Function at 0x140046f90
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov r12, rcx
mov rax, qword [0x1400c95d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
call fcn.14001ccc0
movzx ebp, byte [r12 + 0x17]
test bpl, bpl
mov rcx, qword [r12 + 8]
mov rax, rbp
cmovs rax, rcx
test rax, rax
je 0x140047802
cmp rax, 1
je 0x14004704e
test bpl, bpl
mov rdx, qword [r12]
mov rbx, r12
cmovs rbx, rdx
movzx edi, word [rbx]
cmp di, 0x27
je 0x140047008
cmp di, 0x22
jne 0x14004704e
cmp word [rbx + rax*2 - 2], 0x22
je 0x140047010
jmp 0x14004704e
cmp word [rbx + rax*2 - 2], 0x27
jne 0x14004704e
test bpl, bpl
js 0x140047028
lea rax, [rbp - 1]
mov byte [r12 + 0x17], al
lea rax, [r12 + rbp*2]
add rax, 0xfffffffffffffffe
jmp 0x140047039
lea rax, [rcx - 1]
mov qword [r12 + 8], rax
lea rax, [rdx + rcx*2]
add rax, 0xfffffffffffffffe
mov word [rax], 0
mov r8d, 1
mov rcx, r12
xor edx, edx
call fcn.14001d720
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rsp + 0x38], rax
je 0x14004707c
lea rdx, [0x1400aa042]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
jmp 0x14004707c
xor r15d, r15d
mov r13, r15
shl r13, 4
lea rax, str._windows
mov rbp, qword [r13 + rax]
mov rcx, rbp
call fcn.140090808
movzx ebx, byte [r12 + 0x17]
mov rcx, r12
test bl, bl
jns 0x1400470ab
mov rcx, qword [r12]
test rax, rax
je 0x140047136
test bl, bl
jns 0x1400470bd
mov rbx, qword [r12 + 8]
cmp rbx, rax
jl 0x140047255
lea r8, [rcx + rbx*2]
movzx esi, word [rbp]
mov rdi, rcx
mov rdx, rbx
sub rdx, rax
inc rdx
je 0x140047255
inc rbx
cmp word [rdi], si
je 0x1400470f9
add rdi, 2
dec rbx
cmp rax, rbx
jne 0x1400470e3
jmp 0x140047255
test rdi, rdi
je 0x140047255
mov edx, 1
cmp rax, rdx
je 0x1400471f4
movzx ebx, word [rdi + rdx*2]
cmp bx, word [rbp + rdx*2]
lea rdx, [rdx + 1]
je 0x140047107
add rdi, 2
mov rbx, r8
sub rbx, rdi
sar rbx, 1
cmp rbx, rax
jge 0x1400470d1
jmp 0x140047255
xor edi, edi
lea rsi, [rsp + 0x60]
mov rcx, rbp
call fcn.140090808
mov r14, rax
lea rax, str._windows
mov r8d, dword [r13 + rax + 8]
xor ecx, ecx
mov rdx, rsi
xor r9d, r9d
call qword [rsp + 0x28]
test eax, eax
jne 0x14004716b
mov word [rsp + 0x60], 0
lea r13, [rsp + 0x48]
mov rcx, r13
mov rdx, rsi
call fcn.140019bf0
movzx esi, byte [rsp + 0x5f]
test sil, sil
mov rcx, qword [rsp + 0x50]
mov rax, rsi
cmovs rax, rcx
test rax, rax
je 0x14004721a
test sil, sil
mov rdx, qword [rsp + 0x48]
mov rbp, r13
cmovs rbp, rdx
cmp word [rbp + rax*2 - 2], 0x5c
jne 0x14004721a
movzx ebx, byte [r12 + 0x17]
mov rax, rbx
test bl, bl
jns 0x1400471c1
mov rax, qword [r12 + 8]
mov rbp, r14
add rbp, rdi
cmp rax, rbp
jbe 0x14004721a
mov rax, r12
test bl, bl
jns 0x1400471d7
mov rax, qword [r12]
cmp word [rax + rbp*2], 0x5c
jne 0x14004721a
test sil, sil
js 0x14004720a
lea rax, [rsi - 1]
mov byte [rsp + 0x5f], al
mov word [rsp + rsi*2 + 0x46], 0
jmp 0x14004721a
cmp r8, rdi
je 0x140047255
sub rdi, rcx
cmp rdi, 0xfffffffffffffffe
je 0x140047255
sar rdi, 1
jmp 0x140047138
lea rax, [rcx - 1]
mov qword [rsp + 0x50], rax
mov word [rdx + rcx*2 - 2], 0
movzx eax, byte [rsp + 0x5f]
test al, al
cmovs rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
cmovns r9, r13
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rdi
mov r8, r14
call fcn.14001d7a4
xor eax, eax
cmp byte [rsp + 0x5f], al
jns 0x140047255
mov rcx, qword [rsp + 0x48]
call fcn.1400795d8
inc r15
cmp r15, 7
jne 0x14004707f
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x14004728e
lea rdx, [0x1400aa0f2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x14004728e
mov dl, byte [r12 + 0x17]
test dl, dl
mov r9, qword [r12]
mov r10, qword [r12 + 8]
mov rbx, r12
cmovs rbx, r9
movzx eax, dl
mov rcx, rax
cmovs rcx, r10
cmp rcx, 0xc
jl 0x1400473d4
lea r8, [rbx + rcx*2]
lea rsi, str._user_name
mov rdi, rbx
add rcx, 0xfffffffffffffff5
je 0x1400473d4
cmp word [rdi], 0x24
je 0x1400472e5
add rdi, 2
dec rcx
jne 0x1400472d1
jmp 0x1400473d4
test rdi, rdi
je 0x1400473d4
mov ecx, 1
cmp rcx, 0xc
je 0x140047322
movzx ebp, word [rdi + rcx*2]
cmp bp, word [rsi + rcx*2]
lea rcx, [rcx + 1]
je 0x1400472f3
add rdi, 2
mov rbp, r8
sub rbp, rdi
mov rcx, rbp
sar rcx, 1
cmp rbp, 0x18
jge 0x1400472c7
jmp 0x1400473d4
cmp r8, rdi
je 0x1400473d4
sub rdi, rbx
cmp rdi, 0xfffffffffffffffe
je 0x1400473d4
lea rbp, [rsp + 0x48]
mov dword [rbp], 0
xor ecx, ecx
mov rdx, rbp
call r14
mov ecx, dword [rbp]
test rcx, rcx
je 0x1400473c3
sar rdi, 1
add rcx, rcx
call fcn.14007960c
mov rbp, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call r14
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov rdx, rbp
call fcn.140019bf0
movzx eax, byte [rsp + 0x77]
test al, al
jns 0x140047390
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xc
mov rcx, r12
mov rdx, rdi
mov r9, rsi
call fcn.14001d7a4
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400473bb
mov rcx, qword [rsp + 0x60]
call fcn.1400795d8
mov rcx, rbp
call fcn.140079614
mov dl, byte [r12 + 0x17]
mov r9, qword [r12]
mov r10, qword [r12 + 8]
movzx eax, dl
test dl, dl
cmovns r9, r12
cmovs rax, r10
cmp rax, 0xf
jl 0x140047500
lea rdx, [r9 + rax*2]
lea rbp, str._machine_name
mov rdi, r9
add rax, 0xfffffffffffffff2
je 0x140047500
cmp word [rdi], 0x24
je 0x140047414
add rdi, 2
dec rax
jne 0x140047400
jmp 0x140047500
test rdi, rdi
je 0x140047500
mov eax, 1
cmp rax, 0xf
je 0x140047452
movzx ecx, word [rdi + rax*2]
cmp cx, word [rbp + rax*2]
lea rax, [rax + 1]
je 0x140047422
add rdi, 2
mov rcx, rdx
sub rcx, rdi
mov rax, rcx
sar rax, 1
cmp rcx, 0x1e
jge 0x1400473f6
jmp 0x140047500
cmp rdx, rdi
je 0x140047500
sub rdi, r9
cmp rdi, 0xfffffffffffffffe
je 0x140047500
lea rbx, [rsp + 0x48]
mov dword [rbx], 0
mov ecx, 5
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [rbx]
test rcx, rcx
je 0x140047500
sar rdi, 1
add rcx, rcx
call fcn.14007960c
mov rbx, rax
lea r8, [rsp + 0x48]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rbp, [rsp + 0x60]
mov rcx, rbp
mov rdx, rbx
call fcn.140019bf0
movzx eax, byte [rbp + 0x17]
test al, al
jns 0x1400474cd
mov rax, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r12
mov rdx, rdi
mov r9, rbp
call fcn.14001d7a4
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400474f8
mov rcx, qword [rsp + 0x60]
call fcn.1400795d8
mov rcx, rbx
call fcn.140079614
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x14004752c
lea rdx, [0x1400aa162]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
jmp 0x14004752c
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
je 0x140047553
lea rdx, [0x1400aa19a]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140047553
mov r15b, byte [r12 + 0x17]
test r15b, r15b
mov r10, qword [r12]
mov r9, qword [r12 + 8]
mov rbx, r12
cmovs rbx, r10
movzx edi, r15b
mov rcx, rdi
cmovs rcx, r9
cmp rcx, 0xe
jl 0x1400476a3
lea r8, [rbx + rcx*2]
lea rsi, str._client_name
mov rbp, rbx
add rcx, 0xfffffffffffffff3
je 0x1400476a3
cmp word [rbp], 0x24
je 0x1400475ad
add rbp, 2
dec rcx
jne 0x140047598
jmp 0x1400476a3
test rbp, rbp
je 0x1400476a3
mov ecx, 1
cmp rcx, 0xe
je 0x1400475eb
movzx edx, word [rbp + rcx*2]
cmp dx, word [rsi + rcx*2]
lea rcx, [rcx + 1]
je 0x1400475bb
add rbp, 2
mov r11, r8
sub r11, rbp
mov rcx, r11
sar rcx, 1
cmp r11, 0x1c
jge 0x14004758e
jmp 0x1400476a3
cmp r8, rbp
je 0x1400476a3
sub rbp, rbx
cmp rbp, 0xfffffffffffffffe
je 0x1400476a3
mov rbx, rax
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
call qword [rsp + 0x30]
test eax, eax
je 0x14004768e
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140019bf0
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14004765c
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xe
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.14001d7a4
mov rcx, qword [rsp + 0x48]
call rbx
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x14004768e
mov rcx, qword [rsp + 0x60]
call fcn.1400795d8
mov r15b, byte [r12 + 0x17]
mov r10, qword [r12]
mov r9, qword [r12 + 8]
movzx edi, r15b
mov rax, rbx
test r15b, r15b
cmovns r10, r12
cmovs rdi, r9
cmp rdi, 0xf
jl 0x1400477c6
lea rdx, [r10 + rdi*2]
lea rbx, str._session_name
mov rbp, r10
add rdi, 0xfffffffffffffff2
je 0x1400477c6
cmp word [rbp], 0x24
je 0x1400476e5
add rbp, 2
dec rdi
jne 0x1400476d0
jmp 0x1400477c6
test rbp, rbp
je 0x1400477c6
mov ecx, 1
cmp rcx, 0xf
je 0x140047723
movzx edi, word [rbp + rcx*2]
cmp di, word [rbx + rcx*2]
lea rcx, [rcx + 1]
je 0x1400476f3
add rbp, 2
mov rcx, rdx
sub rcx, rbp
mov rdi, rcx
sar rdi, 1
cmp rcx, 0x1e
jge 0x1400476c6
jmp 0x1400477c6
cmp rdx, rbp
je 0x1400477c6
sub rbp, r10
cmp rbp, 0xfffffffffffffffe
je 0x1400477c6
mov rdi, rax
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
call qword [rsp + 0x30]
test eax, eax
je 0x1400477c6
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140019bf0
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140047794
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.14001d7a4
mov rcx, qword [rsp + 0x48]
call rdi
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400477c6
mov rcx, qword [rsp + 0x60]
call fcn.1400795d8
test r13, r13
je 0x1400477d4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x1400477e2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400477f2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140047802
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140079940
mov rax, r12
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret