Function at 0x180001ef8
Capabilities:
Get hostname
Get session user name

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov ecx, dword [0x18000f520]
xor eax, eax
xor ebx, ebx
mov byte [rsp + 0x30], bl
mov qword [r11 - 0x27], rax
mov qword [r11 - 0x1f], rax
mov qword [r11 - 0x17], rax
lea rdx, [r11 - 0x28]
mov word [rsp + 0x49], ax
mov byte [rsp + 0x4b], al
call fcn.180003bfc
test eax, eax
je 0x180001f55
mov al, byte [rsp + 0x31]
cmp al, 2
jbe 0x180001f55
movzx eax, al
sub eax, 2
test eax, eax
jle 0x180001f55
lea rcx, [rsp + 0x3c]
mov edx, eax
add ebx, dword [rcx]
add rcx, 4
sub rdx, 1
jne 0x180001f49
test ebx, ebx
mov dword [0x18000f52c], ebx
jne 0x180001f67
lea eax, [rbx + 5]
jmp 0x180002155
mov rcx, qword [0x18000f510]
xor ebx, 0xcf8558fc
xor edx, edx
mov r8d, 0xa0
mov dword [0x18000f52c], ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, 8
test rax, rax
mov qword [0x18000f648], rax
je 0x180001fcf
xor edx, edx
mov r8d, 0xa0
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x18000f648]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x18000f648]
lea rdx, [0x1800114f5]
mov qword [rax], rdx
xor eax, eax
jmp 0x180001fd1
mov eax, ebx
test eax, eax
jne 0x180002155
mov rcx, qword [0x18000f510]
lea r8d, [rax + 0x43]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov qword [0x18000f568], rax
je 0x180002028
movzx r9d, byte [0x18000f525]
movzx r8d, byte [0x18000f524]
lea rcx, [0x18001144c]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1800111e7]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
jmp 0x18000202a
mov eax, ebx
test eax, eax
jne 0x180002155
and dword [rsp + 0x60], eax
mov eax, dword [0x18000f52c]
lea rdx, [rsp + 0x68]
lea rcx, [0x18000f180]
mov dword [rsp + 0x68], eax
call fcn.18000215c
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x1800020bb
mov rcx, qword [0x18000f510]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800020bb
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1800020a9
mov edx, dword [rsp + 0x60]
mov rcx, rbx
add edx, edx
call fcn.18000739c
xor dword [0x18000f180], eax
mov rcx, qword [0x18000f510]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and dword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x18000212a
mov rcx, qword [0x18000f510]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18000212a
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x180002118
mov edx, dword [rsp + 0x60]
mov rcx, rbx
add edx, edx
call fcn.18000739c
xor dword [0x18000f18c], eax
mov rcx, qword [0x18000f510]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
cpuid
mov r8d, eax
mov eax, dword [0x18000f184]
mov dword [rsp + 0x34], ebx
xor eax, edx
xor eax, ecx
xor eax, r8d
mov dword [0x18000f184], eax
call fcn.1800012b8
call fcn.180001d44
add rsp, 0x50
pop rbx
ret