Function at 0x140049300
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x1400a5768]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor r14d, r14d
mov rdi, rcx
test byte [0x1400a6ec0], 1
mov dword [rsp + 0x20], r14d
je 0x14004934e
lea rdx, [0x140095a38]
call fcn.1400253d0
mov rax, qword [rdi + 8]
mov qword [0x1400a7358], rax
mov rax, qword [rdi]
mov qword [0x1400a7300], rax
call fcn.1400491c0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x198
call sub.msvcrt.dll_memset
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea r15, [0x14008bc78]
lea rbp, [0x1400a52b8]
test eax, eax
je 0x1400493c4
mov rcx, qword [0x1400a52b8]
cmp rcx, rbp
je 0x1400493ce
test byte [rcx + 0x1c], 0x20
je 0x1400493ce
mov rcx, qword [rcx + 0x10]
mov edx, 0xa
mov r9d, eax
mov r8, r15
call fcn.140024908
jmp 0x1400493ce
mov dword [0x1400a7310], 1
call sym.spoolsv.exe_PrvSplIsUpgrade
lea rdx, [rsp + 0x24]
mov dword [0x1400a6e40], 0x5c005c
lea rcx, [0x1400a6e44]
mov dword [rsp + 0x24], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x14004944e
mov rax, qword [0x1400a52b8]
cmp rax, rbp
je 0x14004942e
test byte [rax + 0x1c], 0x20
je 0x14004942e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [0x1400a52b8]
mov edx, 0xb
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140024908
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
xor r8d, r8d
lea rcx, [0x140095848]
mov edx, eax
call fcn.140044b3c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
call fcn.140048c98
mov ecx, eax
call fcn.14005b9d8
mov ebx, eax
test eax, eax
jns 0x1400494a7
mov rcx, qword [0x1400a52b8]
cmp rcx, rbp
je 0x140049486
test byte [rcx + 0x1c], 0x20
je 0x140049486
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, eax
mov r8, r15
call fcn.140024908
mov ecx, ebx
call fcn.14002b1e4
mov edx, eax
lea rcx, [0x140095988]
xor r8d, r8d
call fcn.140044b3c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
lea rdx, [0x1400a72fc]
lea rcx, [0x1400a7308]
call sym.spoolsv.exe_PrvBuildOtherNamesFromMachineName
test eax, eax
jne 0x1400494fb
mov rax, qword [0x1400a52b8]
cmp rax, rbp
je 0x1400494f1
test byte [rax + 0x1c], 0x20
je 0x1400494f1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [0x1400a52b8]
mov edx, 0xd
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140024908
mov word [0x1400a6c30], r14w
jmp 0x140049521
mov r8, qword [0x1400a7308]
lea rcx, [0x1400a6c34]
mov dword [0x1400a6c30], 0x5c005c
mov edx, 0x102
mov r8, qword [r8 + 8]
call fcn.140009080
call fcn.14005e170
mov ebx, eax
test eax, eax
jns 0x140049573
mov rcx, qword [0x1400a52b8]
cmp rcx, rbp
je 0x140049552
test byte [rcx + 0x1c], 0x20
je 0x140049552
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r9d, eax
mov r8, r15
call fcn.140024908
mov ecx, ebx
call fcn.14002b1e4
mov edx, eax
lea rcx, [0x1400958b8]
xor r8d, r8d
call fcn.140044b3c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
call fcn.14005e4e0
mov ebx, eax
test eax, eax
jns 0x1400495c5
mov rcx, qword [0x1400a52b8]
cmp rcx, rbp
je 0x1400495a4
test byte [rcx + 0x1c], 0x20
je 0x1400495a4
mov rcx, qword [rcx + 0x10]
mov edx, 0xf
mov r9d, eax
mov r8, r15
call fcn.140024908
mov ecx, ebx
call fcn.14002b1e4
mov edx, eax
lea rcx, [0x1400959e8]
xor r8d, r8d
call fcn.140044b3c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, str.localspl.dll
call fcn.140048ec4
mov qword [0x1400a6f10], rax
test rax, rax
jne 0x14004962a
mov rcx, qword [0x1400a52b8]
cmp rcx, rbp
je 0x14004960a
test byte [rcx + 0x1c], 0x20
je 0x14004960a
mov r9d, dword [rsp + 0x20]
lea edx, [rax + 0x10]
mov rcx, qword [rcx + 0x10]
mov r8, r15
call fcn.140024908
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
xor r8d, r8d
lea rcx, [0x140095a48]
mov edx, eax
call fcn.140044b3c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, qword [rax + 0x10]
mov edx, 0x190
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400a7070], rax
test rax, rax
jne 0x140049698
mov rax, qword [0x1400a52b8]
cmp rax, rbp
je 0x140049678
test byte [rax + 0x1c], 0x20
je 0x140049678
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [0x1400a52b8]
mov edx, 0x11
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140024908
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
xor r8d, r8d
lea rcx, [0x140095a48]
mov edx, eax
call fcn.140044b3c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
call fcn.140048d28
mov rcx, qword [0x1400a6ee8]
call fcn.14000c6a0
mov dword [0x1400a6f08], 1
call fcn.14005e0a4
call fcn.140053cf4
call fcn.14004aa20
call fcn.14004abb0
call fcn.14005b1d8
call fcn.14004b8bc
mov rcx, qword [0x1400a6ef0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test byte [0x1400a6ec0], 1
je 0x1400496f8
lea rdx, [0x140095918]
call fcn.1400253d0
call fcn.140049c88
int3