Function at 0x14000b2a0
Capabilities:
Get local ipv4 addresses
Get session user name

Disassembly:
push rbx
push rsi
push r13
push r14
push r15
push rbp
sub rsp, 0x718
mov r14, rcx
mov edx, 0x1af
lea rcx, [rsp + 0x250]
lea r8, [0x14002bf14]
mov r9d, 0x1e
movaps xmmword [rsp + 0x700], xmm15
xor ebx, ebx
mov qword [rsp + 0x6c8], 0
mov dword [rsp + 0x6c4], 0x3a98
call fcn.14000b040
mov rcx, r14
mov rdx, rax
call fcn.14000be20
cmp byte [0x140043340], 0
jne 0x14000bcae
lea rcx, [0x140040d40]
xor edx, edx
mov r8d, 0x800
call fcn.1400142c0
lea rcx, [0x140041540]
xor edx, edx
mov r8d, 0x800
call fcn.1400142c0
pxor xmm15, xmm15
movaps xmmword [rsp + 0x6d0], xmm15
movaps xmmword [rsp + 0x6e0], xmm15
movaps xmmword [rsp + 0x670], xmm15
movaps xmmword [rsp + 0x680], xmm15
mov byte [rsp + 0x690], 0
movaps xmmword [rsp + 0x6a0], xmm15
movaps xmmword [rsp + 0x6b0], xmm15
mov byte [rsp + 0x6c0], 0
movaps xmmword [rsp + 0x650], xmm15
movaps xmmword [rsp + 0x660], xmm15
mov qword [rsp + 0x698], r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, dword [rsp + 0x6c4]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test r13, r13
je 0x14000bd4e
mov rbp, rsp
xor ecx, ecx
mov edx, 0x1f
xor r8d, r8d
mov r9, r13
lea rax, [rsp + 0x6c4]
mov qword [rbp + 0x20], rax
call fcn.140028982
mov ebp, eax
cmp ebp, 0x6f
jne 0x14000b404
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
inc ebx
xor r13d, r13d
cmp ebx, 4
jb 0x14000b399
mov r12, qword [rsp + 0x698]
cmp byte [0x140042f40], 0
je 0x14000b455
mov edx, 0x1d9
lea rcx, [rsp + 0x250]
lea r8, [0x14002bf88]
mov r9d, 3
call fcn.14000b040
mov edx, 0x21
lea rcx, [rsp + 0x6a0]
mov r8, rax
lea r9, [0x140042f40]
call fcn.140017dd0
jmp 0x14000b4e1
mov dword [rsp + 0x694], 0x200
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x694]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14000b4b2
mov edx, 0x1de
lea rcx, [rsp + 0x250]
lea r8, [0x14002bf8c]
mov r9d, 3
call fcn.14000b040
mov edx, 0x21
lea rcx, [rsp + 0x6a0]
mov r8, rax
lea r9, [rsp + 0x50]
call fcn.140017dd0
jmp 0x14000b4e1
mov edx, 0x1e0
lea rcx, [rsp + 0x250]
lea r8, [0x14002bf90]
mov r9d, 6
call fcn.14000b040
mov rdx, rax
lea rax, [rsp + 0x6a0]
call fcn.140014530
mov edx, 0x1e2
lea rcx, [rsp + 0x250]
lea r8, [0x14002bf98]
mov r9d, 0x18
call fcn.14000b040
mov r8, rax
mov r15, rsp
lea rcx, [rsp + 0x670]
movsx eax, byte [rcx + 0x31]
mov edx, 0x21
movsx ebx, byte [rcx + 0x32]
movsx esi, byte [rcx + 0x33]
movsx r10d, byte [rcx + 0x34]
movsx r11d, byte [rcx + 0x35]
movsx r9d, byte [rcx + 0x30]
mov dword [r15 + 0x20], eax
mov dword [r15 + 0x28], ebx
mov dword [r15 + 0x30], esi
mov dword [r15 + 0x38], r10d
mov dword [r15 + 0x40], r11d
call fcn.140017dd0
lea rax, [0x140041540]
lea rdx, [rsp + 0x670]
call fcn.140014530
mov edx, 0x1e6
lea rcx, [rsp + 0x250]
lea r8, [0x14002bfb4]
mov r9d, 0xb
call fcn.14000b040
mov rcx, r14
mov rdx, rax
lea r8, [rsp + 0x6a0]
call fcn.14000be20
movaps xmmword [rsp + 0x6f0], xmm15
cmp byte [0x140042d40], 0
je 0x14000b5aa
mov r15d, 0xbc614e
jmp 0x14000b6b1
mov eax, 1
lea rsi, [rsp + 0x6f0]
mov dword [rsi], 1
cpuid
mov dword [rsi], eax
mov dword [rsi + 4], ebx
mov dword [rsi + 8], ecx
mov dword [rsi + 0xc], edx
mov eax, 0x80000000
lea rsi, [rsp + 0x6f0]
mov r15d, dword [rsi]
mov dword [rsi], 0x80000000
cpuid
mov dword [rsi], eax
mov dword [rsi + 4], ebx
mov dword [rsi + 8], ecx
mov dword [rsi + 0xc], edx
cmp dword [rsp + 0x6f0], 4
jbe 0x14000b6b1
mov eax, 0x80000002
lea rsi, [rsp + 0x6f0]
mov dword [rsi], 0x80000002
cpuid
mov dword [rsi], eax
mov dword [rsi + 4], ebx
mov dword [rsi + 8], ecx
mov dword [rsi + 0xc], edx
mov edx, dword [rsp + 0x6f0]
xor r15d, edx
xor r15d, dword [rsp + 0x6f4]
lea rsi, [rsp + 0x6f0]
xor r15d, dword [rsi + 8]
mov eax, 0x80000003
xor r15d, dword [rsi + 0xc]
mov dword [rsi], 0x80000003
cpuid
mov dword [rsi], eax
mov dword [rsi + 4], ebx
mov dword [rsi + 8], ecx
mov dword [rsi + 0xc], edx
mov edx, dword [rsp + 0x6f0]
xor r15d, edx
xor r15d, dword [rsp + 0x6f4]
lea rsi, [rsp + 0x6f0]
xor r15d, dword [rsi + 8]
mov eax, 0x80000004
xor r15d, dword [rsi + 0xc]
mov dword [rsi], 0x80000004
cpuid
mov dword [rsi], eax
mov dword [rsi + 4], ebx
mov dword [rsi + 8], ecx
mov dword [rsi + 0xc], edx
mov eax, dword [rsp + 0x6f0]
xor r15d, eax
xor r15d, dword [rsp + 0x6f4]
xor r15d, dword [rsp + 0x6f8]
xor r15d, dword [rsp + 0x6fc]
mov edx, 0x1ec
lea rcx, [rsp + 0x250]
lea r8, [0x14002bfc0]
mov r9d, 0x18
call fcn.14000b040
mov r11, rsp
mov esi, r15d
mov r10d, r15d
mov ebx, r15d
shr esi, 0x10
lea rcx, [rsp + 0x6d0]
shr r10d, 8
mov edx, 0x20
mov r8, rax
xor r9d, r9d
shr ebx, 0x18
movzx esi, sil
movzx r10d, r10b
movzx r15d, r15b
mov qword [r11 + 0x20], 0
mov dword [r11 + 0x28], ebx
mov dword [r11 + 0x30], esi
mov dword [r11 + 0x38], r10d
mov dword [r11 + 0x40], r15d
call fcn.140017dd0
lea rax, [0x140041540]
lea rdx, [rsp + 0x6d0]
call fcn.140014530
mov edx, 0x1f7
lea rcx, [rsp + 0x250]
lea r8, [0x14002bfdc]
mov r9d, 0xb
mov esi, 2
call fcn.14000b040
mov rcx, r14
mov rdx, rax
lea r8, [rsp + 0x6d0]
call fcn.14000be20
test ebp, ebp
jne 0x14000babf
mov rbp, r13
test r13, r13
je 0x14000bc63
mov qword [rsp + 0x698], r12
lea rbx, [0x140002000]
mov edx, 0x1ff
lea rcx, [rsp + 0x250]
lea r8, [0x14002bfe8]
mov r9d, 0x1c
call fcn.14000b040
mov rcx, r14
mov rdx, rax
mov r8d, dword [rbp + 4]
call fcn.14000be20
mov edx, 0x200
lea rcx, [rsp + 0x250]
lea r8, [0x14002c008]
mov r9d, 0xb
call fcn.14000b040
mov rcx, r14
mov rdx, rax
mov r8, qword [rbp + 0x10]
call fcn.14000be20
mov edx, 0x201
lea rcx, [rsp + 0x250]
lea r8, [0x14002c014]
mov r9d, 0xc
call fcn.14000b040
mov rcx, r14
mov rdx, rax
mov r8, qword [rbp + 0x40]
call fcn.14000be20
mov edx, 0x202
lea rcx, [rsp + 0x250]
lea r8, [0x14002c024]
mov r9d, 0xc
call fcn.14000b040
mov rcx, r14
mov rdx, rax
mov r8, qword [rbp + 0x48]
call fcn.14000be20
mov edx, 0x203
lea rcx, [rsp + 0x250]
lea r8, [0x14002c034]
mov r9d, 0xb
call fcn.14000b040
mov rcx, r14
mov rdx, rax
mov r8d, dword [rbp + 0x58]
call fcn.14000be20
mov dl, byte [rbp + 0x50]
xor eax, eax
lea r11, [rax + rax*2]
cmp dl, byte [rbx + r11 + 0x3a480]
jne 0x14000b8af
mov r10b, byte [rbp + 0x51]
cmp r10b, byte [rbx + r11 + 0x3a481]
jne 0x14000b8af
mov r10b, byte [rbp + 0x52]
cmp r10b, byte [rbx + r11 + 0x3a482]
jne 0x14000b8af
mov dword [0x140044158], 1
inc eax
cmp rax, 4
jb 0x14000b87b
cmp dword [rbp + 0x58], 6
jb 0x14000ba7b
mov eax, dword [rbp + 0x64]
cmp eax, 6
je 0x14000b8d2
cmp eax, 0x47
jne 0x14000ba7b
cmp byte [0x140042d40], 0
je 0x14000b958
mov edx, 0x21e
lea rcx, [rsp + 0x250]
lea r8, [0x14002c040]
mov r9d, 0x18
call fcn.14000b040
mov rdx, rsp
lea rcx, [rsp + 0x6d0]
movzx r10d, byte [0x140042d42]
mov r8, rax
movzx r11d, byte [0x140042d40]
movzx r12d, byte [0x140042d44]
mov dword [rdx + 0x20], r10d
movzx r15d, byte [str.hl_HES]
movzx r10d, byte [0x140042d43]
mov dword [rdx + 0x28], r11d
mov dword [rdx + 0x30], r12d
mov dword [rdx + 0x38], r15d
mov dword [rdx + 0x40], r10d
mov edx, 0x20
movzx r9d, byte [0x140042d45]
call fcn.140017dd0
jmp 0x14000b9c1
mov edx, 0x228
lea rcx, [rsp + 0x250]
lea r8, [0x14002c05c]
mov r9d, 0x18
call fcn.14000b040
mov rdx, rsp
lea rcx, [rsp + 0x6d0]
movzx r10d, byte [rbp + 0x52]
mov r8, rax
movzx r11d, byte [rbp + 0x50]
movzx r12d, byte [rbp + 0x54]
mov dword [rdx + 0x20], r10d
movzx r15d, byte [rbp + 0x51]
movzx r10d, byte [rbp + 0x53]
mov dword [rdx + 0x28], r11d
mov dword [rdx + 0x30], r12d
mov dword [rdx + 0x38], r15d
mov dword [rdx + 0x40], r10d
mov edx, 0x20
movzx r9d, byte [rbp + 0x55]
call fcn.140017dd0
mov edx, 0x231
lea rcx, [rsp + 0x250]
lea r8, [0x14002c078]
mov r9d, 0x18
call fcn.14000b040
mov rdx, rsp
lea rcx, [rsp + 0x650]
movzx r10d, byte [rbp + 0x51]
mov r8, rax
movzx r11d, byte [rbp + 0x52]
movzx r12d, byte [rbp + 0x53]
mov dword [rdx + 0x20], r10d
movzx r15d, byte [rbp + 0x54]
movzx r10d, byte [rbp + 0x55]
mov dword [rdx + 0x28], r11d
mov dword [rdx + 0x30], r12d
mov dword [rdx + 0x38], r15d
mov dword [rdx + 0x40], r10d
mov edx, 0x20
movzx r9d, byte [rbp + 0x50]
call fcn.140017dd0
lea rcx, [0x140041540]
lea rdx, [rsp + 0x6d0]
call fcn.140017b88
test rax, rax
je 0x14000bd00
mov edx, 0x242
lea rcx, [rsp + 0x250]
lea r8, [0x14002c0a8]
mov r9d, 0x12
call fcn.14000b040
mov rcx, r14
mov rdx, rax
lea r8, [rsp + 0x650]
call fcn.14000be20
jmp 0x14000baa5
mov edx, 0x247
lea rcx, [rsp + 0x250]
lea r8, [0x14002c0bc]
mov r9d, 9
call fcn.14000b040
mov rcx, r14
mov rdx, rax
call fcn.14000be20
mov rbp, qword [rbp + 8]
test rbp, rbp
jne 0x14000b790
mov r12, qword [rsp + 0x698]
jmp 0x14000bbb0
mov edx, 0x24e
lea rcx, [rsp + 0x250]
lea r8, [0x14002c0c8]
mov r9d, 0x32
call fcn.14000b040
mov rcx, r14
mov edx, 0x7e2
mov r8, rax
mov r9d, ebp
call fcn.14000bdb0
cmp ebp, 0xe8
jne 0x14000bb2a
mov edx, 0x250
lea rcx, [rsp + 0x250]
lea r8, [0x14002c0fc]
mov r9d, 0x35
call fcn.14000b040
mov rcx, r14
mov edx, 0x7e2
mov r8, rax
call fcn.14000bdb0
jmp 0x14000bba7
mov rbx, rsp
mov ecx, 0x1300
xor edx, edx
mov r8d, ebp
mov r9d, 0x400
lea rax, [rsp + 0x6c8]
mov qword [rbx + 0x20], rax
mov dword [rbx + 0x28], 0
mov qword [rbx + 0x30], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x14000bba7
mov edx, 0x258
lea rcx, [rsp + 0x250]
lea r8, [0x14002c134]
mov r9d, 0xa
call fcn.14000b040
mov rcx, r14
mov edx, 0x7e2
mov r8, rax
mov r9, qword [rsp + 0x6c8]
call fcn.14000bdb0
mov rcx, qword [rsp + 0x6c8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x14000bc63
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, 2
je 0x14000bc63
mov edx, 0x323
lea rcx, [rsp + 0x250]
lea r8, [0x14002c164]
mov r9d, 6
call fcn.14000b040
mov r8, rax
mov rbx, rsp
lea rcx, [0x140043340]
mov edx, 0x200
mov r9d, esi
lea rax, [0x140041540]
mov qword [rbx + 0x20], rax
call fcn.140017dd0
mov edx, 0x324
lea rcx, [rsp + 0x250]
lea r8, [0x14002c16c]
mov r9d, 0x10
call fcn.14000b040
mov rcx, r14
mov rdx, rax
lea r8, [0x140043340]
call fcn.14000be20
movaps xmm15, xmmword [rsp + 0x700]
lea rax, [0x140043340]
add rsp, 0x718
pop rbp
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
mov edx, 0x31f
lea rcx, [rsp + 0x250]
lea r8, [0x14002c140]
mov r9d, 0x22
call fcn.14000b040
mov rcx, r14
mov edx, 0x7e4
mov r8, rax
call fcn.14000bdb0
movaps xmm15, xmmword [rsp + 0x700]
xor eax, eax
add rsp, 0x718
pop rbp
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
mov edx, 0x1b3
lea rcx, [rsp + 0x250]
lea r8, [0x14002bf34]
mov r9d, 0x1a
call fcn.14000b040
mov rcx, r14
mov rdx, rax
lea r8, [0x140043340]
call fcn.14000be20
movaps xmm15, xmmword [rsp + 0x700]
lea rax, [0x140043340]
add rsp, 0x718
pop rbp
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
lea rax, [0x140041540]
lea rdx, [rsp + 0x6d0]
call fcn.140014530
mov edx, 0x23e
lea rcx, [rsp + 0x250]
lea r8, [0x14002c094]
mov r9d, 0x10
inc esi
call fcn.14000b040
mov rcx, r14
mov rdx, rax
lea r8, [rsp + 0x650]
call fcn.14000be20
nop
jmp 0x14000baa5
mov edx, 0x1c2
lea rcx, [rsp + 0x250]
lea r8, [0x14002bf50]
mov r9d, 0x35
mov r12, qword [rsp + 0x698]
call fcn.14000b040
nop
mov rcx, r14
mov edx, 0x7d1
mov r8, rax
call fcn.14000bdb0
movaps xmm15, xmmword [rsp + 0x700]
xor eax, eax
add rsp, 0x718
pop rbp
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret