Function at 0x1400f4610
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov r12, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x270], rax
call fcn.14006b420
movzx ebp, byte [r12 + 0x17]
test bpl, bpl
mov rcx, qword [r12 + 8]
mov rax, rbp
cmovs rax, rcx
test rax, rax
je 0x1400f4e8b
cmp rax, 1
je 0x1400f46ce
test bpl, bpl
mov rdx, qword [r12]
mov rbx, r12
cmovs rbx, rdx
movzx edi, word [rbx]
cmp di, 0x27
je 0x1400f4688
cmp di, 0x22
jne 0x1400f46ce
cmp word [rbx + rax*2 - 2], 0x22
je 0x1400f4690
jmp 0x1400f46ce
cmp word [rbx + rax*2 - 2], 0x27
jne 0x1400f46ce
test bpl, bpl
js 0x1400f46a8
lea rax, [rbp - 1]
mov byte [r12 + 0x17], al
lea rax, [r12 + rbp*2]
add rax, 0xfffffffffffffffe
jmp 0x1400f46b9
lea rax, [rcx - 1]
mov qword [r12 + 8], rax
lea rax, [rdx + rcx*2]
add rax, 0xfffffffffffffffe
mov word [rax], 0
mov r8d, 1
mov rcx, r12
xor edx, edx
call fcn.14006bf00
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rsp + 0x38], rax
je 0x1400f46fc
lea rdx, [0x1401e9e12]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
jmp 0x1400f46fc
lea r14, str._windows
xor ebp, ebp
mov r15, rbp
shl r15, 4
mov rbx, qword [r15 + r14]
mov rcx, rbx
call fcn.1401b5060
movzx edi, byte [r12 + 0x17]
mov r10, r12
test dil, dil
jns 0x1400f472a
mov r10, qword [r12]
test rax, rax
je 0x1400f47c5
test dil, dil
jns 0x1400f473d
mov rdi, qword [r12 + 8]
lea rdx, [rdi + rdi]
add rax, rax
sar rax, 1
sar rdx, 1
cmp rdx, rax
jl 0x1400f48dd
lea r8, [r10 + rdi*2]
movzx esi, word [rbx]
lea r9, [rax - 1]
mov rdi, r10
mov rcx, rdx
sub rcx, rax
inc rcx
je 0x1400f48dd
mov rcx, r9
sub rcx, rdx
cmp word [rdi], si
je 0x1400f4789
add rdi, 2
inc rcx
jne 0x1400f4776
jmp 0x1400f48dd
test rdi, rdi
je 0x1400f48dd
mov ecx, 1
cmp rax, rcx
je 0x1400f487b
movzx edx, word [rdi + rcx*2]
cmp dx, word [rbx + rcx*2]
lea rcx, [rcx + 1]
je 0x1400f4797
add rdi, 2
mov rdx, r8
sub rdx, rdi
sar rdx, 1
cmp rdx, rax
jge 0x1400f4761
jmp 0x1400f48dd
xor edi, edi
mov rcx, rbx
call fcn.1401b5060
mov r13, rax
mov r8d, dword [r15 + r14 + 8]
xor ecx, ecx
lea rsi, [rsp + 0x60]
mov rdx, rsi
xor r9d, r9d
call qword [rsp + 0x30]
test eax, eax
jne 0x1400f47f3
mov word [rsp + 0x60], 0
lea r15, [rsp + 0x48]
mov rcx, r15
mov rdx, rsi
call fcn.140004f50
movzx edx, byte [rsp + 0x5f]
test dl, dl
mov rcx, qword [rsp + 0x50]
mov rax, rdx
cmovs rax, rcx
test rax, rax
je 0x1400f48a2
test dl, dl
mov r8, qword [rsp + 0x48]
mov rbx, r15
cmovs rbx, r8
cmp word [rbx + rax*2 - 2], 0x5c
jne 0x1400f48a2
movzx esi, byte [r12 + 0x17]
mov rax, rsi
test sil, sil
jns 0x1400f4848
mov rax, qword [r12 + 8]
mov rbx, r13
add rbx, rdi
cmp rax, rbx
jbe 0x1400f48a2
mov rax, r12
test sil, sil
jns 0x1400f485f
mov rax, qword [r12]
cmp word [rax + rbx*2], 0x5c
jne 0x1400f48a2
test dl, dl
js 0x1400f4891
lea rax, [rdx - 1]
mov byte [rsp + 0x5f], al
mov word [rsp + rdx*2 + 0x46], 0
jmp 0x1400f48a2
cmp r8, rdi
je 0x1400f48dd
sub rdi, r10
cmp rdi, 0xfffffffffffffffe
je 0x1400f48dd
sar rdi, 1
jmp 0x1400f47c7
lea rax, [rcx - 1]
mov qword [rsp + 0x50], rax
mov word [r8 + rcx*2 - 2], 0
movzx eax, byte [rsp + 0x5f]
test al, al
cmovs rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
cmovns r9, r15
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rdi
mov r8, r13
call fcn.14006bf90
xor eax, eax
cmp byte [rsp + 0x5f], al
jns 0x1400f48dd
mov rcx, qword [rsp + 0x48]
call fcn.140190860
inc rbp
cmp rbp, 7
jne 0x1400f4705
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x1400f4914
lea rdx, [0x1401e9ec2]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x1400f4914
mov dl, byte [r12 + 0x17]
test dl, dl
mov r10, qword [r12]
mov r9, qword [r12 + 8]
mov rbx, r12
cmovs rbx, r10
movzx eax, dl
mov rbp, rax
cmovs rbp, r9
mov rcx, rbp
add rcx, rbp
cmp rcx, 0x18
jl 0x1400f4a5d
lea r8, [rbx + rbp*2]
lea rsi, str._user_name
mov rdi, rbx
shr rcx, 1
add rcx, 0xfffffffffffffff5
je 0x1400f4a5d
cmp word [rdi], 0x24
je 0x1400f4974
add rdi, 2
dec rcx
jne 0x1400f4960
jmp 0x1400f4a5d
test rdi, rdi
je 0x1400f4a5d
mov ecx, 1
cmp rcx, 0xc
je 0x1400f49ab
movzx ebp, word [rdi + rcx*2]
cmp bp, word [rsi + rcx*2]
lea rcx, [rcx + 1]
je 0x1400f4982
add rdi, 2
mov rcx, r8
sub rcx, rdi
cmp rcx, 0x18
jge 0x1400f4953
jmp 0x1400f4a5d
cmp r8, rdi
je 0x1400f4a5d
sub rdi, rbx
cmp rdi, 0xfffffffffffffffe
je 0x1400f4a5d
lea rbp, [rsp + 0x48]
mov dword [rbp], 0
xor ecx, ecx
mov rdx, rbp
call r14
mov ecx, dword [rbp]
test rcx, rcx
je 0x1400f4a4c
sar rdi, 1
add rcx, rcx
call fcn.1401908a0
mov rbp, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call r14
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov rdx, rbp
call fcn.140004f50
movzx eax, byte [rsp + 0x77]
test al, al
jns 0x1400f4a19
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, ntohs
mov rcx, r12
mov rdx, rdi
mov r9, rsi
call fcn.14006bf90
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400f4a44
mov rcx, qword [rsp + 0x60]
call fcn.140190860
mov rcx, rbp
call fcn.1401908b0
mov dl, byte [r12 + 0x17]
mov r10, qword [r12]
mov r9, qword [r12 + 8]
movzx eax, dl
test dl, dl
cmovns r10, r12
cmovs rax, r9
lea rcx, [rax + rax]
cmp rcx, 0x1e
jl 0x1400f4b89
lea rbp, [r10 + rax*2]
lea rdx, str._machine_name
mov rdi, r10
shr rcx, 1
add rcx, 0xfffffffffffffff2
je 0x1400f4b89
cmp word [rdi], 0x24
je 0x1400f4aa4
add rdi, 2
dec rcx
jne 0x1400f4a90
jmp 0x1400f4b89
test rdi, rdi
je 0x1400f4b89
mov ecx, 1
cmp rcx, 0xf
je 0x1400f4adb
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
lea rcx, [rcx + 1]
je 0x1400f4ab2
add rdi, 2
mov rcx, rbp
sub rcx, rdi
cmp rcx, 0x1e
jge 0x1400f4a83
jmp 0x1400f4b89
cmp rbp, rdi
je 0x1400f4b89
sub rdi, r10
cmp rdi, 0xfffffffffffffffe
je 0x1400f4b89
lea rbx, [rsp + 0x48]
mov dword [rbx], 0
mov ecx, 5
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [rbx]
test rcx, rcx
je 0x1400f4b89
sar rdi, 1
add rcx, rcx
call fcn.1401908a0
mov rbx, rax
lea r8, [rsp + 0x48]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rbp, [rsp + 0x60]
mov rcx, rbp
mov rdx, rbx
call fcn.140004f50
movzx eax, byte [rbp + 0x17]
test al, al
jns 0x1400f4b56
mov rax, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, r12
mov rdx, rdi
mov r9, rbp
call fcn.14006bf90
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400f4b81
mov rcx, qword [rsp + 0x60]
call fcn.140190860
mov rcx, rbx
call fcn.1401908b0
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x1400f4bb5
lea rdx, [0x1401e9f32]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
jmp 0x1400f4bb5
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
je 0x1400f4bdc
lea rdx, [0x1401e9f6a]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400f4bdc
mov r11b, byte [r12 + 0x17]
test r11b, r11b
mov r10, qword [r12]
mov r9, qword [r12 + 8]
mov rbx, r12
cmovs rbx, r10
movzx edx, r11b
mov rdi, rdx
cmovs rdi, r9
lea rcx, [rdi + rdi]
cmp rcx, 0x1c
jl 0x1400f4d2d
lea r8, [rbx + rdi*2]
lea rsi, str._client_name
mov rbp, rbx
shr rcx, 1
add rcx, 0xfffffffffffffff3
je 0x1400f4d2d
cmp word [rbp], 0x24
je 0x1400f4c3d
add rbp, 2
dec rcx
jne 0x1400f4c28
jmp 0x1400f4d2d
test rbp, rbp
je 0x1400f4d2d
mov ecx, 1
cmp rcx, 0xe
je 0x1400f4c75
movzx edi, word [rbp + rcx*2]
cmp di, word [rsi + rcx*2]
lea rcx, [rcx + 1]
je 0x1400f4c4b
add rbp, 2
mov rcx, r8
sub rcx, rbp
cmp rcx, 0x1c
jge 0x1400f4c1b
jmp 0x1400f4d2d
cmp r8, rbp
je 0x1400f4d2d
sub rbp, rbx
cmp rbp, 0xfffffffffffffffe
je 0x1400f4d2d
mov rdi, rax
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
call qword [rsp + 0x30]
test eax, eax
je 0x1400f4d18
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140004f50
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400f4ce6
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, ntohs
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.14006bf90
mov rcx, qword [rsp + 0x48]
call rdi
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400f4d18
mov rcx, qword [rsp + 0x60]
call fcn.140190860
mov r11b, byte [r12 + 0x17]
mov r10, qword [r12]
mov r9, qword [r12 + 8]
movzx edx, r11b
mov rax, rdi
test r11b, r11b
cmovns r10, r12
cmovs rdx, r9
lea rcx, [rdx + rdx]
cmp rcx, 0x1e
jl 0x1400f4e51
lea rbx, [r10 + rdx*2]
lea rdx, str._session_name
mov rbp, r10
shr rcx, 1
add rcx, 0xfffffffffffffff2
je 0x1400f4e51
cmp word [rbp], 0x24
je 0x1400f4d76
add rbp, 2
dec rcx
jne 0x1400f4d61
jmp 0x1400f4e51
test rbp, rbp
je 0x1400f4e51
mov ecx, 1
cmp rcx, 0xf
je 0x1400f4dae
movzx edi, word [rbp + rcx*2]
cmp di, word [rdx + rcx*2]
lea rcx, [rcx + 1]
je 0x1400f4d84
add rbp, 2
mov rcx, rbx
sub rcx, rbp
cmp rcx, 0x1e
jge 0x1400f4d54
jmp 0x1400f4e51
cmp rbx, rbp
je 0x1400f4e51
sub rbp, r10
cmp rbp, 0xfffffffffffffffe
je 0x1400f4e51
mov rdi, rax
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
call qword [rsp + 0x30]
test eax, eax
je 0x1400f4e51
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140004f50
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400f4e1f
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.14006bf90
mov rcx, qword [rsp + 0x48]
call rdi
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400f4e51
mov rcx, qword [rsp + 0x60]
call fcn.140190860
test r13, r13
je 0x1400f4e5f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x1400f4e6d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x1400f4e7b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400f4e8b
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140190ca0
mov rax, r12
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret