Function at 0x180001000
Capabilities:
Get hostname
Terminate process

Disassembly:
push rsi
sub rsp, 0x150
mov edx, 0x10
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x180001028
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x178], rbp
lea r8, [rsp + 0x160]
xor edx, edx
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x140], r12
xor r12d, r12d
mov qword [rsp + 0x130], r15
mov dword [rsp + 0x160], r12d
lea ecx, [rdx + 7]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov edi, dword [rsp + 0x160]
lea ebp, [r12 + 2]
lea r15, [0x180003170]
test edi, edi
je 0x1800010f1
add edi, edi
je 0x1800010a0
mov edx, edi
lea ecx, [rbp + 0x3e]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
jne 0x18000109a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsi], rax
mov dword [rsi + 8], edi
mov rdx, qword [rsi]
lea r8, [rsp + 0x160]
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1800010f1
mov edx, dword [rsi + 8]
mov ecx, r12d
mov rdi, qword [rsi]
test edx, 0xfffffffe
jbe 0x180001145
mov r8d, 0x20
mov eax, ecx
cmp word [rdi + rax*2], r12w
jne 0x1800010df
mov word [rdi + rax*2], r8w
mov edx, dword [rsi + 8]
inc ecx
mov eax, edx
shr eax, 1
cmp ecx, eax
jb 0x1800010d1
mov rdi, qword [rsi]
jmp 0x180001145
mov rdi, qword [rsi]
mov eax, dword [rsi + 8]
mov rcx, rdi
test rdi, rdi
je 0x18000110c
test eax, eax
je 0x18000110c
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000111a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], r12
mov rdx, rbp
mov dword [rsi + 8], r12d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
jne 0x18000113a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rsi + 8], ebp
mov edx, ebp
mov qword [rsi], r15
mov rdi, r15
mov eax, edx
mov edx, 0x10
mov qword [rsp + 0x138], r14
lea ecx, [rdx + 0x30]
mov byte [rax + rdi - 2], 0x2c
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x180001173
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
test eax, eax
je 0x1800011eb
mov ecx, r12d
cmp word [rsp + 0x34], r12w
je 0x18000119a
nop dword [rax]
inc ecx
cmp word [rsp + rcx*2 + 0x34], r12w
jne 0x180001190
lea edi, [rcx*2 + 2]
test edi, edi
je 0x1800011eb
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8, rax
test rax, rax
jne 0x1800011c3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [r14], r8
mov edx, r12d
mov dword [r14 + 8], edi
test edi, edi
je 0x180001241
mov ecx, edx
inc edx
movzx eax, byte [rsp + rcx + 0x34]
mov byte [rcx + r8], al
cmp edx, edi
jb 0x1800011d1
mov edi, dword [r14 + 8]
mov r8, qword [r14]
jmp 0x180001241
mov rdi, qword [r14]
mov eax, dword [r14 + 8]
mov rcx, rdi
test rdi, rdi
je 0x180001207
test eax, eax
je 0x180001207
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [r14]
test rcx, rcx
je 0x180001215
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [r14], r12
mov rdx, rbp
mov dword [r14 + 8], r12d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
jne 0x180001235
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [r14 + 8], ebp
mov edi, ebp
mov qword [r14], r15
mov r8, r15
mov edx, 0x10
mov eax, edi
mov qword [rsp + 0x170], rbx
lea ecx, [rdx + 0x30]
mov byte [rax + r8 - 2], 0x2c
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x180001270
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x20]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x1800012c9
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x20]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x1800012c9
mov rdx, qword [rsp + 0x168]
mov ecx, r12d
cmp word [rdx], r12w
je 0x1800012b0
inc ecx
cmp word [rdx + rcx*2], r12w
jne 0x1800012a7
lea edi, [rcx*2 + 2]
test edi, edi
jne 0x180001312
lea rcx, [rsp + 0x168]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov rdi, qword [rbx]
mov eax, dword [rbx + 8]
mov rcx, rdi
test rdi, rdi
je 0x1800012e4
test eax, eax
je 0x1800012e4
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800012f2
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], r12
mov rdx, rbp
mov dword [rbx + 8], r12d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
jne 0x180001374
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8, rax
test rax, rax
jne 0x180001330
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9, qword [rsp + 0x168]
mov edx, r12d
mov qword [rbx], r8
mov dword [rbx + 8], edi
test edi, edi
je 0x180001361
nop word [rax + rax]
mov ecx, edx
inc edx
movzx eax, byte [rcx + r9]
mov byte [rcx + r8], al
cmp edx, edi
jb 0x180001350
lea rcx, [rsp + 0x168]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov ebp, dword [rbx + 8]
jmp 0x18000137a
mov dword [rbx + 8], ebp
mov qword [rbx], r15
mov edx, dword [rsi + 8]
mov ecx, 0x40
mov eax, dword [r14 + 8]
add edx, ebp
add eax, 0xe
add edx, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
jne 0x1800013a4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rax], 0x690054
mov edx, r12d
mov dword [rax + 4], 0x6c0074
mov dword [rax + 8], 0x3a0065
mov word [rax + 0xc], 0x20
mov edi, dword [rsi + 8]
mov r8, qword [rsi]
test rdi, rdi
je 0x1800013e6
mov rcx, r12
nop
movzx eax, byte [rcx + r8]
inc edx
mov byte [r15 + rcx + 0xe], al
mov ecx, edx
cmp rcx, rdi
jb 0x1800013d0
mov edi, dword [rsi + 8]
mov r8, qword [r14]
mov edx, r12d
mov eax, edi
mov edi, dword [r14 + 8]
lea r9, [rax + r15]
test edi, edi
je 0x180001419
nop word [rax + rax]
mov ecx, edx
inc edx
movzx eax, byte [rcx + r8]
mov byte [rcx + r9 + 0xe], al
cmp edx, edi
jb 0x180001400
mov edi, dword [r14 + 8]
mov eax, dword [rsi + 8]
mov r9d, dword [rbx + 8]
add rdi, r15
mov r10, qword [rbx]
mov edx, r12d
mov r8d, eax
add rdi, r8
test r9d, r9d
je 0x180001456
nop dword [rax]
nop word [rax + rax]
mov ecx, edx
inc edx
movzx eax, byte [rcx + r10]
mov byte [rcx + rdi + 0xe], al
cmp edx, r9d
jb 0x180001440
mov r8d, dword [rsi + 8]
mov rdi, qword [rsi]
mov rcx, rdi
test rdi, rdi
je 0x180001470
test r8d, r8d
je 0x180001470
mov ecx, r8d
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000147e
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], r12
mov qword [rsi + 4], r12
mov rcx, rsi
mov qword [rsi + 8], r12
mov dword [rsi], r12d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [r14]
mov eax, dword [r14 + 8]
mov rcx, rdi
test rdi, rdi
je 0x1800014ae
test eax, eax
je 0x1800014ae
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [r14]
test rcx, rcx
je 0x1800014bc
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [r14], r12
mov qword [r14 + 4], r12
mov rcx, r14
mov qword [r14 + 8], r12
mov dword [r14], r12d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rbx]
mov eax, dword [rbx + 8]
mov rcx, rdi
test rdi, rdi
je 0x1800014eb
test eax, eax
je 0x1800014eb
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800014f9
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], r12
mov qword [rbx + 4], r12
mov rcx, rbx
mov qword [rbx + 8], r12
mov dword [rbx], r12d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x170]
mov rax, r15
mov r15, qword [rsp + 0x130]
mov r14, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x148]
mov rbp, qword [rsp + 0x178]
mov r12, qword [rsp + 0x140]
add rsp, 0x150
pop rsi
ret