Function at 0x140009020
Capabilities:
Get hostname
Get session user name

Disassembly:
push r15
xor eax, eax
mov ecx, 0x47
xor r8d, r8d
push r14
xor r9d, r9d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
lea rdi, [rsp + 0x34]
mov qword [rsp + 0x20], r8
lea rbp, [rsp + 0x28]
rep stosd dword [rdi], eax
mov ecx, 0x100
mov qword [rsp + 0x28], r9
lea r13, [rsp + 0x34]
call fcn.140008c90
mov rsi, qword [0x14000ba80]
mov rcx, rax
mov rbx, rax
mov edx, dword [rsi]
call fcn.140008ba0
xor edx, edx
xor ecx, ecx
mov r12, qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov r8, rbp
call r12
mov r14, qword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x1400090b7
mov rdx, qword [rsp + 0x28]
mov ecx, 0x40
call r14
mov qword [rsp + 0x20], rax
mov rdx, rax
test rax, rax
je 0x1400090b7
mov r8, rbp
xor ecx, ecx
call r12
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140008b30
mov rcx, qword [rsp + 0x28]
xor eax, eax
mov rdi, qword [rsp + 0x20]
mov r15, qword [sym.imp.KERNEL32.dll_LocalFree]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x20]
call r15
xor ecx, ecx
mov edx, 0x104
mov qword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rcx
mov ecx, 0x40
call r14
mov qword [rsp + 0x20], rax
mov rcx, rax
test rax, rax
je 0x140009119
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov rcx, rbx
mov r8, rax
call fcn.140008b30
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x20]
call r15
xor edx, edx
mov r8, rbp
mov ecx, 2
mov qword [rsp + 0x20], rdx
xor edx, edx
call r12
test eax, eax
jne 0x140009187
mov rdx, qword [rsp + 0x28]
mov ecx, 0x40
call r14
mov qword [rsp + 0x20], rax
mov rdx, rax
test rax, rax
je 0x140009187
mov r8, rbp
mov ecx, 2
call r12
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140008b30
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x20]
call r15
xor eax, eax
mov rdx, rbp
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov rdx, qword [rsp + 0x28]
mov ecx, 0x40
call r14
mov r12, rax
test rax, rax
je 0x140009216
mov rdx, rbp
mov rcx, rax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x140009216
lea rdi, [r12 + 0x1c0]
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov rcx, rbx
mov rdi, r12
mov r8, rax
call fcn.140008b30
mov rcx, qword [rsp + 0x28]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r12
call r15
jmp 0x140009220
xor edx, edx
mov rcx, rbx
call fcn.140008ba0
mov edx, 0x104
mov ecx, 0x40
mov qword [rsp + 0x28], 0x104
call r14
mov qword [rsp + 0x20], rax
mov rdx, rax
test rax, rax
je 0x140009267
mov r8d, dword [rsp + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
mov r8d, eax
mov qword [rsp + 0x28], r8
call fcn.140008b30
jmp 0x140009271
xor edx, edx
mov rcx, rbx
call fcn.140008ba0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rbx
mov rdi, r13
xor r12d, r12d
mov edx, eax
call fcn.140008ba0
xor edx, edx
mov rcx, rbx
call fcn.140008ba0
movzx edx, word [rsi + 4]
mov rcx, rbx
call fcn.140008ba0
xor edx, edx
mov rcx, rbx
call fcn.140008ba0
xor eax, eax
mov ecx, 0x47
rep stosd dword [rdi], eax
mov rcx, r13
lea r13, str.Data:___d___
mov dword [rsp + 0x34], 0x11c
lea rdi, str._02x
call qword [rsi + 0x18]
mov edx, dword [rsp + 0x38]
mov rcx, rbx
call fcn.140008ba0
mov edx, dword [rsp + 0x3c]
mov rcx, rbx
call fcn.140008ba0
movzx edx, byte [rsp + 0x14e]
mov rcx, rbx
call fcn.140008ba0
movzx edx, word [rsp + 0x148]
mov rcx, rbx
call fcn.140008ba0
mov edx, dword [rsp + 0x40]
mov rcx, rbx
call fcn.140008ba0
mov edx, dword [rsi + 8]
mov rcx, rbx
call fcn.140008ba0
mov edx, dword [rsi + 0x20]
mov rcx, rbx
call fcn.140008ba0
mov edx, dword [rsi + 0x24]
mov rcx, rbx
call fcn.140008ba0
mov edx, dword [rsi + 0x40]
mov rcx, rbx
call fcn.140008ba0
mov edx, dword [rsi + 0x48]
mov rcx, rbx
call fcn.140008ba0
mov rdx, qword [rsp + 0x28]
mov rcx, r13
call fcn.140009810
cmp r12, qword [rsp + 0x28]
jae 0x140009372
mov rax, qword [rsp + 0x20]
mov rcx, rdi
movzx edx, byte [rax + r12]
inc r12
call fcn.140009810
jmp 0x140009354
lea rdi, [0x14000b254]
mov rcx, rdi
call sub.msvcrt.dll_puts
lea rdx, [rsp + 0x20]
mov r8, rbp
mov rcx, rbx
call fcn.140008dd0
test eax, eax
jne 0x14000939c
xor eax, eax
jmp 0x140009421
lea rcx, str.TRM_PACKAGE__n
xor ebx, ebx
lea rbp, str._02x
call fcn.140009810
mov rdx, qword [rsp + 0x28]
mov rcx, r13
call fcn.140009810
cmp rbx, qword [rsp + 0x28]
jae 0x1400093db
mov rax, qword [rsp + 0x20]
mov rcx, rbp
movzx edx, byte [rax + rbx]
inc rbx
call fcn.140009810
jmp 0x1400093be
mov rcx, rdi
call sub.msvcrt.dll_puts
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140009395
mov r8d, dword [rsi]
mov edx, dword [rax]
lea rcx, str.Ag_ent____x_:__x_n
call fcn.140009810
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
cmp dword [rsi], eax
jne 0x140009395
lea rcx, str.CONN_ECTED__n
call fcn.140009810
mov dword [rsi + 0xc], 1
mov eax, 1
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret