword [rsp + 0x3c8], rax
lea rax, str.HKEY_DYN_DATA
mov qword [rsp + 0x390], rax
cmp qword [rsp + 0x390], 0
jne 0x1401b68c5
mov dword [rsp + 0x398], 0
jmp 0x1401b68d9
mov rcx, qword [rsp + 0x390]
call fcn.14002f9b0
mov dword [rsp + 0x398], eax
mov r8d, dword [rsp + 0x398]
lea rdx, str.HKEY_DYN_DATA
mov rcx, qword [rsp + 0x3c8]
call fcn.140005080
jmp 0x1401b6962
mov rax, qword [rsp + 0x450]
add rax, 0x38
mov qword [rsp + 0x420], rax
lea rax, str.Unknown
mov qword [rsp + 0x3d0], rax
cmp qword [rsp + 0x3d0], 0
jne 0x1401b6932
mov dword [rsp + 0x3d8], 0
jmp 0x1401b6946
mov rcx, qword [rsp + 0x3d0]
call fcn.14002f9b0
mov dword [rsp + 0x3d8], eax
mov r8d, dword [rsp + 0x3d8]
lea rdx, str.Unknown
mov rcx, qword [rsp + 0x420]
call fcn.140005080
mov eax, 1
jmp 0x1401b6978
xor eax, eax
jmp 0x1401b6978
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14002f990
add rsp, 0x448
ret