Function at 0x140181368
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
movaps xmmword [rsp + 0x290], xmm6
mov rsi, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x288], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rdi
movaps xmm6, xmmword [0x14026fe30]
movups xmmword [rcx], xmm6
cmp byte [rdx + 0x17], 0
js 0x1401813c6
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
jmp 0x1401813d8
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rsi
mov rdx, rax
call fcn.1400e9174
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1401813e4
mov rax, qword [rsi + 8]
test rax, rax
je 0x1401819ea
cmp rax, 2
jb 0x140181482
mov rcx, rsi
call fcn.140181efe
cmp word [rax], 0x22
jne 0x140181413
mov rcx, rsi
call fcn.1400e6686
cmp word [rax], 0x22
je 0x14018142f
mov rcx, rsi
call fcn.140181efe
cmp word [rax], 0x27
jne 0x140181482
mov rcx, rsi
call fcn.1400e6686
cmp word [rax], 0x27
jne 0x140181482
movzx edi, byte [rsi + 0x17]
test dil, dil
js 0x140181445
mov rbx, rsi
test rdi, rdi
jne 0x140181455
jmp 0x140181ea4
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x140181ea4
mov rbx, qword [rsi]
lea rdx, [rdi - 1]
mov rcx, rsi
call fcn.14003f5e6
mov word [rbx + rdi*2 - 2], 0
mov r8d, 1
mov rcx, rsi
xor edx, edx
call fcn.1400a7564
movabs rdi, 0xaaaaaaaaaaaaaaaa
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x38], rdi
test rax, rax
je 0x1401814b1
lea rdx, [0x1402962f2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rbx
xor r14d, r14d
lea r15, [rsp + 0x80]
mov rbx, r14
shl rbx, 4
lea rax, str._windows
mov rbp, qword [rbx + rax]
test rbp, rbp
je 0x140181e78
mov rcx, rbp
call fcn.14022f908
movzx edx, byte [rsi + 0x17]
mov rcx, rsi
test dl, dl
jns 0x1401814f2
mov rcx, qword [rsi]
test rax, rax
je 0x14018159c
test dl, dl
jns 0x140181503
mov rdx, qword [rsi + 8]
cmp rdx, rax
jl 0x1401816f3
lea r8, [rcx + rdx*2]
movzx r9d, word [rbp]
lea r10, [rcx + rdx*2]
add r10, 0xfffffffffffffffe
mov r11, rcx
mov r12, rdx
sub r12, rax
inc r12
je 0x1401816f3
inc rdx
xor r12d, r12d
cmp word [r11 + r12], r9w
je 0x14018154d
add r12, 2
dec rdx
cmp rax, rdx
jne 0x140181535
jmp 0x1401816f3
mov r13, r11
add r13, r12
je 0x1401816f3
xor edx, edx
movzx edi, word [r13 + rdx*2]
cmp di, word [rbp + rdx*2]
jne 0x140181575
inc rdx
cmp rax, rdx
jne 0x14018155b
jmp 0x140181675
mov rdx, r10
sub rdx, r11
add r11, r12
add r11, 2
sub rdx, r12
sar rdx, 1
cmp rdx, rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
jge 0x140181520
jmp 0x1401816f3
xor r13d, r13d
mov rcx, rbp
call fcn.14022f908
mov rbp, rax
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.1402055c0
lea rax, str._windows
mov r8d, dword [rbx + rax + 8]
xor ecx, ecx
mov rdx, r15
xor r9d, r9d
mov rax, qword [rsp + 0x38]
call qword [case.0x1400f45b0.0]
test eax, eax
jne 0x1401815e7
mov word [rsp + 0x80], 0
mov qword [rsp + 0x70], rdi
movaps xmmword [rsp + 0x60], xmm6
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov rdx, r15
call fcn.14003f01a
movzx eax, byte [rsp + 0x77]
test al, al
jns 0x14018160f
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1401816b9
mov rcx, rbx
call fcn.1400e6686
cmp word [rax], 0x5c
jne 0x1401816b9
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140181636
mov rax, qword [rsi + 8]
mov rdx, rbp
add rdx, r13
cmp rax, rdx
jbe 0x1401816b9
mov rcx, rsi
call fcn.1400defdc
cmp word [rax], 0x5c
jne 0x1401816b9
movzx eax, byte [rsp + 0x77]
test al, al
js 0x140181698
test rax, rax
je 0x140181ea4
cmp al, 0xc
jae 0x140181ed0
dec rax
mov byte [rsp + 0x77], al
mov rcx, rbx
jmp 0x1401816b3
cmp r13, r8
movabs rdi, 0xaaaaaaaaaaaaaaaa
je 0x1401816f3
sub r13, rcx
mov rax, r13
add rax, 2
je 0x1401816f3
sar r13, 1
jmp 0x14018159f
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140181ea4
mov rcx, qword [rsp + 0x60]
dec rax
mov qword [rsp + 0x68], rax
mov word [rcx + rax*2], 0
movzx eax, byte [rsp + 0x77]
test al, al
cmovs rax, qword [rsp + 0x68]
mov r9, qword [rsp + 0x60]
cmovns r9, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, r13
mov r8, rbp
call fcn.1400e8b2c
cmp byte [rsp + 0x77], 0
jns 0x1401816f3
mov rcx, qword [rsp + 0x60]
call fcn.1402021a8
inc r14
cmp r14, 7
jne 0x1401814c1
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x140181727
lea rdx, [0x1402963a2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14018172a
mov rax, rdi
mov dl, byte [rsi + 0x17]
test dl, dl
mov r12, qword [rsi]
mov r8, qword [rsi + 8]
mov r9, rsi
cmovs r9, r12
movzx ecx, dl
mov r13, rcx
cmovs r13, r8
cmp r13, 0xc
jl 0x1401817eb
lea r10, [r9 + r13*2]
lea r11, [r9 + r13*2]
add r11, 0xfffffffffffffffe
mov qword [rsp + 0x38], r11
lea rdi, str._user_name
mov rbx, r9
add r13, 0xfffffffffffffff5
je 0x1401817e1
xor ebp, ebp
cmp word [rbx + rbp], 0x24
je 0x140181786
add rbp, 2
dec r13
jne 0x140181774
jmp 0x1401817e1
mov r13, rbx
add r13, rbp
je 0x1401817e1
mov r11, r10
mov qword [rsp + 0x30], rax
mov rax, r14
xor r14d, r14d
movzx r10d, word [r13 + r14]
cmp r10w, word [r14 + rdi]
jne 0x1401817b8
add r14, 2
cmp r14, 0x18
jne 0x14018179c
jmp 0x140181aa2
mov r10, qword [rsp + 0x38]
sub r10, rbx
add rbx, rbp
add rbx, 2
sub r10, rbp
mov r13, r10
shr r13, 1
cmp r10, 0x18
mov r14, rax
mov rax, qword [rsp + 0x30]
mov r10, r11
jge 0x14018176c
movabs rdi, 0xaaaaaaaaaaaaaaaa
test dl, dl
cmovns r12, rsi
cmovs rcx, r8
cmp rcx, 0xf
jge 0x14018182e
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x1401818b0
lea rdx, [0x1402963f2]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
jmp 0x1401818b5
lea rdx, [r12 + rcx*2]
lea r8, [r12 + rcx*2]
add r8, 0xfffffffffffffffe
lea r9, str._machine_name
mov r10, r12
add rcx, 0xfffffffffffffff2
je 0x1401817fb
xor r11d, r11d
cmp word [r10 + r11], 0x24
je 0x140181860
add r11, 2
dec rcx
jne 0x14018184d
jmp 0x1401817fb
mov r15, r10
add r15, r11
je 0x1401817fb
xor ecx, ecx
movzx edi, word [r15 + rcx]
cmp di, word [rcx + r9]
jne 0x140181885
add rcx, 2
cmp rcx, 0x1e
jne 0x14018186a
jmp 0x140181ba2
mov rdi, r8
sub rdi, r10
add r10, r11
add r10, 2
sub rdi, r11
mov rcx, rdi
shr rcx, 1
cmp rdi, 0x1e
movabs rdi, 0xaaaaaaaaaaaaaaaa
jge 0x140181844
jmp 0x1401817fb
mov qword [rsp + 0x38], rdi
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x1401818dd
lea rdx, [0x14029642a]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov dl, byte [rsi + 0x17]
test dl, dl
mov rax, qword [rsi]
mov r8, qword [rsi + 8]
mov r9, rsi
cmovs r9, rax
movzx ecx, dl
mov rbp, rcx
cmovs rbp, r8
cmp rbp, 0xe
jl 0x1401819a0
mov qword [rsp + 0x30], rdi
lea r10, [r9 + rbp*2]
lea r11, [r9 + rbp*2]
add r11, 0xfffffffffffffffe
mov qword [rsp + 0x48], r11
lea rdi, str._client_name
mov rbx, r9
add rbp, 0xfffffffffffffff3
je 0x14018199b
xor r13d, r13d
cmp word [rbx + r13], 0x24
je 0x140181940
add r13, 2
dec rbp
jne 0x14018192d
jmp 0x14018199b
mov rbp, rbx
add rbp, r13
je 0x14018199b
mov r11, r10
mov qword [rsp + 0x40], r15
mov r15, r14
xor r14d, r14d
movzx r10d, word [rbp + r14]
cmp r10w, word [r14 + rdi]
jne 0x140181972
add r14, 2
cmp r14, 0x1c
jne 0x140181956
jmp 0x140181c95
mov r10, qword [rsp + 0x48]
sub r10, rbx
add rbx, r13
add rbx, 2
sub r10, r13
mov rbp, r10
shr rbp, 1
cmp r10, 0x1c
mov r14, r15
mov r15, qword [rsp + 0x40]
mov r10, r11
jge 0x140181924
mov rdi, qword [rsp + 0x30]
test dl, dl
cmovns rax, rsi
cmovs rcx, r8
cmp rcx, 0xf
jge 0x140181a19
test r12, r12
je 0x1401819be
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x1401819cc
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x1401819da
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401819ea
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140203460
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rax + rcx*2]
lea r8, [rax + rcx*2]
add r8, 0xfffffffffffffffe
lea r9, str._session_name
mov r10, rax
add rcx, 0xfffffffffffffff2
je 0x1401819b0
xor r11d, r11d
cmp word [r10 + r11], 0x24
je 0x140181a52
add r11, 2
dec rcx
jne 0x140181a3c
jmp 0x1401819b0
mov rbp, r10
add rbp, r11
je 0x1401819b0
mov rbx, rdi
xor ecx, ecx
movzx edi, word [rbp + rcx]
cmp di, word [rcx + r9]
jne 0x140181a7e
add rcx, 2
cmp rcx, 0x1e
jne 0x140181a63
jmp 0x140181d8b
mov rdi, r8
sub rdi, r10
add r10, r11
add r10, 2
sub rdi, r11
mov rcx, rdi
shr rcx, 1
cmp rdi, 0x1e
mov rdi, rbx
jge 0x140181a2f
jmp 0x1401819b0
cmp r13, r11
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov r14, rax
je 0x1401817eb
sub r13, r9
mov r9, r13
add r9, 2
je 0x1401817eb
lea rbp, [rsp + 0x60]
mov dword [rbp], 0
xor ecx, ecx
mov rdx, rbp
mov rbx, qword [rsp + 0x30]
mov rax, rbx
call qword [case.0x1400f45b0.0]
mov ecx, dword [rbp]
test rcx, rcx
je 0x140181b90
sar r13, 1
add rcx, rcx
call fcn.1402021dc
mov rbp, rax
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rax, rbx
call qword [case.0x1400f45b0.0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
movaps xmmword [rsp + 0x80], xmm6
mov rcx, r15
mov rdx, rbp
call fcn.14003f01a
movzx eax, byte [rsp + 0x97]
test al, al
jns 0x140181b53
mov rax, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, ntohs
mov rcx, rsi
mov rdx, r13
mov r9, r15
call fcn.1400e8b2c
cmp byte [rsp + 0x97], 0
jns 0x140181b83
mov rcx, qword [rsp + 0x80]
call fcn.1402021a8
test rbp, rbp
je 0x140181b90
mov rcx, rbp
call fcn.1402021e4
mov dl, byte [rsi + 0x17]
mov r12, qword [rsi]
mov r8, qword [rsi + 8]
movzx ecx, dl
jmp 0x1401817eb
cmp r15, rdx
movabs rdi, 0xaaaaaaaaaaaaaaaa
je 0x1401817fb
sub r15, r12
mov rax, r15
add rax, 2
je 0x1401817fb
lea r12, [rsp + 0x60]
mov dword [r12], 0
mov ecx, 5
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [r12]
test rcx, rcx
je 0x1401817fb
sar r15, 1
add rcx, rcx
call fcn.1402021dc
mov r12, rax
lea r8, [rsp + 0x60]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x80]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rcx, r13
mov rdx, r12
call fcn.14003f01a
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x140181c4f
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rsi
mov rdx, r15
mov r9, r13
call fcn.1400e8b2c
cmp byte [rsp + 0x97], 0
jns 0x140181c7f
mov rcx, qword [rsp + 0x80]
call fcn.1402021a8
test r12, r12
je 0x1401817fb
mov rcx, r12
call fcn.1402021e4
jmp 0x1401817fb
cmp rbp, r11
mov rdi, qword [rsp + 0x30]
mov r14, r15
je 0x140181e6e
sub rbp, r9
mov r9, rbp
add r9, 2
mov r15, qword [rsp + 0x40]
je 0x1401819a0
lea r9, [rsp + 0x60]
mov qword [r9], 0
lea rax, [rsp + 0x5c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
mov rax, qword [rsp + 0x38]
call qword [case.0x1400f45b0.0]
test eax, eax
je 0x140181d79
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x80]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.14003f01a
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x140181d3b
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, ntohs
mov rcx, rsi
mov rdx, rbp
mov r9, r13
call fcn.1400e8b2c
mov rcx, qword [rsp + 0x60]
mov rax, rdi
call qword [case.0x1400f45b0.0]
cmp byte [rsp + 0x97], 0
jns 0x140181d79
mov rcx, qword [rsp + 0x80]
call fcn.1402021a8
mov dl, byte [rsi + 0x17]
mov rax, qword [rsi]
mov r8, qword [rsi + 8]
movzx ecx, dl
jmp 0x1401819a0
cmp rbp, rdx
je 0x1401819b0
sub rbp, rax
mov rax, rbp
add rax, 2
je 0x1401819b0
mov rdi, rbx
lea r9, [rsp + 0x60]
mov qword [r9], 0
lea rax, [rsp + 0x5c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
mov rax, qword [rsp + 0x38]
call qword [case.0x1400f45b0.0]
test eax, eax
je 0x1401819b0
sar rbp, 1
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x80]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call fcn.14003f01a
movzx eax, byte [r13 + 0x17]
test al, al
jns 0x140181e27
mov rax, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rsi
mov rdx, rbp
mov r9, r13
call fcn.1400e8b2c
mov rcx, qword [rsp + 0x60]
mov rax, rdi
call qword [case.0x1400f45b0.0]
cmp byte [rsp + 0x97], 0
jns 0x1401819b0
mov rcx, qword [rsp + 0x80]
call fcn.1402021a8
jmp 0x1401819b0
mov r15, qword [rsp + 0x40]
jmp 0x1401819a0
lea rax, str.string::find__:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str.__s___nullptr
mov r8d, 0xd00
call fcn.14004460c
lea rax, str.string::pop_back__:_string_is_already_empty
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str._empty__
mov r8d, 0xc07
call fcn.14004460c
lea rax, str.__s_should_never_be_greater_than_or_equal_to_the_short_string_capacity
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str.__s_____min_cap
mov r8d, 0x6c6
call fcn.14004460c
int3