Function at 0x14004d040
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x298
movaps xmmword [rsp + 0x280], xmm6
mov r12, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x278], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
mov qword [rcx + 0x10], rax
movaps xmm6, xmmword [section..rdata]
movups xmmword [rcx], xmm6
call fcn.14001fd78
movzx eax, byte [r12]
test al, 1
jne 0x14004d0df
cmp al, 2
jb 0x14004d824
cmp al, 4
jb 0x14004d16a
cmp word [r12 + 2], 0x22
jne 0x14004d0c5
mov ecx, eax
and ecx, 0xfffffffe
cmp word [r12 + rcx], 0x22
je 0x14004d124
test al, 1
jne 0x14004d109
cmp word [r12 + 2], 0x27
jne 0x14004d16a
lea rcx, [r12 + 2]
mov rdx, rax
shr rdx, 1
jmp 0x14004d11c
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x14004d824
cmp rdx, 1
je 0x14004d16a
mov rcx, qword [r12 + 0x10]
movzx ebp, word [rcx]
cmp bp, 0x22
jne 0x14004d111
cmp word [rcx + rdx*2 - 2], 0x22
je 0x14004d13b
mov rcx, qword [r12 + 0x10]
movzx ebp, word [rcx]
cmp bp, 0x27
jne 0x14004d16a
mov rdx, qword [r12 + 8]
cmp word [rcx + rdx*2 - 2], 0x27
jne 0x14004d16a
test al, 1
jne 0x14004d13b
shr rax, 1
lea rcx, [rax - 1]
add cl, cl
mov byte [r12], cl
lea rax, [r12 + rax*2]
jmp 0x14004d155
mov rax, qword [r12 + 8]
lea rcx, [rax - 1]
mov qword [r12 + 8], rcx
add rax, rax
add rax, 0xfffffffffffffffe
add rax, qword [r12 + 0x10]
mov word [rax], 0
mov r8d, 1
mov rcx, r12
xor edx, edx
call fcn.1400207ea
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
test rsi, rsi
je 0x14004d1a3
lea rdx, [0x1400b6042]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rsi
lea rax, [r12 + 2]
mov qword [rsp + 0x28], rax
xor r14d, r14d
lea r15, str._windows
mov r13, r14
shl r13, 4
mov rbx, qword [r13 + r15]
mov rcx, rbx
call fcn.14009bbb8
movzx edi, byte [r12]
mov rcx, qword [rsp + 0x28]
test dil, 1
je 0x14004d1e5
mov rcx, qword [r12 + 0x10]
test rax, rax
je 0x14004d1fe
test dil, 1
je 0x14004d282
mov rdi, qword [r12 + 8]
jmp 0x14004d285
xor ebp, ebp
mov rcx, rbx
call fcn.14009bbb8
mov rbx, rax
mov r8d, 0x208
lea rsi, [rsp + 0x70]
mov rcx, rsi
mov dl, 0xaa
call fcn.140086a50
mov r8d, dword [r13 + r15 + 8]
xor ecx, ecx
mov rdx, rsi
xor r9d, r9d
call qword [rsp + 0x38]
test eax, eax
jne 0x14004d23c
mov word [rsp + 0x70], 0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x60], rax
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.14000278c
movzx eax, byte [rsp + 0x50]
test al, 1
jne 0x14004d2f1
cmp al, 2
jb 0x14004d396
mov rcx, rax
shr rcx, 1
lea rdx, [rsp + 0x52]
jmp 0x14004d304
shr rdi, 1
cmp rdi, rax
jl 0x14004d3d7
lea r8, [rcx + rdi*2]
movzx esi, word [rbx]
mov rbp, rcx
mov rdx, rdi
sub rdx, rax
inc rdx
je 0x14004d3d7
inc rdi
cmp word [rbp], si
je 0x14004d2c1
add rbp, 2
dec rdi
cmp rax, rdi
jne 0x14004d2aa
jmp 0x14004d3d7
mov edx, 1
cmp rax, rdx
je 0x14004d32d
movzx edi, word [rbp + rdx*2]
cmp di, word [rbx + rdx*2]
lea rdx, [rdx + 1]
je 0x14004d2c6
add rbp, 2
mov rdi, r8
sub rdi, rbp
sar rdi, 1
cmp rdi, rax
jge 0x14004d298
jmp 0x14004d3d7
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14004d396
mov rdx, qword [rsp + 0x60]
cmp word [rdx + rcx*2 - 2], 0x5c
jne 0x14004d396
movzx edx, byte [r12]
test dl, 1
jne 0x14004d34b
shr rdx, 1
lea rcx, [rbx + rbp]
mov rdi, qword [rsp + 0x28]
cmp rcx, rdx
jb 0x14004d35b
jmp 0x14004d396
cmp r8, rbp
je 0x14004d3d7
sub rbp, rcx
cmp rbp, 0xfffffffffffffffe
je 0x14004d3d7
sar rbp, 1
jmp 0x14004d200
lea rcx, [rbx + rbp]
cmp qword [r12 + 8], rcx
jbe 0x14004d396
mov rdi, qword [r12 + 0x10]
cmp word [rdi + rcx*2], 0x5c
jne 0x14004d396
test al, 1
jne 0x14004d37c
shr rax, 1
lea rcx, [rax - 1]
add cl, cl
mov byte [rsp + 0x50], cl
mov word [rsp + rax*2 + 0x50], 0
jmp 0x14004d396
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
lea rdx, [rax - 1]
mov qword [rsp + 0x58], rdx
mov word [rcx + rax*2 - 2], 0
movzx eax, byte [rsp + 0x50]
test al, 1
je 0x14004d3ab
mov rax, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
jmp 0x14004d3b3
shr rax, 1
lea r9, [rsp + 0x52]
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rbp
mov r8, rbx
call fcn.140020874
test byte [rsp + 0x50], 1
je 0x14004d3d7
mov rcx, qword [rsp + 0x60]
call fcn.140083808
inc r14
cmp r14, 7
jne 0x14004d1bc
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x14004d40e
lea rdx, [0x1400b60f2]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x14004d418
movabs r14, 0xaaaaaaaaaaaaaaaa
movzx edx, byte [r12]
mov rcx, rdx
shr rcx, 1
and dl, 1
mov r10, qword [r12 + 0x10]
mov rax, r10
cmove rax, qword [rsp + 0x28]
mov r9, qword [r12 + 8]
mov rbp, r9
cmove rbp, rcx
cmp rbp, 0xc
jge 0x14004d48d
test dl, dl
cmove r10, qword [rsp + 0x28]
cmovne rcx, r9
cmp rcx, 0xf
jge 0x14004d4ea
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
je 0x14004d54e
lea rdx, [0x1400b6162]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
jmp 0x14004d558
lea r8, [rax + rbp*2]
lea rsi, str._user_name
mov rdi, rax
add rbp, 0xfffffffffffffff5
je 0x14004d446
cmp word [rdi], 0x24
je 0x14004d4b2
add rdi, 2
dec rbp
jne 0x14004d4a1
jmp 0x14004d446
mov ebp, 1
cmp rbp, 0xc
je 0x14004d61d
movzx ebx, word [rdi + rbp*2]
cmp bx, word [rsi + rbp*2]
lea rbp, [rbp + 1]
je 0x14004d4b7
add rdi, 2
mov rbx, r8
sub rbx, rdi
mov rbp, rbx
sar rbp, 1
cmp rbx, 0x18
jge 0x14004d49b
jmp 0x14004d446
lea rbx, [r10 + rcx*2]
lea rdx, str._machine_name
mov rdi, r10
add rcx, 0xfffffffffffffff2
je 0x14004d45c
cmp word [rdi], 0x24
je 0x14004d516
add rdi, 2
dec rcx
jne 0x14004d502
jmp 0x14004d45c
mov ecx, 1
cmp rcx, 0xf
je 0x14004d6aa
movzx ebp, word [rdi + rcx*2]
cmp bp, word [rdx + rcx*2]
lea rcx, [rcx + 1]
je 0x14004d51b
add rdi, 2
mov rax, rbx
sub rax, rdi
mov rcx, rax
sar rcx, 1
cmp rax, 0x1e
jge 0x14004d4f8
jmp 0x14004d45c
movabs rsi, 0xaaaaaaaaaaaaaaaa
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x14004d582
lea rdx, [0x1400b619a]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
movzx edx, byte [r12]
mov rcx, rdx
shr rcx, 1
and dl, 1
mov r10, qword [r12 + 0x10]
mov rax, r10
cmove rax, qword [rsp + 0x28]
mov r9, qword [r12 + 8]
mov rdi, r9
cmove rdi, rcx
cmp rdi, 0xe
jl 0x14004d7d5
mov r11, rsi
lea r8, [rax + rdi*2]
lea rsi, str._client_name
mov rbp, rax
add rdi, 0xfffffffffffffff3
je 0x14004d7d2
cmp word [rbp], 0x24
je 0x14004d5e4
add rbp, 2
dec rdi
jne 0x14004d5cf
jmp 0x14004d7d2
mov edi, 1
cmp rdi, 0xe
je 0x14004d747
movzx ebx, word [rbp + rdi*2]
cmp bx, word [rsi + rdi*2]
lea rdi, [rdi + 1]
je 0x14004d5e9
add rbp, 2
mov rbx, r8
sub rbx, rbp
mov rdi, rbx
sar rdi, 1
cmp rbx, 0x1c
jge 0x14004d5c5
jmp 0x14004d7d2
cmp r8, rdi
je 0x14004d446
sub rdi, rax
cmp rdi, 0xfffffffffffffffe
je 0x14004d446
lea rbp, [rsp + 0x50]
mov dword [rbp], 0
xor ecx, ecx
mov rdx, rbp
call r14
mov ecx, dword [rbp]
test rcx, rcx
je 0x14004d977
sar rdi, 1
add rcx, rcx
call fcn.14008383c
mov rbp, rax
lea rdx, [rsp + 0x50]
mov rcx, rax
call r14
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x70]
mov qword [rbx + 0x10], rax
movaps xmmword [rbx], xmm6
mov rcx, rbx
mov rdx, rbp
call fcn.14000278c
movzx eax, byte [rbx]
test al, 1
je 0x14004d93d
mov rax, qword [rsp + 0x78]
mov r9, qword [rsp + 0x80]
jmp 0x14004d945
cmp rbx, rdi
je 0x14004d45c
sub rdi, r10
cmp rdi, 0xfffffffffffffffe
je 0x14004d45c
lea rbx, [rsp + 0x50]
mov dword [rbx], 0
mov ecx, 5
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [rbx]
test rcx, rcx
je 0x14004d45c
sar rdi, 1
add rcx, rcx
call fcn.14008383c
mov rbx, rax
lea r8, [rsp + 0x50]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x10], rax
movaps xmmword [rbp], xmm6
mov rcx, rbp
mov rdx, rbx
call fcn.14000278c
movzx eax, byte [rbp]
test al, 1
je 0x14004d993
mov rax, qword [rsp + 0x78]
mov r9, qword [rsp + 0x80]
jmp 0x14004d99b
cmp r8, rbp
je 0x14004d7d2
sub rbp, rax
cmp rbp, 0xfffffffffffffffe
mov rsi, r11
je 0x14004d7d5
lea r9, [rsp + 0x50]
mov qword [r9], 0
lea rax, [rsp + 0x4c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
call rsi
test eax, eax
je 0x14004da0d
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x70]
mov qword [rdi + 0x10], rax
movaps xmmword [rdi], xmm6
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.14000278c
movzx eax, byte [rdi]
test al, 1
je 0x14004d9d2
mov rax, qword [rsp + 0x78]
mov r9, qword [rsp + 0x80]
jmp 0x14004d9da
mov rsi, r11
test dl, dl
cmove r10, qword [rsp + 0x28]
cmovne rcx, r9
cmp rcx, 0xf
jge 0x14004d853
test r14, r14
je 0x14004d7f5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r13, r13
mov rsi, qword [rsp + 0x40]
je 0x14004d808
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x14004d816
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rsi, rsi
je 0x14004d824
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140083c20
mov rax, r12
movaps xmm6, xmmword [rsp + 0x280]
add rsp, 0x298
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [r10 + rcx*2]
lea rdx, str._session_name
mov rbp, r10
add rcx, 0xfffffffffffffff2
je 0x14004d7e7
cmp word [rbp], 0x24
je 0x14004d87c
add rbp, 2
dec rcx
jne 0x14004d867
jmp 0x14004d7e7
mov ecx, 1
cmp rcx, 0xf
je 0x14004d8b1
movzx ebx, word [rbp + rcx*2]
cmp bx, word [rdx + rcx*2]
lea rcx, [rcx + 1]
je 0x14004d881
add rbp, 2
mov rax, rdi
sub rax, rbp
mov rcx, rax
sar rcx, 1
cmp rax, 0x1e
jge 0x14004d861
jmp 0x14004d7e7
cmp rdi, rbp
je 0x14004d7e7
sub rbp, r10
cmp rbp, 0xfffffffffffffffe
je 0x14004d7e7
lea r9, [rsp + 0x50]
mov qword [r9], 0
lea rax, [rsp + 0x4c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
call rsi
test eax, eax
je 0x14004d7e7
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x70]
mov qword [rdi + 0x10], rax
movaps xmmword [rdi], xmm6
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.14000278c
movzx eax, byte [rdi]
test al, 1
je 0x14004da29
mov rax, qword [rsp + 0x78]
mov r9, qword [rsp + 0x80]
jmp 0x14004da31
shr rax, 1
lea r9, [rsp + 0x72]
mov qword [rsp + 0x20], rax
mov r8d, 0xc
mov rcx, r12
mov rdx, rdi
call fcn.140020874
test byte [rsp + 0x70], 1
je 0x14004d96f
mov rcx, qword [rsp + 0x80]
call fcn.140083808
mov rcx, rbp
call fcn.140083844
movzx ecx, byte [r12]
mov r9, qword [r12 + 8]
mov r10, qword [r12 + 0x10]
mov edx, ecx
and dl, 1
shr rcx, 1
jmp 0x14004d446
shr rax, 1
lea r9, [rsp + 0x72]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r12
mov rdx, rdi
call fcn.140020874
test byte [rsp + 0x70], 1
je 0x14004d9c5
mov rcx, qword [rsp + 0x80]
call fcn.140083808
mov rcx, rbx
call fcn.140083844
jmp 0x14004d45c
shr rax, 1
lea r9, [rsp + 0x72]
mov qword [rsp + 0x20], rax
mov r8d, 0xe
mov rcx, r12
mov rdx, rbp
call fcn.140020874
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x30]
test byte [rsp + 0x70], 1
je 0x14004da0d
mov rcx, qword [rsp + 0x80]
call fcn.140083808
movzx ecx, byte [r12]
mov r9, qword [r12 + 8]
mov r10, qword [r12 + 0x10]
mov edx, ecx
and dl, 1
shr rcx, 1
jmp 0x14004d7d5
shr rax, 1
lea r9, [rsp + 0x72]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r12
mov rdx, rbp
call fcn.140020874
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x30]
test byte [rsp + 0x70], 1
je 0x14004d7e7
mov rcx, qword [rsp + 0x80]
call fcn.140083808
jmp 0x14004d7e7