Function at 0x1400813b8
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
movaps xmmword [rsp + 0x290], xmm6
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x288], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rdi
movaps xmm6, xmmword [0x1401990c0]
movups xmmword [rcx], xmm6
cmp byte [rdx + 0x17], 0
js 0x140081416
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
jmp 0x140081428
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rsi
mov rdx, rax
call fcn.140050dce
movzx eax, byte [rsi + 0x17]
test al, al
js 0x14008145b
test rax, rax
je 0x140081a65
cmp eax, 1
je 0x1400814ed
movzx ecx, word [rsi]
cmp ecx, 0x22
je 0x1400814c6
cmp ecx, 0x27
jne 0x1400814ed
mov rdx, rsi
mov rcx, rax
jmp 0x1400814a1
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140081a65
cmp rdx, 1
je 0x1400814ed
mov rcx, qword [rsi]
cmp word [rcx], 0x22
jne 0x14008148b
cmp word [rcx + rdx*2 - 2], 0x22
je 0x1400814a9
test al, al
js 0x14008148b
cmp cx, 0x27
je 0x140081453
jmp 0x1400814ed
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140081eeb
mov rdx, qword [rsi]
cmp word [rdx], 0x27
jne 0x1400814ed
cmp word [rdx + rcx*2 - 2], 0x27
jne 0x1400814ed
test al, al
jns 0x1400814ce
mov rax, qword [rsi + 8]
test rax, rax
je 0x140081eee
dec rax
mov rcx, qword [rsi]
mov qword [rsi + 8], rax
jmp 0x1400814d7
cmp word [rsi + rax*2 - 2], 0x22
jne 0x1400814ed
dec rax
mov byte [rsi + 0x17], al
mov rcx, rsi
mov word [rcx + rax*2], 0
mov r8d, 1
mov rcx, rsi
xor edx, edx
call fcn.140051542
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x38], rdi
test rax, rax
je 0x14008151c
lea rdx, [0x1401a941f]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rbx
xor r14d, r14d
lea r15, [rsp + 0x80]
mov rbx, r14
shl rbx, 4
lea rax, str._windows
mov rbp, qword [rbx + rax]
test rbp, rbp
je 0x140081ee2
mov rcx, rbp
call fcn.140171c94
movzx edx, byte [rsi + 0x17]
mov rcx, rsi
test dl, dl
jns 0x14008155d
mov rcx, qword [rsi]
test rax, rax
je 0x140081607
test dl, dl
jns 0x14008156e
mov rdx, qword [rsi + 8]
cmp rdx, rax
jl 0x140081785
lea r8, [rcx + rdx*2]
movzx r9d, word [rbp]
lea r10, [rcx + rdx*2]
add r10, 0xfffffffffffffffe
mov r11, rcx
mov r12, rdx
sub r12, rax
inc r12
je 0x140081785
inc rdx
xor r12d, r12d
cmp word [r11 + r12], r9w
je 0x1400815b8
add r12, 2
dec rdx
cmp rax, rdx
jne 0x1400815a0
jmp 0x140081785
mov r13, r11
add r13, r12
je 0x140081785
xor edx, edx
movzx edi, word [r13 + rdx*2]
cmp di, word [rbp + rdx*2]
jne 0x1400815e0
inc rdx
cmp rax, rdx
jne 0x1400815c6
jmp 0x1400816c7
mov rdx, r10
sub rdx, r11
add r11, r12
add r11, 2
sub rdx, r12
sar rdx, 1
cmp rdx, rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
jge 0x14008158b
jmp 0x140081785
xor r13d, r13d
mov rcx, rbp
call fcn.140171c94
mov rbp, rax
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.1401543c0
lea rax, str._windows
mov r8d, dword [rbx + rax + 8]
xor ecx, ecx
mov rdx, r15
xor r9d, r9d
mov rax, qword [rsp + 0x38]
call qword [0x1401b8a50]
test eax, eax
jne 0x140081652
mov word [rsp + 0x80], 0
mov qword [rsp + 0x70], rdi
movaps xmmword [rsp + 0x60], xmm6
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov rdx, r15
call fcn.1400279c4
mov al, byte [rsp + 0x77]
movzx ecx, al
test cl, cl
js 0x140081683
test al, al
je 0x1400816c0
mov r8, rbx
mov rdx, rcx
jmp 0x140081696
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14008174d
mov r8, qword [rsp + 0x60]
cmp word [r8 + rdx*2 - 2], 0x5c
jne 0x14008174d
movzx r8d, byte [rsi + 0x17]
mov rdx, rbp
add rdx, r13
test r8b, r8b
js 0x1400816f2
mov r9, r8
cmp rdx, r8
jb 0x1400816fb
jmp 0x14008174d
xor eax, eax
jmp 0x14008174d
cmp r13, r8
movabs rdi, 0xaaaaaaaaaaaaaaaa
je 0x140081785
sub r13, rcx
mov rax, r13
add rax, 2
je 0x140081785
sar r13, 1
jmp 0x14008160a
mov r9, qword [rsi + 8]
cmp r9, rdx
jbe 0x14008174d
cmp r9, rdx
jb 0x140081ee5
mov r9, rsi
test r8b, r8b
jns 0x14008170f
mov r9, qword [rsi]
cmp word [r9 + rdx*2], 0x5c
jne 0x14008174d
test al, al
js 0x140081728
lea rax, [rcx - 1]
mov byte [rsp + 0x77], al
mov rcx, rbx
jmp 0x140081743
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140081ee8
dec rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov word [rcx + rax*2], 0
mov al, byte [rsp + 0x77]
test al, al
movzx eax, al
cmovs rax, qword [rsp + 0x68]
mov r9, qword [rsp + 0x60]
cmovns r9, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, r13
mov r8, rbp
call fcn.140050a14
cmp byte [rsp + 0x77], 0
jns 0x140081785
mov rcx, qword [rsp + 0x60]
call fcn.140150da4
inc r14
cmp r14, 7
jne 0x14008152c
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x1400817b9
lea rdx, [0x1401a94c2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400817bc
mov rax, rdi
mov dl, byte [rsi + 0x17]
test dl, dl
mov r12, qword [rsi]
mov r8, qword [rsi + 8]
mov r9, rsi
cmovs r9, r12
movzx ecx, dl
mov r13, rcx
cmovs r13, r8
cmp r13, 0xc
jl 0x140081878
lea r10, [r9 + r13*2]
lea r11, [r9 + r13*2]
add r11, 0xfffffffffffffffe
mov qword [rsp + 0x38], r11
lea rdi, str._user_name
mov rbx, r9
add r13, 0xfffffffffffffff5
xor ebp, ebp
cmp word [rbx + rbp], 0x24
je 0x140081816
add rbp, 2
dec r13
jne 0x140081804
jmp 0x14008186e
mov r13, rbx
add r13, rbp
je 0x14008186e
mov r11, r10
mov qword [rsp + 0x30], rax
mov rax, r14
xor r14d, r14d
movzx r10d, word [r13 + r14]
cmp r10w, word [r14 + rdi]
jne 0x140081848
add r14, 2
cmp r14, 0x18
jne 0x14008182c
jmp 0x140081b14
mov r13, qword [rsp + 0x38]
sub r13, rbx
add rbx, rbp
add rbx, 2
sub r13, rbp
sar r13, 1
cmp r13, 0xc
mov r14, rax
mov rax, qword [rsp + 0x30]
mov r10, r11
jge 0x1400817fe
movabs rdi, 0xaaaaaaaaaaaaaaaa
test dl, dl
cmovns r12, rsi
cmovs rcx, r8
cmp rcx, 0xf
jge 0x1400818bb
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x140081938
lea rdx, [0x1401a9532]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
jmp 0x14008193d
lea rdx, [r12 + rcx*2]
lea r8, [r12 + rcx*2]
add r8, 0xfffffffffffffffe
lea r9, str._machine_name
mov r10, r12
add rcx, 0xfffffffffffffff2
xor r11d, r11d
cmp word [r10 + r11], 0x24
je 0x1400818eb
add r11, 2
dec rcx
jne 0x1400818d8
jmp 0x140081888
mov r15, r10
add r15, r11
je 0x140081888
xor ecx, ecx
movzx edi, word [r15 + rcx]
cmp di, word [rcx + r9]
jne 0x140081910
add rcx, 2
cmp rcx, 0x1e
jne 0x1400818f5
jmp 0x140081c14
mov rcx, r8
sub rcx, r10
add r10, r11
add r10, 2
sub rcx, r11
sar rcx, 1
cmp rcx, 0xf
movabs rdi, 0xaaaaaaaaaaaaaaaa
jge 0x1400818d1
jmp 0x140081888
mov qword [rsp + 0x38], rdi
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x140081965
lea rdx, [0x1401a956a]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov dl, byte [rsi + 0x17]
test dl, dl
mov rax, qword [rsi]
mov r8, qword [rsi + 8]
mov r9, rsi
cmovs r9, rax
movzx ecx, dl
mov r13, rcx
cmovs r13, r8
cmp r13, 0xe
jl 0x140081a1b
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rdi
lea r15, [r9 + r13*2]
lea r11, [r9 + r13*2]
add r11, 0xfffffffffffffffe
lea rdi, str._client_name
mov rbx, r9
add r13, 0xfffffffffffffff3
xor r14d, r14d
cmp word [rbx + r14], 0x24
je 0x1400819cb
add r14, 2
dec r13
jne 0x1400819b8
jmp 0x140081a0c
mov rbp, rbx
add rbp, r14
je 0x140081a0c
xor r13d, r13d
movzx r10d, word [rbp + r13]
cmp r10w, word [r13 + rdi]
jne 0x1400819f3
add r13, 2
cmp r13, 0x1c
jne 0x1400819d6
jmp 0x140081d07
mov r13, r11
sub r13, rbx
add rbx, r14
add rbx, 2
sub r13, r14
sar r13, 1
cmp r13, 0xe
jge 0x1400819b1
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x30]
test dl, dl
cmovns rax, rsi
cmovs rcx, r8
cmp rcx, 0xf
jge 0x140081a94
test r12, r12
je 0x140081a39
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x140081a47
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x140081a55
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140081a65
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140152280
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rax + rcx*2]
lea r8, [rax + rcx*2]
add r8, 0xfffffffffffffffe
lea r9, str._session_name
mov r10, rax
add rcx, 0xfffffffffffffff2
xor r11d, r11d
cmp word [r10 + r11], 0x24
je 0x140081ac7
add r11, 2
dec rcx
jne 0x140081ab1
jmp 0x140081a2b
mov rbp, r10
add rbp, r11
je 0x140081a2b
mov rbx, rdi
xor ecx, ecx
movzx edi, word [rbp + rcx]
cmp di, word [rcx + r9]
jne 0x140081af3
add rcx, 2
cmp rcx, 0x1e
jne 0x140081ad8
jmp 0x140081dff
mov rcx, r8
sub rcx, r10
add r10, r11
add r10, 2
sub rcx, r11
sar rcx, 1
cmp rcx, 0xf
mov rdi, rbx
jge 0x140081aaa
jmp 0x140081a2b
cmp r13, r11
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov r14, rax
je 0x140081878
sub r13, r9
mov r9, r13
add r9, 2
je 0x140081878
lea rbp, [rsp + 0x60]
mov dword [rbp], 0
xor ecx, ecx
mov rdx, rbp
mov rbx, qword [rsp + 0x30]
mov rax, rbx
call qword [0x1401b8a50]
mov ecx, dword [rbp]
test rcx, rcx
je 0x140081c02
sar r13, 1
add rcx, rcx
call fcn.140150ddc
mov rbp, rax
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rax, rbx
call qword [0x1401b8a50]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
movaps xmmword [rsp + 0x80], xmm6
mov rcx, r15
mov rdx, rbp
call fcn.1400279c4
movzx eax, byte [rsp + 0x97]
test al, al
jns 0x140081bc5
mov rax, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, 0xc
mov rcx, rsi
mov rdx, r13
mov r9, r15
call fcn.140050a14
cmp byte [rsp + 0x97], 0
jns 0x140081bf5
mov rcx, qword [rsp + 0x80]
call fcn.140150da4
test rbp, rbp
je 0x140081c02
mov rcx, rbp
call fcn.140150de4
mov dl, byte [rsi + 0x17]
mov r12, qword [rsi]
mov r8, qword [rsi + 8]
movzx ecx, dl
jmp 0x140081878
cmp r15, rdx
movabs rdi, 0xaaaaaaaaaaaaaaaa
je 0x140081888
sub r15, r12
mov rax, r15
add rax, 2
je 0x140081888
lea r12, [rsp + 0x60]
mov dword [r12], 0
mov ecx, 5
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [r12]
test rcx, rcx
je 0x140081888
sar r15, 1
add rcx, rcx
call fcn.140150ddc
mov r12, rax
lea r8, [rsp + 0x60]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x80]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rcx, r13
mov rdx, r12
call fcn.1400279c4
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x140081cc1
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, rsi
mov rdx, r15
mov r9, r13
call fcn.140050a14
cmp byte [rsp + 0x97], 0
jns 0x140081cf1
mov rcx, qword [rsp + 0x80]
call fcn.140150da4
test r12, r12
je 0x140081888
mov rcx, r12
call fcn.140150de4
jmp 0x140081888
cmp rbp, r15
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
je 0x140081a16
sub rbp, r9
mov r9, rbp
add r9, 2
mov r15, qword [rsp + 0x30]
je 0x140081a1b
lea r9, [rsp + 0x60]
mov qword [r9], 0
lea rax, [rsp + 0x5c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
mov rax, qword [rsp + 0x38]
call qword [0x1401b8a50]
test eax, eax
je 0x140081ded
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x80]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.1400279c4
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x140081daf
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, 0xe
mov rcx, rsi
mov rdx, rbp
mov r9, r13
call fcn.140050a14
mov rcx, qword [rsp + 0x60]
mov rax, rdi
call qword [0x1401b8a50]
cmp byte [rsp + 0x97], 0
jns 0x140081ded
mov rcx, qword [rsp + 0x80]
call fcn.140150da4
mov dl, byte [rsi + 0x17]
mov rax, qword [rsi]
mov r8, qword [rsi + 8]
movzx ecx, dl
jmp 0x140081a1b
cmp rbp, rdx
je 0x140081a2b
sub rbp, rax
mov rax, rbp
add rax, 2
je 0x140081a2b
mov rdi, rbx
lea r9, [rsp + 0x60]
mov qword [r9], 0
lea rax, [rsp + 0x5c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
mov rax, qword [rsp + 0x38]
call qword [0x1401b8a50]
test eax, eax
je 0x140081a2b
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x80]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.1400279c4
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x140081e9b
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, rsi
mov rdx, rbp
mov r9, r13
call fcn.140050a14
mov rcx, qword [rsp + 0x60]
mov rax, rdi
call qword [0x1401b8a50]
cmp byte [rsp + 0x97], 0
jns 0x140081a2b
mov rcx, qword [rsp + 0x80]
call fcn.140150da4
jmp 0x140081a2b
int3
int3
int3
int3
int3