Function at 0x140068f20
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x120
mov rax, qword [0x140139980]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [0x140145e30]
mov r15, rdx
mov qword [rbp - 0x48], rdx
test rax, rax
jne 0x140068f80
lea rcx, str.Rpcrt4.dll
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [0x140145e30], rax
test rax, rax
je 0x140069028
lea rdx, str.UuidCreate
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140069028
lea rcx, [rbp - 0x40]
call rax
test eax, eax
je 0x140068fb1
cmp eax, 0x720
je 0x140068fb1
cmp eax, 0x6cb
jne 0x140069028
movzx edx, byte [rbp - 0x32]
mov rcx, r15
movzx r8d, byte [rbp - 0x33]
movzx r9d, byte [rbp - 0x34]
movzx eax, byte [rbp - 0x31]
movzx r10d, byte [rbp - 0x35]
movzx r11d, byte [rbp - 0x36]
movzx ebx, byte [rbp - 0x37]
movzx edi, byte [rbp - 0x38]
movzx esi, word [rbp - 0x3a]
movzx r14d, word [rbp - 0x3c]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], edx
mov edx, 0x25
mov dword [rsp + 0x58], r8d
lea r8, str._08lX__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbp - 0x40]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.14006ee9c
jmp 0x140069158
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x80], rax
sar rax, 8
mov qword [rbp - 0x58], rax
mov rax, rcx
sar rax, 0x10
mov qword [rbp - 0x60], rax
mov rax, rcx
sar rax, 0x18
mov qword [rbp - 0x68], rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
lea r14, [rbp - 0x80]
mov dword [rbp - 0x78], 0x10
mov ecx, eax
mov dword [rbp - 0x70], eax
mov r12d, ecx
sar eax, 8
mov r15d, ecx
sar r12d, 0x10
lea rsi, [rbp - 0x80]
sar r15d, 0x18
lea rdi, [rbp - 0x80]
mov dword [rbp - 0x74], eax
lea rcx, [rbp - 0x20]
shr r14, 8
lea rdx, [rbp - 0x78]
shr rsi, 0x10
lea rbx, [rbp - 0x80]
shr rdi, 0x18
call qword [sym.imp.kernel32.dll_GetComputerNameA]
mov eax, dword [rbp - 0x20]
movzx r9d, byte [rbp - 0x50]
mov dword [rbp - 0x24], eax
movzx r13d, byte [rbp - 0x21]
mov dword [rsp + 0x90], r13d
movzx r13d, byte [rbp - 0x22]
mov dword [rsp + 0x88], r13d
movzx r13d, byte [rbp - 0x23]
mov dword [rsp + 0x80], r13d
movzx ecx, al
mov dword [rsp + 0x78], ecx
mov rcx, qword [rbp - 0x48]
movzx eax, dil
movzx edi, byte [rbp - 0x74]
mov dword [rsp + 0x70], eax
movzx edx, sil
movzx esi, byte [rbp - 0x70]
mov dword [rsp + 0x68], edx
mov edx, 0x25
movzx r8d, r14b
movzx r14d, byte [rbp - 0x68]
mov dword [rsp + 0x60], r8d
lea r8, str._02X_02X_02X_02X__02X_02X__02X_02X__02X_02X__02X_02X_02X_02X_02X_02X
movzx r10d, bl
mov dword [rsp + 0x58], r10d
movzx r11d, r15b
movzx r15d, byte [rbp - 0x60]
mov dword [rsp + 0x50], r11d
movzx ebx, r12b
movzx r12d, byte [rbp - 0x58]
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
call fcn.14006ee9c
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400a6970
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret