Function at 0x1400011e0
Capabilities:
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x14000125e
lea rdx, str.Error_getting_computer_name.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001f30
mov rcx, rax
lea rdx, [0x140002100]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x14000172f
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdx
lea rax, [rbp + 0x70]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], dl
jne 0x140001280
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x140001771
movabs rax, 0x8000000000000000
mov ecx, 0x16
mov qword [rsp + 0x60], 0xf
cmp rbx, 0x10
jae 0x1400012d9
mov qword [rsp + 0x58], rbx
mov r8, rbx
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x48], 0
jmp 0x140001363
mov rdi, rbx
or rdi, 0xf
cmp rdi, rsi
jbe 0x14000130b
mov rdi, rsi
add rax, 0x27
mov rcx, rax
call fcn.140002430
test rax, rax
je 0x14000171f
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001340
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000132e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001765
jmp 0x1400012ec
test rcx, rcx
je 0x14000133d
call fcn.140002430
mov r14, rax
jmp 0x140001340
mov r14, rdx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
mov r8, rbx
lea rdx, [rbp + 0x70]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
lea rbx, [rsp + 0x48]
mov r12, qword [rsp + 0x60]
cmp r12, 0x10
cmovae rbx, qword [rsp + 0x48]
lea rdi, str.__n_r_t
lea r13, [0x140004494]
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x1400013f7
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rsp + rax + 0x70], 1
inc rcx
cmp rcx, r13
jne 0x1400013b0
lea rax, [r14 - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rsp + rax + 0x70], 0
je 0x1400013f2
nop
cmp rcx, rbx
je 0x1400013f7
dec rcx
movzx eax, byte [rcx]
cmp byte [rsp + rax + 0x70], 0
jne 0x1400013e0
sub rcx, rbx
jmp 0x1400013fe
mov rcx, 0xffffffffffffffff
inc rcx
cmp r14, rcx
jb 0x140001777
mov qword [rsp + 0x58], rcx
lea rax, [rsp + 0x48]
cmp r12, 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax + rcx], 0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
lea rdx, str.HQ_TSEC_CYMW01
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000144c
lea rdx, str.Invalid_asdg12f3hg213f_name
jmp 0x140001471
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x140001495
lea rdx, str.Error_getting_user_name.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001f30
lea rdx, [0x140002100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor dil, dil
jmp 0x1400016eb
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0xf0]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x1400014c0
cmp rbx, rsi
ja 0x14000177d
mov qword [rsp + 0x40], 0xf
cmp rbx, 0x10
jae 0x140001504
mov qword [rsp + 0x38], rbx
mov r8, rbx
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x28], r12b
jmp 0x1400015a0
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14000153d
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002430
test rax, rax
je 0x1400016c9
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14000157b
mov rsi, rax
cmp rax, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140001569
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000176b
jmp 0x14000151e
test rcx, rcx
je 0x140001578
call fcn.140002430
mov r14, rax
jmp 0x14000157b
mov r14, r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
mov r8, rbx
lea rdx, [rbp + 0xf0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], r12b
lea rbx, [rsp + 0x28]
mov r14, qword [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rbx, r14
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x140001617
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
movzx eax, byte [rdi]
mov byte [rsp + rax + 0x70], 1
inc rdi
cmp rdi, r13
jne 0x1400015d0
lea rax, [rsi - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rsp + rax + 0x70], 0
je 0x140001612
nop
cmp rcx, rbx
je 0x140001617
dec rcx
movzx eax, byte [rcx]
cmp byte [rsp + rax + 0x70], 0
jne 0x140001600
sub rcx, rbx
jmp 0x14000161e
mov rcx, 0xffffffffffffffff
inc rcx
cmp rsi, rcx
jb 0x14000175f
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rax, r14
mov byte [rax + rcx], 0
lea rcx, [rsp + 0x28]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x10
cmovae rcx, rbx
lea rdx, str.hq_tsec_cymw01cisadmin
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000169b
lea rdx, str.Invalid_asdg12f3hg213f_name
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001f30
mov rcx, rax
lea rdx, [0x140002100]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor dil, dil
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
jmp 0x14000169e
mov dil, 1
cmp rsi, 0x10
jb 0x1400016d8
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400016d0
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14000253c
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000172b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001726
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001726
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000253c
movzx eax, dil
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140002410
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
call fcn.140001f10
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.1400011a0
nop
call fcn.140001f10
int3
call fcn.1400011a0
int3