Function at 0x180001f2c
Capabilities:
Get hostname
Get session user name

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov ecx, dword [0x18000d36c]
xor eax, eax
xor ebx, ebx
mov byte [rsp + 0x30], bl
mov qword [r11 - 0x27], rax
mov qword [r11 - 0x1f], rax
mov qword [r11 - 0x17], rax
lea rdx, [r11 - 0x28]
mov word [rsp + 0x49], ax
mov byte [rsp + 0x4b], al
call fcn.1800050a4
test eax, eax
je 0x180001f89
mov al, byte [rsp + 0x31]
cmp al, 2
jbe 0x180001f89
movzx eax, al
sub eax, 2
test eax, eax
jle 0x180001f89
lea rcx, [rsp + 0x3c]
mov edx, eax
add ebx, dword [rcx]
add rcx, 4
sub rdx, 1
jne 0x180001f7d
test ebx, ebx
mov dword [0x18000d3a0], ebx
jne 0x180001f9b
lea eax, [rbx + 5]
jmp 0x180002189
mov rcx, qword [0x18000d350]
xor ebx, 0xcf8558fc
xor edx, edx
mov r8d, 0xa0
mov dword [0x18000d3a0], ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, 8
test rax, rax
mov qword [0x18000d400], rax
je 0x180002003
xor edx, edx
mov r8d, 0xa0
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x18000d400]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x18000d400]
lea rdx, [0x18000f547]
mov qword [rax], rdx
xor eax, eax
jmp 0x180002005
mov eax, ebx
test eax, eax
jne 0x180002189
mov rcx, qword [0x18000d350]
lea r8d, [rax + 0x43]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov qword [0x18000d358], rax
je 0x18000205c
movzx r9d, byte [0x18000d379]
movzx r8d, byte [0x18000d378]
lea rcx, [0x18000f42f]
mov qword [rsp + 0x20], rcx
lea rdx, [0x18000f1c3]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
jmp 0x18000205e
mov eax, ebx
test eax, eax
jne 0x180002189
and dword [rsp + 0x60], eax
mov eax, dword [0x18000d3a0]
lea rdx, [rsp + 0x68]
lea rcx, [0x18000d088]
mov dword [rsp + 0x68], eax
call fcn.180003730
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x1800020ef
mov rcx, qword [0x18000d350]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800020ef
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1800020dd
mov edx, dword [rsp + 0x60]
mov rcx, rbx
add edx, edx
call fcn.180005858
xor dword [0x18000d088], eax
mov rcx, qword [0x18000d350]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and dword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x18000215e
mov rcx, qword [0x18000d350]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18000215e
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x18000214c
mov edx, dword [rsp + 0x60]
mov rcx, rbx
add edx, edx
call fcn.180005858
xor dword [0x18000d094], eax
mov rcx, qword [0x18000d350]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
cpuid
mov r8d, eax
mov eax, dword [0x18000d08c]
mov dword [rsp + 0x34], ebx
xor eax, edx
xor eax, ecx
xor eax, r8d
mov dword [0x18000d08c], eax
call fcn.1800012d0
call fcn.180001d78
add rsp, 0x50
pop rbx
ret