Function at 0x18005a440
Capabilities:
Get hostname
Get session user name

Disassembly:
push rbp
push rsi
push r12
push r14
lea rbp, [rsp - 0x78]
sub rsp, 0x178
movaps xmmword [rsp + 0x160], xmm6
mov rax, qword [0x180195040]
xor rax, rsp
mov qword [rbp + 0x50], rax
movdqa xmm6, xmmword [0x18017c070]
xorps xmm0, xmm0
xor r12d, r12d
mov qword [rsp + 0x38], rcx
mov r14, rcx
mov qword [rbp - 0x70], r12
movups xmmword [rbp - 0x80], xmm0
mov esi, 0xf
lea rcx, [rbp - 0x40]
movups xmmword [rsp + 0x60], xmm0
mov byte [rbp - 0x80], r12b
mov byte [rsp + 0x60], r12b
mov qword [rbp - 0x68], rsi
movdqu xmmword [rsp + 0x70], xmm6
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x18005a4c0
lea rdx, [rbp - 0x3c]
lea rcx, [rsp + 0x60]
call fcn.18005cad0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180059fe0
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], rsi
jbe 0x18005a4dc
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.18005c750
mov rdx, qword [rsp + 0x58]
cmp rdx, rsi
jbe 0x18005a524
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005a51f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005a909
call fcn.1800f1af0
xorps xmm0, xmm0
mov byte [rsp + 0x40], r12b
movups xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x60], r12b
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x10
movdqu xmmword [rsp + 0x50], xmm6
mov dword [rsp + 0x20], 0x10
movdqu xmmword [rsp + 0x70], xmm6
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x18005a596
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18005cad0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x18005a596
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18005cad0
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.180059fe0
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], rsi
jbe 0x18005a5b1
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.18005c750
mov rdx, qword [rbp - 0x48]
cmp rdx, rsi
jbe 0x18005a5f7
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005a5f2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005a90f
call fcn.1800f1af0
xor eax, eax
mov qword [rsp + 0x1a8], rbx
xorps xmm0, xmm0
mov byte [rbp - 0x60], r12b
movdqu xmmword [rsp + 0x20], xmm0
xor ecx, ecx
cpuid
mov dword [rsp + 0x24], ebx
mov ebx, r12d
movdqu xmmword [rbp - 0x50], xmm6
mov dword [rsp + 0x20], eax
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], edx
movdqu xmmword [rbp - 0x50], xmm6
mov byte [rbp - 0x60], r12b
nop word [rax + rax]
movsxd rax, ebx
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x50], r12
mov r8d, 4
mov qword [rsp + 0x58], r12
lea rcx, [rsp + 0x40]
lea rdx, [rdx + rax*4]
movups xmmword [rsp + 0x40], xmm0
call fcn.18005dfa0
cmp qword [rsp + 0x58], rsi
lea rdx, [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rcx, [rbp - 0x60]
cmova rdx, qword [rsp + 0x40]
call fcn.18005c750
mov rdx, qword [rsp + 0x58]
cmp rdx, rsi
jbe 0x18005a6c8
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005a6c3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005a915
call fcn.1800f1af0
inc ebx
cmp ebx, 3
jl 0x18005a640
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.180059fe0
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], rsi
jbe 0x18005a6ee
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.18005c750
mov rdx, qword [rsp + 0x78]
cmp rdx, rsi
jbe 0x18005a736
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005a731
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005a915
call fcn.1800f1af0
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], r12b
movabs rax, 0x3d954da05c6511a2
mov qword [rsp + 0x20], rax
movabs rcx, 0xc35fa6211be4c2ac
mov rax, qword [rsp + 0x20]
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x48], rax
movabs rax, 0x3d954da0033557ef
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x40]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rsp + 0x170], r15
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x18005a7c0
mov r15, qword [rbp - 0x70]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, rbx
jb 0x18005a91b
mov qword [rsp + 0x1b0], rdi
lea rax, [rbp - 0x80]
mov rdi, qword [rbp - 0x80]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [rsp + 0x1b8], r13
mov r13, qword [rbp - 0x68]
cmp r13, rsi
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
lea r12, [r15 + rbx]
cmova rax, rdi
mov qword [rsp + 0x20], rax
cmp r12, rsi
jbe 0x18005a859
mov rsi, r12
or rsi, 0xf
cmp rsi, rcx
jbe 0x18005a837
mov rsi, rcx
jmp 0x18005a843
mov eax, 0x16
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
call fcn.180028220
mov r14, rax
mov rax, qword [rsp + 0x38]
mov qword [rax], r14
jmp 0x18005a85c
mov rax, r14
mov r8, rbx
mov qword [rax + 0x10], r12
lea rdx, [rbp + 0x40]
mov qword [rax + 0x18], rsi
mov rcx, r14
call fcn.180117d70
mov rdx, qword [rsp + 0x20]
lea rcx, [r14 + rbx]
mov r8, r15
call fcn.180117d70
mov byte [r14 + r12], 0
cmp r13, 0xf
jbe 0x18005a8bc
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x18005a8b4
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005a903
mov rcx, rdi
call fcn.1800f1af0
mov rax, qword [rsp + 0x38]
mov r13, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1b0]
mov r15, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x1a8]
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1800f1520
movaps xmm6, xmmword [rsp + 0x160]
add rsp, 0x178
pop r14
pop r12
pop rsi
pop rbp
ret
call fcn.1800f5950
int3
call fcn.1800f5950
int3
call fcn.1800f5950
int3
call fcn.1800f5950
int3
call fcn.180004810
int3