Function at 0x18006ce80
Capabilities:
Accept command line arguments
Get hostname
Get session user name
Receive http response

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1288
call fcn.1800364f6
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x342
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x12a8]
mov rax, qword [0x1800ea138]
xor rax, rbp
mov qword [rbp + 0x1230], rax
lea rcx, [0x1800fd3aa]
call fcn.180037c84
mov rax, qword [rbp + 0x1260]
mov rcx, rax
call fcn.180036299
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.180036d5c
nop
mov dword [rbp + 0x44], 0
lea rdx, str.Failed
lea rcx, [rbp + 0x68]
call fcn.180036d5c
nop
lea rdx, [rbp + 0x44]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [rbp + 0x44]
mov ecx, eax
call fcn.180036cd0
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0x44]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x18006cf53
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x68]
call fcn.1800360fa
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x7f8], rax
mov rcx, qword [rbp + 0x7f8]
call fcn.180036e2e
mov dword [rbp + 0xf4], 0x10
lea rdx, str.Failed
lea rcx, [rbp + 0x118]
call fcn.180036d5c
nop
lea rdx, [rbp + 0xf4]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x18006cfb6
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x118]
call fcn.1800360fa
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rbp + 0x158], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x158]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rbp + 0x174], eax
cmp dword [rbp + 0x174], 0
jle 0x18006d8a5
movsxd rax, dword [rbp + 0x174]
mov rcx, rax
call fcn.180036cd0
mov qword [rbp + 0x818], rax
mov rax, qword [rbp + 0x818]
mov qword [rbp + 0x198], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rbp + 0x174]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x158]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, str.Command_line:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180036302
mov rdx, qword [rbp + 0x198]
mov rcx, rax
call fcn.180036302
lea rdx, [0x180036127]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1800b5fd4]
lea rcx, [rbp + 0x1b8]
call fcn.180036d5c
nop
lea rdx, [0x1800b6008]
lea rcx, [rbp + 0x838]
call fcn.180036d5c
nop
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x838]
call fcn.1800365f0
nop
lea rcx, [rbp + 0x838]
call fcn.180036523
lea rax, str.Content_Type:_application_json
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x198]
lea rcx, [rbp + 0xaf8]
call fcn.180036d5c
nop
mov rax, qword [rbp + 0x1260]
add rax, 0x50
mov qword [rbp + 0x1048], rax
lea rcx, [rbp + 0x878]
call fcn.1800378a6
mov qword [rbp + 0x1050], rax
mov rax, qword [rbp + 0x1050]
mov qword [rbp + 0x1058], rax
mov rdx, qword [rbp + 0x1058]
lea rcx, [rbp + 0x8b8]
call fcn.18003669f
mov qword [rbp + 0x1060], rax
mov rax, qword [rbp + 0x1060]
mov qword [rbp + 0x1068], rax
lea rcx, [rbp + 0x8f8]
call fcn.180037a63
mov qword [rbp + 0x1070], rax
mov rax, qword [rbp + 0x1070]
mov qword [rbp + 0x1078], rax
mov rdx, qword [rbp + 0x1078]
lea rcx, [rbp + 0x938]
call fcn.18003669f
mov qword [rbp + 0x1080], rax
mov rax, qword [rbp + 0x1080]
mov qword [rbp + 0x1088], rax
lea rcx, [rbp + 0x978]
call fcn.18003775c
mov qword [rbp + 0x1090], rax
mov rax, qword [rbp + 0x1090]
mov qword [rbp + 0x1098], rax
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x9b8]
call fcn.18003669f
mov qword [rbp + 0x10a0], rax
mov rax, qword [rbp + 0x10a0]
mov qword [rbp + 0x10a8], rax
lea rcx, [rbp + 0x9f8]
call fcn.1800364ec
mov qword [rbp + 0x10b0], rax
mov rax, qword [rbp + 0x10b0]
mov qword [rbp + 0x10b8], rax
mov rdx, qword [rbp + 0x10b8]
lea rcx, [rbp + 0xa38]
call fcn.18003669f
mov qword [rbp + 0x10c0], rax
mov rax, qword [rbp + 0x10c0]
mov qword [rbp + 0x10c8], rax
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xa78]
call fcn.18003669f
mov qword [rbp + 0x10d0], rax
mov rax, qword [rbp + 0x10d0]
mov qword [rbp + 0x10d8], rax
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0xab8]
call fcn.18003669f
mov qword [rbp + 0x10e0], rax
mov rax, qword [rbp + 0x10e0]
mov qword [rbp + 0x10e8], rax
lea rdx, [rbp + 0xaf8]
lea rcx, [rbp + 0xb38]
call fcn.18003669f
mov qword [rbp + 0x10f0], rax
mov rax, qword [rbp + 0x10f0]
mov qword [rbp + 0x10f8], rax
mov rax, qword [rbp + 0x1260]
add rax, 0x28
mov r8, rax
lea rdx, str._dat_:__2____a_:__
lea rcx, [rbp + 0xb78]
call fcn.18003613b
mov qword [rbp + 0x1100], rax
mov rax, qword [rbp + 0x1100]
mov qword [rbp + 0x1108], rax
lea r8, str.____c_:__
mov rdx, qword [rbp + 0x1108]
lea rcx, [rbp + 0xbb8]
call fcn.1800379fa
mov qword [rbp + 0x1110], rax
mov rax, qword [rbp + 0x1110]
mov qword [rbp + 0x1118], rax
mov r8, qword [rbp + 0x10f8]
mov rdx, qword [rbp + 0x1118]
lea rcx, [rbp + 0xbf8]
call fcn.18003628f
mov qword [rbp + 0x1120], rax
mov rax, qword [rbp + 0x1120]
mov qword [rbp + 0x1128], rax
lea r8, str.____d_:__
mov rdx, qword [rbp + 0x1128]
lea rcx, [rbp + 0xc38]
call fcn.1800379fa
mov qword [rbp + 0x1130], rax
mov rax, qword [rbp + 0x1130]
mov qword [rbp + 0x1138], rax
mov r8, qword [rbp + 0x10e8]
mov rdx, qword [rbp + 0x1138]
lea rcx, [rbp + 0xc78]
call fcn.18003628f
mov qword [rbp + 0x1140], rax
mov rax, qword [rbp + 0x1140]
mov qword [rbp + 0x1148], rax
lea r8, str.____e_:__
mov rdx, qword [rbp + 0x1148]
lea rcx, [rbp + 0xcb8]
call fcn.1800379fa
mov qword [rbp + 0x1150], rax
mov rax, qword [rbp + 0x1150]
mov qword [rbp + 0x1158], rax
mov r8, qword [rbp + 0x10d8]
mov rdx, qword [rbp + 0x1158]
lea rcx, [rbp + 0xcf8]
call fcn.18003628f
mov qword [rbp + 0x1160], rax
mov rax, qword [rbp + 0x1160]
mov qword [rbp + 0x1168], rax
lea r8, str.____f_:__
mov rdx, qword [rbp + 0x1168]
lea rcx, [rbp + 0xd38]
call fcn.1800379fa
mov qword [rbp + 0x1170], rax
mov rax, qword [rbp + 0x1170]
mov qword [rbp + 0x1178], rax
mov r8, qword [rbp + 0x10c8]
mov rdx, qword [rbp + 0x1178]
lea rcx, [rbp + 0xd78]
call fcn.18003628f
mov qword [rbp + 0x1180], rax
mov rax, qword [rbp + 0x1180]
mov qword [rbp + 0x1188], rax
lea r8, str.____g_:__
mov rdx, qword [rbp + 0x1188]
lea rcx, [rbp + 0xdb8]
call fcn.1800379fa
mov qword [rbp + 0x1190], rax
mov rax, qword [rbp + 0x1190]
mov qword [rbp + 0x1198], rax
mov r8, qword [rbp + 0x10a8]
mov rdx, qword [rbp + 0x1198]
lea rcx, [rbp + 0xdf8]
call fcn.18003628f
mov qword [rbp + 0x11a0], rax
mov rax, qword [rbp + 0x11a0]
mov qword [rbp + 0x11a8], rax
lea r8, str.____h_:__
mov rdx, qword [rbp + 0x11a8]
lea rcx, [rbp + 0xe38]
call fcn.1800379fa
mov qword [rbp + 0x11b0], rax
mov rax, qword [rbp + 0x11b0]
mov qword [rbp + 0x11b8], rax
mov r8, qword [rbp + 0x1098]
mov rdx, qword [rbp + 0x11b8]
lea rcx, [rbp + 0xe78]
call fcn.18003628f
mov qword [rbp + 0x11c0], rax
mov rax, qword [rbp + 0x11c0]
mov qword [rbp + 0x11c8], rax
lea r8, str.____i_:__
mov rdx, qword [rbp + 0x11c8]
lea rcx, [rbp + 0xeb8]
call fcn.1800379fa
mov qword [rbp + 0x11d0], rax
mov rax, qword [rbp + 0x11d0]
mov qword [rbp + 0x11d8], rax
mov r8, qword [rbp + 0x1088]
mov rdx, qword [rbp + 0x11d8]
lea rcx, [rbp + 0xef8]
call fcn.18003628f
mov qword [rbp + 0x11e0], rax
mov rax, qword [rbp + 0x11e0]
mov qword [rbp + 0x11e8], rax
lea r8, str.____j_:__
mov rdx, qword [rbp + 0x11e8]
lea rcx, [rbp + 0xf38]
call fcn.1800379fa
mov qword [rbp + 0x11f0], rax
mov rax, qword [rbp + 0x11f0]
mov qword [rbp + 0x11f8], rax
mov r8, qword [rbp + 0x1068]
mov rdx, qword [rbp + 0x11f8]
lea rcx, [rbp + 0xf78]
call fcn.18003628f
mov qword [rbp + 0x1200], rax
mov rax, qword [rbp + 0x1200]
mov qword [rbp + 0x1208], rax
lea r8, str.____k_:__
mov rdx, qword [rbp + 0x1208]
lea rcx, [rbp + 0xfb8]
call fcn.1800379fa
mov qword [rbp + 0x1210], rax
mov rax, qword [rbp + 0x1210]
mov qword [rbp + 0x1218], rax
mov rax, qword [rbp + 0x1048]
mov r8, rax
mov rdx, qword [rbp + 0x1218]
lea rcx, [rbp + 0xff8]
call fcn.1800369fb
mov qword [rbp + 0x1220], rax
mov rax, qword [rbp + 0x1220]
mov qword [rbp + 0x1228], rax
lea r8, [0x1800b65fc]
mov rdx, qword [rbp + 0x1228]
lea rcx, [rbp + 0x218]
call fcn.1800379fa
nop
lea rcx, [rbp + 0xff8]
call fcn.180036523
nop
lea rcx, [rbp + 0xfb8]
call fcn.180036523
nop
lea rcx, [rbp + 0xf78]
call fcn.180036523
nop
lea rcx, [rbp + 0xf38]
call fcn.180036523
nop
lea rcx, [rbp + 0xef8]
call fcn.180036523
nop
lea rcx, [rbp + 0xeb8]
call fcn.180036523
nop
lea rcx, [rbp + 0xe78]
call fcn.180036523
nop
lea rcx, [rbp + 0xe38]
call fcn.180036523
nop
lea rcx, [rbp + 0xdf8]
call fcn.180036523
nop
lea rcx, [rbp + 0xdb8]
call fcn.180036523
nop
lea rcx, [rbp + 0xd78]
call fcn.180036523
nop
lea rcx, [rbp + 0xd38]
call fcn.180036523
nop
lea rcx, [rbp + 0xcf8]
call fcn.180036523
nop
lea rcx, [rbp + 0xcb8]
call fcn.180036523
nop
lea rcx, [rbp + 0xc78]
call fcn.180036523
nop
lea rcx, [rbp + 0xc38]
call fcn.180036523
nop
lea rcx, [rbp + 0xbf8]
call fcn.180036523
nop
lea rcx, [rbp + 0xbb8]
call fcn.180036523
nop
lea rcx, [rbp + 0xb78]
call fcn.180036523
nop
lea rcx, [rbp + 0xb38]
call fcn.180036523
nop
lea rcx, [rbp + 0xab8]
call fcn.180036523
nop
lea rcx, [rbp + 0xa78]
call fcn.180036523
nop
lea rcx, [rbp + 0xa38]
call fcn.180036523
nop
lea rcx, [rbp + 0x9f8]
call fcn.180036523
nop
lea rcx, [rbp + 0x9b8]
call fcn.180036523
nop
lea rcx, [rbp + 0x978]
call fcn.180036523
nop
lea rcx, [rbp + 0x938]
call fcn.180036523
nop
lea rcx, [rbp + 0x8f8]
call fcn.180036523
nop
lea rcx, [rbp + 0x8b8]
call fcn.180036523
nop
lea rcx, [rbp + 0x878]
call fcn.180036523
nop
lea rcx, [rbp + 0xaf8]
call fcn.180036523
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x1038], rax
mov rcx, qword [rbp + 0x1038]
call fcn.180036e2e
lea rcx, [rbp + 0x218]
call fcn.180037833
mov dword [rbp + 0x254], eax
lea rcx, [rbp + 0x218]
call fcn.180036299
mov qword [rsp + 0x30], 0
mov ecx, dword [rbp + 0x254]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rbp + 0x254]
mov dword [rsp + 0x20], ecx
mov r9, rax
mov r8d, 0xffffffff
mov rdx, qword [rbp + 0x1f8]
mov rax, qword [rbp + 0x1260]
mov rcx, qword [rax + 0x78]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [rbp + 0x274], eax
cmp dword [rbp + 0x274], 0
je 0x18006d88c
xor edx, edx
mov rax, qword [rbp + 0x1260]
mov rcx, qword [rax + 0x78]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
lea rcx, [rbp + 0x218]
call fcn.180036523
nop
lea rcx, [rbp + 0x1b8]
call fcn.180036523
mov rax, qword [rbp + 0x1260]
mov rcx, qword [rax + 0x78]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rax, qword [rbp + 0x1260]
mov rcx, qword [rax + 0x80]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rax, qword [rbp + 0x1260]
mov rcx, qword [rax + 0x88]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea rcx, [rbp + 0x118]
call fcn.180036523
nop
lea rcx, [rbp + 0x68]
call fcn.180036523
nop
lea rcx, [rbp + 8]
call fcn.180036523
lea rcx, [rbp - 0x40]
lea rdx, [0x1800b32b8]
call fcn.1800377a7
mov rcx, qword [rbp + 0x1230]
xor rcx, rbp
call fcn.180036e4c
lea rsp, [rbp + 0x1248]
pop rdi
pop rbp
ret