Function at 0x1400564b0
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov r12, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
call fcn.140028270
movzx ebp, byte [r12 + 0x17]
test bpl, bpl
mov rcx, qword [r12 + 8]
mov rax, rbp
cmovs rax, rcx
test rax, rax
je 0x1400569df
cmp rax, 1
je 0x14005656e
test bpl, bpl
mov rdx, qword [r12]
mov rbx, r12
cmovs rbx, rdx
movzx edi, word [rbx]
cmp di, 0x27
je 0x140056528
cmp di, 0x22
jne 0x14005656e
cmp word [rbx + rax*2 - 2], 0x22
je 0x140056530
jmp 0x14005656e
cmp word [rbx + rax*2 - 2], 0x27
jne 0x14005656e
test bpl, bpl
js 0x140056548
lea rax, [rbp - 1]
mov byte [r12 + 0x17], al
lea rax, [r12 + rbp*2]
add rax, 0xfffffffffffffffe
jmp 0x140056559
lea rax, [rcx - 1]
mov qword [r12 + 8], rax
lea rax, [rdx + rcx*2]
add rax, 0xfffffffffffffffe
mov word [rax], 0
mov r8d, 1
mov rcx, r12
xor edx, edx
call fcn.140029040
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rsp + 0x38], rax
je 0x14005659c
lea rdx, [0x1400c2322]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
jmp 0x14005659c
xor r15d, r15d
lea r14, str._windows
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r13, r15
shl r13, 4
mov rbp, qword [r13 + r14]
mov rcx, rbp
call fcn.1400a6370
movzx ecx, byte [r12 + 0x17]
mov r9, r12
test cl, cl
jns 0x1400565d5
mov r9, qword [r12]
test rax, rax
je 0x14005666f
test cl, cl
jns 0x1400565e7
mov rcx, qword [r12 + 8]
cmp rcx, rax
jge 0x1400565fa
inc r15
cmp r15, 7
jne 0x1400565b0
jmp 0x140056774
lea r8, [r9 + rcx*2]
movzx esi, word [rbp]
mov rdi, r9
mov rdx, rcx
sub rdx, rax
inc rdx
je 0x1400565ec
inc rcx
cmp word [rdi], si
je 0x140056626
add rdi, 2
dec rcx
cmp rax, rcx
jne 0x140056613
jmp 0x1400565ec
cmp si, word [rbp]
jne 0x140056648
mov edx, 1
cmp rax, rdx
je 0x14005665c
movzx ecx, word [rdi + rdx*2]
lea rbx, [rdx + 1]
cmp cx, word [rbp + rdx*2]
mov rdx, rbx
je 0x140056631
add rdi, 2
mov rcx, r8
sub rcx, rdi
sar rcx, 1
cmp rcx, rax
jge 0x140056605
jmp 0x1400565ec
cmp r8, rdi
je 0x1400565ec
sub rdi, r9
cmp rdi, 0xfffffffffffffffe
je 0x1400565ec
sar rdi, 1
jmp 0x140056671
xor edi, edi
mov rcx, rbp
call fcn.1400a6370
mov rbx, rax
mov r8d, dword [r13 + r14 + 8]
xor ecx, ecx
lea rdx, [rsp + 0x60]
xor r9d, r9d
call qword [rsp + 0x30]
test eax, eax
jne 0x14005669a
mov word [rsp + 0x60], 0
lea r13, [rsp + 0x48]
mov rcx, r13
lea rdx, [rsp + 0x60]
call fcn.140024700
movzx edx, byte [rsp + 0x5f]
test dl, dl
mov rcx, qword [rsp + 0x50]
mov rax, rdx
cmovs rax, rcx
test rax, rax
je 0x140056731
test dl, dl
mov r8, qword [rsp + 0x48]
mov rbp, r13
cmovs rbp, r8
cmp word [rbp + rax*2 - 2], 0x5c
jne 0x140056731
movzx esi, byte [r12 + 0x17]
mov rax, rsi
test sil, sil
jns 0x1400566ed
mov rax, qword [r12 + 8]
mov rbp, rbx
add rbp, rdi
cmp rax, rbp
jbe 0x140056731
mov rax, r12
test sil, sil
jns 0x140056704
mov rax, qword [r12]
cmp word [rax + rbp*2], 0x5c
jne 0x140056731
test dl, dl
js 0x140056720
lea rax, [rdx - 1]
mov byte [rsp + 0x5f], al
mov word [rsp + rdx*2 + 0x46], 0
jmp 0x140056731
lea rax, [rcx - 1]
mov qword [rsp + 0x50], rax
mov word [r8 + rcx*2 - 2], 0
movzx eax, byte [rsp + 0x5f]
test al, al
cmovs rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
cmovns r9, r13
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rdi
mov r8, rbx
call fcn.1400290d0
cmp byte [rsp + 0x5f], 0
jns 0x1400565ec
mov rcx, qword [rsp + 0x48]
call fcn.14008d81c
jmp 0x1400565ec
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x14005679e
lea rdx, [0x1400c23d2]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x14005679e
mov al, byte [r12 + 0x17]
test al, al
mov rsi, qword [r12]
mov rbp, qword [r12 + 8]
mov rbx, r12
cmovs rbx, rsi
movzx edx, al
mov rcx, rdx
cmovs rcx, rbp
cmp rcx, 0xc
jge 0x14005680c
test al, al
cmovns rsi, r12
cmovs rdx, rbp
cmp rdx, 0xf
jge 0x140056896
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x140056940
lea rdx, [0x1400c23fc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
jmp 0x140056940
lea r8, [rbx + rcx*2]
add rcx, rcx
mov rdi, rbx
shr rcx, 1
add rcx, 0xfffffffffffffff5
je 0x1400567c5
cmp word [rdi], 0x24
je 0x140056830
add rdi, 2
dec rcx
jne 0x14005681f
jmp 0x1400567c5
cmp word [rdi + 2], 0x7b
jne 0x140056881
cmp word [rdi + 4], 0x75
jne 0x140056881
cmp word [rdi + 6], 0x73
jne 0x140056881
cmp word [rdi + 8], 0x65
jne 0x140056881
cmp word [rdi + 0xa], 0x72
jne 0x140056881
cmp word [rdi + 0xc], 0x5f
jne 0x140056881
cmp word [rdi + 0xe], 0x6e
jne 0x140056881
cmp word [rdi + 0x10], 0x61
jne 0x140056881
cmp word [rdi + 0x12], 0x6d
jne 0x140056881
cmp word [rdi + 0x14], 0x65
jne 0x140056881
cmp word [rdi + 0x16], 0x7d
je 0x140056b55
add rdi, 2
mov rcx, r8
sub rcx, rdi
cmp rcx, 0x18
jge 0x140056816
jmp 0x1400567c5
lea rcx, [rsi + rdx*2]
add rdx, rdx
mov rdi, rsi
shr rdx, 1
add rdx, 0xfffffffffffffff2
je 0x1400567d9
cmp word [rdi], 0x24
je 0x1400568c1
add rdi, 2
dec rdx
jne 0x1400568ad
jmp 0x1400567d9
cmp word [rdi + 2], 0x7b
jne 0x140056927
cmp word [rdi + 4], 0x6d
jne 0x140056927
cmp word [rdi + 6], 0x61
jne 0x140056927
cmp word [rdi + 8], 0x63
jne 0x140056927
cmp word [rdi + 0xa], 0x68
jne 0x140056927
cmp word [rdi + 0xc], 0x69
jne 0x140056927
cmp word [rdi + 0xe], 0x6e
jne 0x140056927
cmp word [rdi + 0x10], 0x65
jne 0x140056927
cmp word [rdi + 0x12], 0x5f
jne 0x140056927
cmp word [rdi + 0x14], 0x6e
jne 0x140056927
cmp word [rdi + 0x16], 0x61
jne 0x140056927
cmp word [rdi + 0x18], 0x6d
jne 0x140056927
cmp word [rdi + 0x1a], 0x65
jne 0x140056927
cmp word [rdi + 0x1c], 0x7d
je 0x140056c0e
add rdi, 2
mov rdx, rcx
sub rdx, rdi
cmp rdx, 0x1e
jge 0x1400568a0
jmp 0x1400567d9
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
je 0x140056967
lea rdx, [0x1400c2434]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140056967
mov r9b, byte [r12 + 0x17]
test r9b, r9b
mov rsi, qword [r12]
mov rdi, qword [r12 + 8]
mov rbx, r12
cmovs rbx, rsi
movzx edx, r9b
mov rcx, rdx
cmovs rcx, rdi
cmp rcx, 0xe
jge 0x140056a06
test r9b, r9b
cmovns rsi, r12
cmovs rdx, rdi
cmp rdx, 0xf
jge 0x140056aaa
test r13, r13
je 0x1400569b3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x1400569c1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x1400569cf
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400569df
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14008db90
mov rax, r12
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [rbx + rcx*2]
add rcx, rcx
mov rbp, rbx
shr rcx, 1
add rcx, 0xfffffffffffffff3
je 0x140056990
cmp word [rbp], 0x24
je 0x140056a32
add rbp, 2
dec rcx
jne 0x140056a1d
jmp 0x140056990
cmp word [rbp + 2], 0x7b
jne 0x140056a91
cmp word [rbp + 4], 0x63
jne 0x140056a91
cmp word [rbp + 6], 0x6c
jne 0x140056a91
cmp word [rbp + 8], 0x69
jne 0x140056a91
cmp word [rbp + 0xa], 0x65
jne 0x140056a91
cmp word [rbp + 0xc], 0x6e
jne 0x140056a91
cmp word [rbp + 0xe], 0x74
jne 0x140056a91
cmp word [rbp + 0x10], 0x5f
jne 0x140056a91
cmp word [rbp + 0x12], 0x6e
jne 0x140056a91
cmp word [rbp + 0x14], 0x61
jne 0x140056a91
cmp word [rbp + 0x16], 0x6d
jne 0x140056a91
cmp word [rbp + 0x18], 0x65
jne 0x140056a91
cmp word [rbp + 0x1a], 0x7d
je 0x140056ba1
add rbp, 2
mov rcx, r8
sub rcx, rbp
cmp rcx, 0x1c
jge 0x140056a10
jmp 0x140056990
lea rcx, [rsi + rdx*2]
add rdx, rdx
mov rbp, rsi
shr rdx, 1
add rdx, 0xfffffffffffffff2
je 0x1400569a5
cmp word [rbp], 0x24
je 0x140056ad6
add rbp, 2
dec rdx
jne 0x140056ac1
jmp 0x1400569a5
cmp word [rbp + 2], 0x7b
jne 0x140056b3c
cmp word [rbp + 4], 0x73
jne 0x140056b3c
cmp word [rbp + 6], 0x65
jne 0x140056b3c
cmp word [rbp + 8], 0x73
jne 0x140056b3c
cmp word [rbp + 0xa], 0x73
jne 0x140056b3c
cmp word [rbp + 0xc], 0x69
jne 0x140056b3c
cmp word [rbp + 0xe], 0x6f
jne 0x140056b3c
cmp word [rbp + 0x10], 0x6e
jne 0x140056b3c
cmp word [rbp + 0x12], 0x5f
jne 0x140056b3c
cmp word [rbp + 0x14], 0x6e
jne 0x140056b3c
cmp word [rbp + 0x16], 0x61
jne 0x140056b3c
cmp word [rbp + 0x18], 0x6d
jne 0x140056b3c
cmp word [rbp + 0x1a], 0x65
jne 0x140056b3c
cmp word [rbp + 0x1c], 0x7d
je 0x140056cc4
add rbp, 2
mov rdx, rcx
sub rdx, rbp
cmp rdx, 0x1e
jge 0x140056ab4
jmp 0x1400569a5
cmp r8, rdi
je 0x1400567c5
sub rdi, rbx
cmp rdi, 0xfffffffffffffffe
je 0x1400567c5
lea rbp, [rsp + 0x48]
mov dword [rbp], 0
xor ecx, ecx
mov rdx, rbp
call r14
mov ecx, dword [rbp]
test rcx, rcx
jne 0x140056d73
mov al, byte [r12 + 0x17]
mov rsi, qword [r12]
mov rbp, qword [r12 + 8]
movzx edx, al
jmp 0x1400567c5
mov qword [rsp + 0x28], rax
cmp r8, rbp
je 0x140056c04
sub rbp, rbx
cmp rbp, 0xfffffffffffffffe
mov rax, qword [rsp + 0x28]
je 0x140056990
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
call qword [rsp + 0x30]
test eax, eax
jne 0x140056dea
mov r9b, byte [r12 + 0x17]
mov rsi, qword [r12]
mov rdi, qword [r12 + 8]
movzx edx, r9b
mov rax, qword [rsp + 0x28]
jmp 0x140056990
cmp rcx, rdi
je 0x1400567d9
sub rdi, rsi
cmp rdi, 0xfffffffffffffffe
je 0x1400567d9
lea rbx, [rsp + 0x48]
mov dword [rbx], 0
mov ecx, 5
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [rbx]
test rcx, rcx
je 0x1400567d9
sar rdi, 1
add rcx, rcx
call fcn.14008d85c
mov rbx, rax
lea r8, [rsp + 0x48]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rbp, [rsp + 0x60]
mov rcx, rbp
mov rdx, rbx
call fcn.140024700
movzx eax, byte [rbp + 0x17]
test al, al
jns 0x140056c8d
mov rax, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r12
mov rdx, rdi
mov r9, rbp
call fcn.1400290d0
cmp byte [rsp + 0x77], 0
jns 0x140056cb7
mov rcx, qword [rsp + 0x60]
call fcn.14008d81c
mov rcx, rbx
call fcn.14008d864
jmp 0x1400567d9
cmp rcx, rbp
je 0x1400569a5
sub rbp, rsi
cmp rbp, 0xfffffffffffffffe
je 0x1400569a5
mov rdi, rax
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
call qword [rsp + 0x30]
test eax, eax
je 0x1400569a5
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140024700
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140056d39
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.1400290d0
mov rcx, qword [rsp + 0x48]
call rdi
cmp byte [rsp + 0x77], 0
jns 0x1400569a5
mov rcx, qword [rsp + 0x60]
call fcn.14008d81c
jmp 0x1400569a5
sar rdi, 1
add rcx, rcx
call fcn.14008d85c
mov rbp, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call r14
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.140024700
movzx eax, byte [rsp + 0x77]
test al, al
jns 0x140056db1
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r8d, 0xc
mov rcx, r12
mov rdx, rdi
mov r9, qword [rsp + 0x28]
call fcn.1400290d0
cmp byte [rsp + 0x77], 0
jns 0x140056ddd
mov rcx, qword [rsp + 0x60]
call fcn.14008d81c
mov rcx, rbp
call fcn.14008d864
jmp 0x140056b8b
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140024700
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140056e11
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xe
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.1400290d0
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x28]
cmp byte [rsp + 0x77], 0
jns 0x140056bf2
mov rcx, qword [rsp + 0x60]
call fcn.14008d81c
jmp 0x140056bf2