Function at 0x140085c10
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x288
movaps xmmword [rsp + 0x270], xmm6
mov rsi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x268], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rdi
movaps xmm6, xmmword [section..rdata]
movups xmmword [rcx], xmm6
cmp byte [rdx + 0x17], 0
js 0x140085c6e
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
jmp 0x140085c80
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rsi
mov rdx, rax
call fcn.1400438b0
movsx rax, byte [rsi + 0x17]
test rax, rax
js 0x140085cb7
test al, al
je 0x14008643e
movzx ecx, al
cmp ecx, 1
je 0x140085d49
movzx ecx, word [rsi]
cmp ecx, 0x22
je 0x140085d22
cmp ecx, 0x27
jne 0x140085d49
mov rdx, rsi
mov rcx, rax
jmp 0x140085cfd
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x14008643e
cmp rdx, 1
je 0x140085d49
mov rcx, qword [rsi]
cmp word [rcx], 0x22
jne 0x140085ce7
cmp word [rcx + rdx*2 - 2], 0x22
je 0x140085d05
test al, al
js 0x140085ce7
cmp cx, 0x27
je 0x140085caf
jmp 0x140085d49
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14008659b
mov rdx, qword [rsi]
cmp word [rdx], 0x27
jne 0x140085d49
cmp word [rdx + rcx*2 - 2], 0x27
jne 0x140085d49
test al, al
jns 0x140085d2a
mov rax, qword [rsi + 8]
test rax, rax
je 0x140086588
dec rax
mov rcx, qword [rsi]
mov qword [rsi + 8], rax
jmp 0x140085d33
cmp word [rsi + rax*2 - 2], 0x22
jne 0x140085d49
dec rax
mov byte [rsi + 0x17], al
mov rcx, rsi
mov word [rcx + rax*2], 0
mov r8d, 1
mov rcx, rsi
xor edx, edx
call fcn.140044070
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x28], rdi
test rax, rax
je 0x140085d78
lea rdx, [0x14012d242]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
xor r14d, r14d
lea r15, [rsp + 0x60]
jmp 0x140085dc8
xor eax, eax
test al, al
movzx eax, al
cmovs rax, qword [rsp + 0x48]
mov r9, qword [rsp + 0x40]
cmovns r9, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, r13
mov r8, rbp
call fcn.140043390
cmp byte [rsp + 0x57], 0
js 0x140085f88
inc r14
cmp r14, 7
je 0x140086029
mov rbx, r14
shl rbx, 4
lea rax, str._windows
mov rbp, qword [rbx + rax]
test rbp, rbp
je 0x140086562
mov rcx, rbp
call fcn.1400ffa68
movsx r10, byte [rsi + 0x17]
mov rcx, rsi
test r10, r10
jns 0x140085dff
mov r10, qword [rsi + 8]
mov rcx, qword [rsi]
test rax, rax
je 0x140085ec0
cmp r10, rax
jl 0x140085dbb
lea r9, [r10 + r10]
lea rdx, [rcx + r10*2]
movzx r8d, word [rbp]
add r9, rcx
add r9, 0xfffffffffffffffe
mov r11, rcx
mov r12, r10
sub r12, rax
inc r12
je 0x140085dbb
inc r10
xor r12d, r12d
nop word cs:[rax + rax]
cmp word [r11 + r12], r8w
je 0x140085e60
add r12, 2
dec r10
cmp rax, r10
jne 0x140085e40
jmp 0x140085dbb
mov r13, r11
add r13, r12
je 0x140085dbb
xor r10d, r10d
nop
movzx edi, word [r13 + r10*2]
cmp di, word [rbp + r10*2]
jne 0x140085e90
inc r10
cmp rax, r10
jne 0x140085e70
jmp 0x140085f97
mov r10, r9
sub r10, r11
add r11, r12
add r11, 2
sub r10, r12
sar r10, 1
cmp r10, rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
jge 0x140085e24
jmp 0x140085dbb
xor r13d, r13d
lea rax, str._windows
add rbx, rax
mov rcx, rbp
call fcn.1400ffa68
mov rbp, rax
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.140114c60
mov r8d, dword [rbx + 8]
xor ecx, ecx
mov rdx, r15
xor r9d, r9d
mov rax, qword [rsp + 0x28]
call qword [0x140146120]
test eax, eax
jne 0x140085f0a
mov word [rsp + 0x60], 0
mov qword [rsp + 0x50], rdi
movaps xmmword [rsp + 0x40], xmm6
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov rdx, r15
call fcn.140001850
movsx rax, byte [rsp + 0x57]
test rax, rax
js 0x140085f4b
test al, al
je 0x140085d87
mov rdx, rbx
mov rcx, rax
cmp word [rdx + rcx*2 - 2], 0x5c
jne 0x140085d89
jmp 0x140085f6a
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140085d89
mov rdx, qword [rsp + 0x40]
cmp word [rdx + rcx*2 - 2], 0x5c
jne 0x140085d89
movsx rdx, byte [rsi + 0x17]
mov rcx, rbp
add rcx, r13
test rdx, rdx
js 0x140085fc2
mov r8, rdx
cmp rcx, rdx
jae 0x140085d89
jmp 0x140085fcf
mov rcx, qword [rsp + 0x40]
call fcn.1400dffa0
jmp 0x140085dbb
cmp r13, rdx
movabs rdi, 0xaaaaaaaaaaaaaaaa
je 0x140085dbb
sub r13, rcx
mov rax, r13
add rax, 2
je 0x140085dbb
sar r13, 1
jmp 0x140085ec3
mov r8, qword [rsi + 8]
cmp r8, rcx
jbe 0x140085d89
cmp rcx, r8
ja 0x140086575
mov r8, rsi
test dl, dl
jns 0x140085fe2
mov r8, qword [rsi]
cmp word [r8 + rcx*2], 0x5c
jne 0x140085d89
test al, al
js 0x140085ffe
dec rax
mov byte [rsp + 0x57], al
mov rcx, rbx
jmp 0x140086019
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140086588
dec rax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov word [rcx + rax*2], 0
movzx eax, byte [rsp + 0x57]
jmp 0x140085d89
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x140086053
lea rdx, [0x14012d2f2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
jmp 0x140086056
mov r12, rdi
movsx rcx, byte [rsi + 0x17]
test rcx, rcx
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, rsi
cmovs r8, rax
mov rbx, rcx
cmovs rbx, rdx
cmp rbx, 0xc
jge 0x140086081
mov r8d, ecx
jmp 0x14008616a
lea r10, [rbx + rbx]
lea r9, [r8 + rbx*2]
add r10, r8
add r10, 0xfffffffffffffffe
mov r11, r8
add rbx, 0xfffffffffffffff5
xor edi, edi
nop dword [rax]
cmp word [r11 + rdi], 0x24
je 0x1400860c0
add rdi, 2
dec rbx
jne 0x1400860a0
jmp 0x14008615d
mov r13, r11
add r13, rdi
je 0x14008615d
cmp word [r11 + rdi + 2], 0x7b
jne 0x140086140
cmp word [r11 + rdi + 4], 0x75
jne 0x140086140
cmp word [r11 + rdi + 6], 0x73
jne 0x140086140
cmp word [r11 + rdi + 8], 0x65
jne 0x140086140
cmp word [r11 + rdi + 0xa], 0x72
jne 0x140086140
cmp word [r11 + rdi + 0xc], 0x5f
jne 0x140086140
cmp word [r11 + rdi + 0xe], 0x6e
jne 0x140086140
cmp word [r11 + rdi + 0x10], 0x61
jne 0x140086140
cmp word [r11 + rdi + 0x12], 0x6d
jne 0x140086140
cmp word [r11 + rdi + 0x14], 0x65
jne 0x140086140
cmp word [r11 + rdi + 0x16], 0x7d
je 0x1400865ae
nop word cs:[rax + rax]
mov rbx, r10
sub rbx, r11
add r11, rdi
add r11, 2
sub rbx, rdi
sar rbx, 1
cmp rbx, 0xc
jge 0x140086093
mov r8d, ecx
movabs rdi, 0xaaaaaaaaaaaaaaaa
test r8b, r8b
cmovns rax, rsi
cmovs rcx, rdx
cmp rcx, 0xf
jge 0x1400861ae
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x1400862a2
lea rdx, [0x14012d31c]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
jmp 0x1400862a7
lea r8, [rcx + rcx]
lea rdx, [rax + rcx*2]
add r8, rax
add r8, 0xfffffffffffffffe
mov r9, rax
add rcx, 0xfffffffffffffff2
xor r10d, r10d
nop word [rax + rax]
cmp word [r9 + r10], 0x24
je 0x1400861f0
add r10, 2
dec rcx
jne 0x1400861d0
jmp 0x14008617b
mov r15, r9
add r15, r10
je 0x14008617b
cmp word [r9 + r10 + 2], 0x7b
jne 0x140086280
cmp word [r9 + r10 + 4], 0x6d
jne 0x140086280
cmp word [r9 + r10 + 6], 0x61
jne 0x140086280
cmp word [r9 + r10 + 8], 0x63
jne 0x140086280
cmp word [r9 + r10 + 0xa], 0x68
jne 0x140086280
cmp word [r9 + r10 + 0xc], 0x69
jne 0x140086280
cmp word [r9 + r10 + 0xe], 0x6e
jne 0x140086280
cmp word [r9 + r10 + 0x10], 0x65
jne 0x140086280
cmp word [r9 + r10 + 0x12], 0x5f
jne 0x140086280
cmp word [r9 + r10 + 0x14], 0x6e
jne 0x140086280
cmp word [r9 + r10 + 0x16], 0x61
jne 0x140086280
cmp word [r9 + r10 + 0x18], 0x6d
jne 0x140086280
cmp word [r9 + r10 + 0x1a], 0x65
jne 0x140086280
cmp word [r9 + r10 + 0x1c], 0x7d
je 0x14008677e
nop word [rax + rax]
mov rcx, r8
sub rcx, r9
add r9, r10
add r9, 2
sub rcx, r10
sar rcx, 1
cmp rcx, 0xf
jge 0x1400861c0
jmp 0x14008617b
mov qword [rsp + 0x28], rdi
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x1400862cf
lea rdx, [0x14012d354]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
movsx rcx, byte [rsi + 0x17]
test rcx, rcx
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, rsi
cmovs r8, rax
mov rbx, rcx
cmovs rbx, rdx
cmp rbx, 0xe
jge 0x1400862fa
mov r8d, ecx
jmp 0x1400863f3
mov r13, rdi
lea r10, [rbx + rbx]
lea r9, [r8 + rbx*2]
add r10, r8
add r10, 0xfffffffffffffffe
mov r11, r8
add rbx, 0xfffffffffffffff3
xor edi, edi
nop word cs:[rax + rax]
cmp word [r11 + rdi], 0x24
je 0x140086340
add rdi, 2
dec rbx
jne 0x140086320
jmp 0x1400863ed
mov rbp, r11
add rbp, rdi
je 0x1400863ed
cmp word [r11 + rdi + 2], 0x7b
jne 0x1400863d0
cmp word [r11 + rdi + 4], 0x63
jne 0x1400863d0
cmp word [r11 + rdi + 6], 0x6c
jne 0x1400863d0
cmp word [r11 + rdi + 8], 0x69
jne 0x1400863d0
cmp word [r11 + rdi + 0xa], 0x65
jne 0x1400863d0
cmp word [r11 + rdi + 0xc], 0x6e
jne 0x1400863d0
cmp word [r11 + rdi + 0xe], 0x74
jne 0x1400863d0
cmp word [r11 + rdi + 0x10], 0x5f
jne 0x1400863d0
cmp word [r11 + rdi + 0x12], 0x6e
jne 0x1400863d0
cmp word [r11 + rdi + 0x14], 0x61
jne 0x1400863d0
cmp word [r11 + rdi + 0x16], 0x6d
jne 0x1400863d0
cmp word [r11 + rdi + 0x18], 0x65
jne 0x1400863d0
cmp word [r11 + rdi + 0x1a], 0x7d
je 0x140086698
nop word cs:[rax + rax]
mov rbx, r10
sub rbx, r11
add r11, rdi
add r11, 2
sub rbx, rdi
sar rbx, 1
cmp rbx, 0xe
jge 0x14008630f
mov r8d, ecx
mov rdi, r13
test r8b, r8b
cmovns rax, rsi
cmovs rcx, rdx
cmp rcx, 0xf
jge 0x140086477
test r12, r12
je 0x140086412
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x140086420
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x14008642e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14008643e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x140086471
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x270]
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400e0180
int3
lea r8, [rcx + rcx]
lea rdx, [rax + rcx*2]
add r8, rax
add r8, 0xfffffffffffffffe
mov r9, rax
add rcx, 0xfffffffffffffff2
xor r10d, r10d
cmp word [r9 + r10], 0x24
je 0x1400864b0
add r10, 2
dec rcx
jne 0x140086490
jmp 0x140086404
mov rbp, r9
add rbp, r10
je 0x140086404
cmp word [r9 + r10 + 2], 0x7b
jne 0x140086540
cmp word [r9 + r10 + 4], 0x73
jne 0x140086540
cmp word [r9 + r10 + 6], 0x65
jne 0x140086540
cmp word [r9 + r10 + 8], 0x73
jne 0x140086540
cmp word [r9 + r10 + 0xa], 0x73
jne 0x140086540
cmp word [r9 + r10 + 0xc], 0x69
jne 0x140086540
cmp word [r9 + r10 + 0xe], 0x6f
jne 0x140086540
cmp word [r9 + r10 + 0x10], 0x6e
jne 0x140086540
cmp word [r9 + r10 + 0x12], 0x5f
jne 0x140086540
cmp word [r9 + r10 + 0x14], 0x6e
jne 0x140086540
cmp word [r9 + r10 + 0x16], 0x61
jne 0x140086540
cmp word [r9 + r10 + 0x18], 0x6d
jne 0x140086540
cmp word [r9 + r10 + 0x1a], 0x65
jne 0x140086540
cmp word [r9 + r10 + 0x1c], 0x7d
je 0x14008685e
nop
mov rcx, r8
sub rcx, r9
add r9, r10
add r9, 2
sub rcx, r10
sar rcx, 1
cmp rcx, 0xf
jge 0x140086489
jmp 0x140086404
lea rcx, [0x140117223]
lea rdx, str....._third_partylibc_srcinclude_string:3497:_assertion___s___nullptr_failed:_string::find__:_received_nullptr_n
call fcn.140044b40
lea rcx, [0x140117223]
lea rdx, str....._third_partylibc_srcinclude_string:1339:_assertion___pos___size___failed:_string_index_out_of_bounds_n
call fcn.140044b40
lea rcx, [0x140117223]
lea rdx, str....._third_partylibc_srcinclude_string:3293:_assertion__empty___failed:_string::pop_back__:_string_is_already_empty_n
call fcn.140044b40
lea rcx, [0x140117223]
lea rdx, str....._third_partylibc_srcinclude_string:1439:_assertion__empty___failed:_string::front__:_string_is_empty_n
call fcn.140044b40
cmp r13, r9
je 0x14008615d
sub r13, r8
mov r9, r13
mov r8d, ecx
add r9, 2
movabs rdi, 0xaaaaaaaaaaaaaaaa
je 0x14008616a
mov dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
xor ecx, ecx
mov rax, r12
call qword [0x140146120]
mov ecx, dword [rsp + 0x40]
test rcx, rcx
je 0x140086683
sar r13, 1
add rcx, rcx
call fcn.1400dffdc
mov rbp, rax
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rax, r12
call qword [0x140146120]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm6
mov rcx, r15
mov rdx, rbp
call fcn.140001850
movsx rax, byte [rsp + 0x77]
test rax, rax
jns 0x14008664c
mov rax, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xc
mov rcx, rsi
mov rdx, r13
mov r9, r15
call fcn.140043390
cmp byte [rsp + 0x77], 0
jns 0x140086676
mov rcx, qword [rsp + 0x60]
call fcn.1400dffa0
test rbp, rbp
je 0x140086683
mov rcx, rbp
call fcn.1400dffe4
movzx r8d, byte [rsi + 0x17]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
movzx ecx, r8b
jmp 0x140086160
cmp rbp, r9
je 0x1400863ed
sub rbp, r8
mov r9, rbp
mov r8d, ecx
add r9, 2
mov rdi, r13
je 0x1400863f3
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x3c], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
mov rax, qword [rsp + 0x28]
call qword [0x140146120]
test eax, eax
je 0x140086769
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm6
mov rdx, qword [rsp + 0x40]
lea rdi, [rsp + 0x60]
mov rcx, rdi
call fcn.140001850
movsx rax, byte [rsp + 0x77]
test rax, rax
jns 0x140086731
mov rax, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xe
mov rcx, rsi
mov rdx, rbp
mov r9, rdi
call fcn.140043390
mov rcx, qword [rsp + 0x40]
mov rax, r13
call qword [0x140146120]
cmp byte [rsp + 0x77], 0
jns 0x140086769
mov rcx, qword [rsp + 0x60]
call fcn.1400dffa0
movzx r8d, byte [rsi + 0x17]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
movzx ecx, r8b
jmp 0x1400863f0
cmp r15, rdx
je 0x14008617b
sub r15, rax
mov rax, r15
add rax, 2
je 0x14008617b
mov dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov ecx, 5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [rsp + 0x40]
test rcx, rcx
je 0x14008684f
sar r15, 1
add rcx, rcx
call fcn.1400dffdc
mov r12, rax
lea r8, [rsp + 0x40]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm6
lea r13, [rsp + 0x60]
mov rcx, r13
mov rdx, r12
call fcn.140001850
movsx rax, byte [rsp + 0x77]
test rax, rax
jns 0x140086818
mov rax, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, rsi
mov rdx, r15
mov r9, r13
call fcn.140043390
cmp byte [rsp + 0x77], 0
jns 0x140086842
mov rcx, qword [rsp + 0x60]
call fcn.1400dffa0
test r12, r12
je 0x14008684f
mov rcx, r12
call fcn.1400dffe4
movabs rdi, 0xaaaaaaaaaaaaaaaa
jmp 0x14008617b
cmp rbp, rdx
je 0x140086404
sub rbp, rax
mov rax, rbp
add rax, 2
je 0x140086404
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x3c], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
mov rax, qword [rsp + 0x28]
call qword [0x140146120]
test eax, eax
je 0x140086404
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm6
mov rdx, qword [rsp + 0x40]
lea r13, [rsp + 0x60]
mov rcx, r13
call fcn.140001850
movsx rax, byte [rsp + 0x77]
test rax, rax
jns 0x1400868f5
mov rax, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, rsi
mov rdx, rbp
mov r9, r13
call fcn.140043390
mov rcx, qword [rsp + 0x40]
mov rax, rdi
call qword [0x140146120]
cmp byte [rsp + 0x77], 0
jns 0x140086404
mov rcx, qword [rsp + 0x60]
call fcn.1400dffa0
jmp 0x140086404