Function at 0x2000018f0
Capabilities:
Contain obfuscated stackstrings
Get hostname
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push r12
push r13
sub rsp, 0xe0
xor eax, eax
xor r13d, r13d
mov esi, r8d
mov rbx, rdx
mov r12, rcx
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov word [rsp + 0x31], ax
mov byte [rsp + 0x33], al
mov byte [rsp + 0x38], al
mov qword [rsp + 0x39], rax
mov dword [rsp + 0x41], eax
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
mov byte [rsp + 0x48], al
mov qword [rsp + 0x49], rax
mov byte [rsp + 0x51], al
mov byte [r11 - 0x68], al
mov qword [r11 - 0x67], rax
mov qword [r11 - 0x5f], rax
mov qword [r11 - 0x57], rax
mov qword [r11 - 0x4f], rax
mov qword [r11 - 0x47], rax
mov qword [r11 - 0x3f], rax
mov qword [r11 - 0x37], rax
mov dword [r11 - 0x2f], eax
mov word [r11 - 0x2b], ax
mov byte [r11 - 0x29], al
mov dword [r11 + 0x20], r13d
test rcx, rcx
je 0x200001da7
test rdx, rdx
je 0x200001da7
or rbp, 0xffffffffffffffff
mov qword [r11 + 0x10], rdi
mov rdi, r12
mov rcx, rbp
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x200001c85
lea rcx, [r11 + 8]
call fcn.2000013c0
test esi, esi
je 0x2000019c5
movzx edi, byte [rsp + 0x110]
or dil, 0x80
jmp 0x2000019cd
mov dil, byte [rsp + 0x110]
call fcn.200007a10
test eax, eax
je 0x2000019e4
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x2000019e4
or dil, 0x40
movzx eax, dil
lea rcx, [rsp + 0x110]
shl eax, 0x18
mov dword [rsp + 0x110], eax
call fcn.200001510
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
lea rdx, [0x200017d18]
lea rcx, [rsp + 0x48]
movzx r8d, ax
call fcn.200007d18
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x30303030
mov dword [rsp + 0x24], 0x30303030
mov dword [rsp + 0x28], 0x30303030
mov dword [rsp + 0x2c], 0x30303030
mov byte [rsp + gethostbyname], 0x30
call fcn.2000011a0
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x128], 0x40
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor eax, eax
lea rdi, [rsp + 0xa0]
mov rcx, rbp
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 8
mov rsi, rcx
mov dword [rsp + 0x128], ecx
jge 0x200001ac5
movsxd rax, ecx
mov dl, 0x5f
lea rcx, [rsp + rax + 0xa0]
mov eax, 8
sub eax, esi
mov r8d, eax
mov edi, eax
call fcn.20000d940
add esi, edi
movsxd rax, esi
mov dword [rsp + 0x128], esi
mov byte [rsp + rax + 0xa0], r13b
mov r8d, dword [rsp + 0x110]
lea rdx, [0x200017d20]
lea rcx, [rsp + 0x60]
call fcn.200007d18
movzx eax, byte [rsp + 0xa7]
movzx edx, byte [rsp + 0x60]
mov byte [r12 + 1], al
movzx eax, byte [rsp + 0x3f]
mov byte [r12], dl
mov byte [r12 + 2], al
movzx eax, byte [rsp + 0x25]
mov byte [r12 + 3], al
movzx eax, byte [rsp + 0x21]
mov byte [r12 + 4], al
movzx eax, byte [rsp + 0xa3]
mov byte [r12 + 5], al
movzx eax, byte [rsp + 0x48]
mov byte [r12 + 6], al
movzx eax, byte [rsp + 0x67]
mov byte [r12 + 7], al
movzx eax, byte [rsp + 0x20]
mov byte [r12 + 8], al
movzx eax, byte [rsp + 0x4b]
mov byte [r12 + 9], al
movzx eax, byte [rsp + 0xa4]
mov byte [r12 + 0xa], al
movzx eax, byte [rsp + 0x3a]
mov byte [r12 + 0xb], al
movzx eax, byte [rsp + 0x65]
mov byte [r12 + 0xc], al
movzx eax, byte [rsp + 0x24]
mov byte [r12 + 0xd], al
movzx eax, byte [rsp + 0x39]
mov byte [r12 + 0xe], al
movzx eax, byte [rsp + 0x2b]
mov byte [r12 + 0xf], al
movzx eax, byte [rsp + 0x66]
mov byte [r12 + 0x10], al
movzx eax, byte [rsp + 0x3b]
mov byte [r12 + 0x11], al
movzx eax, byte [rsp + 0xa6]
mov byte [r12 + 0x12], al
movzx eax, byte [rsp + 0x2a]
mov byte [r12 + 0x13], al
movzx eax, byte [rsp + 0xa5]
mov byte [r12 + 0x14], al
movzx eax, byte [rsp + 0x26]
mov byte [r12 + 0x15], al
movzx eax, byte [rsp + 0x49]
mov byte [r12 + 0x16], al
movzx eax, byte [rsp + 0xa1]
mov byte [r12 + 0x17], al
movzx eax, byte [rsp + 0x3c]
mov byte [r12 + 0x18], al
movzx eax, byte [rsp + 0x27]
mov byte [r12 + 0x19], al
movzx eax, byte [rsp + 0x63]
mov byte [r12 + 0x1a], al
movzx eax, byte [rsp + 0x23]
mov byte [r12 + 0x1b], al
movzx eax, byte [rsp + 0x4a]
mov byte [r12 + 0x1c], al
movzx eax, byte [rsp + 0x62]
mov byte [r12 + 0x1d], al
movzx eax, byte [rsp + 0x3d]
mov byte [r12 + 0x1e], al
movzx eax, byte [rsp + 0xa0]
mov byte [r12 + 0x1f], al
movzx eax, byte [rsp + 0x22]
mov byte [r12 + 0x20], al
movzx eax, byte [rsp + 0x3e]
mov byte [r12 + 0x21], al
movzx eax, byte [rsp + 0x64]
mov byte [r12 + 0x22], al
movzx eax, byte [rsp + 0x28]
mov byte [r12 + 0x23], al
movzx eax, byte [rsp + 0x61]
mov byte [r12 + 0x24], al
movzx eax, byte [rsp + 0xa2]
mov byte [r12 + 0x25], al
movzx eax, byte [rsp + 0x38]
mov byte [r12 + 0x26], al
movzx eax, byte [rsp + 0x29]
mov byte [r12 + 0x27], al
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x200001cd1
call fcn.2000086e8
mov edi, eax
mov eax, 0x80008001
imul edi
add edx, edi
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea rcx, [rsp + 0x60]
imul edx, edx, 0xffff
sub edi, edx
lea rdx, str._04X
movzx r8d, di
call fcn.200007d18
jmp 0x200001ce4
lea rcx, [rsp + 0x60]
mov r8d, 4
mov rdx, rbx
call fcn.200008000
movzx ecx, byte [rsp + 0x62]
movzx eax, byte [rsp + 0x60]
mov rdx, r12
mov byte [rbx], al
movzx eax, byte [rsp + 0x61]
mov byte [rbx + 2], cl
mov byte [rbx + 1], al
movzx eax, byte [rsp + 0x63]
mov byte [rbx + 4], cl
lea rcx, [rsp + 0x60]
mov r8d, 0x28
mov byte [rbx + 3], al
mov byte [rbx + 5], al
call fcn.20000e2d0
mov edx, dword [rbx]
mov dword [rsp + 0x88], edx
lea rcx, [rsp + 0x60]
or r8d, 0xffffffff
mov edx, 0x2c
call fcn.200001820
lea rdx, str._08X
lea rcx, [rsp + 0x60]
mov r8d, eax
call fcn.200007d18
movzx ecx, byte [rsp + 0x61]
movzx edx, byte [rsp + 0x60]
mov rdi, qword [rsp + 0x118]
mov byte [rbx + 3], cl
movzx ecx, byte [rsp + 0x62]
mov byte [rbx + 6], cl
movzx ecx, byte [rsp + 0x63]
mov byte [rbx + 2], dl
mov byte [rbx + 7], cl
movzx ecx, byte [rsp + 0x64]
mov ax, r13w
mov byte [rbx + 8], cl
movzx ecx, byte [rsp + 0x65]
mov byte [rbx + 9], cl
movzx ecx, byte [rsp + 0x66]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rsp + 0x67]
mov byte [rbx + 0xb], cl
add rsp, 0xe0
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
or rax, 0xffffffffffffffff
add rsp, 0xe0
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret