Function at 0x7ff7ed4223d4
Capabilities:
Get hostname
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x7ff7ed868f18]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r14, rcx
mov qword [rsp + 0x60], rcx
lea rdi, [rcx + 0x140]
call fcn.7ff7ed41a1c8
comisd xmm0, xmmword [0x7ff7ed6f2390]
jbe 0x7ff7ed422434
xor ecx, ecx
call fcn.7ff7ed6c74d8
mov rcx, qword [rdi]
mov qword [rcx + 0x2f8], rax
mov qword [rsp + 0x58], rdi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], eax
mov rax, qword [rdi]
xor esi, esi
cmp byte [rax + 0x2e8], sil
je 0x7ff7ed422997
mov byte [rax + 0x2e8], sil
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov rcx, rax
call fcn.7ff7ed4079d8
mov ecx, dword [rax + 0x60]
mov rax, qword [rdi]
mov dword [rax + 0x448], ecx
mov dword [rsp + 0x20], 0x10
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
lea rax, [rsp + 0x120]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], si
jne 0x7ff7ed4224c3
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x70]
call fcn.7ff7ed383b88
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.7ff7ed42e864
mov rcx, qword [rdi]
add rcx, 0x360
mov rdx, rax
call fcn.7ff7ed395734
mov rdx, qword [rsp + 0xa8]
mov r15d, 0x1000
cmp rdx, 0x10
jb 0x7ff7ed422549
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x7ff7ed422544
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7ed422e45
call fcn.7ff7ed6b5394
movdqa xmm0, xmmword [0x7ff7ed6f2210]
movdqu xmmword [rsp + 0xa0], xmm0
mov byte [rsp + 0x90], sil
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x7ff7ed4225a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x7ff7ed42259e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7ed422e4b
call fcn.7ff7ed6b5394
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
lea rax, [rsp + 0x120]
inc rbx
cmp word [rax + rbx*2], si
jne 0x7ff7ed4225d2
mov r8, rbx
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x70]
call fcn.7ff7ed383b88
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.7ff7ed42e864
mov rcx, qword [rdi]
add rcx, 0x380
mov rdx, rax
call fcn.7ff7ed395734
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x7ff7ed422654
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x7ff7ed42264f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7ed422e51
call fcn.7ff7ed6b5394
movdqa xmm0, xmmword [0x7ff7ed6f2210]
movdqu xmmword [rsp + 0xa0], xmm0
mov byte [rsp + 0x90], sil
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x7ff7ed4226ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x7ff7ed4226a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7ed422e57
call fcn.7ff7ed6b5394
xor ecx, ecx
call fcn.7ff7ed6c74d8
mov rcx, rax
call fcn.7ff7ed6c54b0
mov rax, qword [rdi]
mov dword [rax + 0x444], 6
lea rcx, [rsp + 0x40]
call fcn.7ff7ed42b9f4
nop
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.7ff7ed42e864
mov rcx, qword [rdi]
add rcx, 0x3a0
mov rdx, rax
call fcn.7ff7ed395734
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x7ff7ed422738
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x7ff7ed422733
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7ed422e5d
call fcn.7ff7ed6b5394
mov rdx, qword [rsp + 0x40]
add rdx, 0x20
lea rcx, [rsp + 0x90]
call fcn.7ff7ed42e864
mov rcx, qword [rdi]
add rcx, 0x3c0
mov rdx, rax
call fcn.7ff7ed395734
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x7ff7ed42279f
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x7ff7ed42279a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7ed422e63
call fcn.7ff7ed6b5394
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
lea rbx, [0x7ff7ed6f0c0d]
mov rdx, rbx
cmp qword [rax + 0x10], rsi
cmovne rdx, qword [rax + 0x10]
mov rcx, qword [rdi]
add rcx, 0x320
call fcn.7ff7ed3c21e0
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov rdx, rbx
cmp qword [rax + 0x20], rsi
cmovne rdx, qword [rax + 0x20]
mov rcx, qword [rdi]
add rcx, 0x340
call fcn.7ff7ed3c21e0
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov rdx, rbx
cmp qword [rax + 0x30], rsi
cmovne rdx, qword [rax + 0x30]
mov rcx, qword [rdi]
add rcx, 0x3e0
call fcn.7ff7ed3c21e0
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
cmp qword [rax + 0x40], rsi
cmovne rbx, qword [rax + 0x40]
mov rcx, qword [rdi]
add rcx, 0x400
mov rdx, rbx
call fcn.7ff7ed3c21e0
mov rax, qword [rdi]
lea rbx, [rax + 0x7f8]
lea rdx, [rax + 0x3e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff7ed422879
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
call fcn.7ff7ed392c04
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.7ff7ed42e5bc
mov rax, qword [rdi]
lea rbx, [rax + 0x810]
lea rdx, [rax + 0x400]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff7ed4228c7
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
call fcn.7ff7ed392c04
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.7ff7ed42e5bc
mov rax, qword [rdi]
lea rbx, [rax + 0x828]
lea rdx, [rax + 0x320]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff7ed422915
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
call fcn.7ff7ed392c04
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.7ff7ed42e5bc
mov rcx, r14
call fcn.7ff7ed418f40
mov rax, qword [rdi]
lea rbx, [rax + 0x840]
lea rdx, [rax + 0x340]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff7ed42296b
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
call fcn.7ff7ed392c04
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.7ff7ed42e5bc
mov rcx, r14
call fcn.7ff7ed416944
nop
lea rcx, [rsp + 0x40]
call fcn.7ff7ed414f0c
jmp 0x7ff7ed42299d
mov r15d, 0x1000
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov r12d, esi
cmp dword [rax + 8], 0x64
cmovbe r12d, dword [rax + 8]
mov dword [rsp + 0x38], r12d
mov rcx, qword [rdi]
mov r13d, dword [rcx + 0x448]
mov dword [rsp + 0x28], r13d
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov rcx, rax
call fcn.7ff7ed4079d8
mov ecx, dword [rax + 0x60]
mov dword [rsp + 0x20], ecx
cmp dword [rsp + 0x30], esi
jle 0x7ff7ed422a56
xor ecx, ecx
call fcn.7ff7ed6c74d8
mov rcx, qword [rdi]
mov rdx, qword [rcx + 0x860]
add rdx, 0x1e
cmp rax, rdx
jle 0x7ff7ed422a2d
call fcn.7ff7ed42cb68
mov ebx, eax
mov rcx, qword [rdi]
cmp dword [rcx + 0x858], eax
je 0x7ff7ed422a2d
xor ecx, ecx
call fcn.7ff7ed6c74d8
mov rcx, qword [rdi]
mov qword [rcx + 0x860], rax
mov rcx, qword [rdi]
mov dword [rcx + 0x858], ebx
xor ecx, ecx
call fcn.7ff7ed6c74d8
mov r8, qword [rdi]
imul ecx, dword [rsp + 0x30], 0x3c
movsxd rdx, ecx
add rdx, qword [r8 + 0x860]
cmp rax, rdx
jle 0x7ff7ed422a56
cmp dword [r8 + 0x858], esi
mov cl, 1
jne 0x7ff7ed422a59
mov cl, sil
mov rax, qword [rdi]
mov byte [rax + 0x2e9], cl
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov bl, byte [rax + 0x70]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov r8, qword [rdi]
add r8, 0x810
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
lea r9, [r8 + 8]
mov rdx, qword [r9]
sub rdx, qword [r8]
sar rdx, 5
lea rcx, [rsp + 0x70]
call fcn.7ff7ed40a5f8
nop
mov r8, qword [rdi]
add r8, 0x7f8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
lea r9, [r8 + 8]
mov rdx, qword [r9]
sub rdx, qword [r8]
sar rdx, 5
lea rcx, [rsp + 0x40]
call fcn.7ff7ed40a5f8
nop
mov r9b, bl
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.7ff7ed42dd94
mov rcx, qword [rdi]
add rcx, 0x420
mov rdx, rax
call fcn.7ff7ed395734
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x7ff7ed422b4b
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x7ff7ed422b46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7ed422e69
call fcn.7ff7ed6b5394
mov rbx, qword [rdi]
lea rcx, [rbx + 0x420]
lea rdx, str.none
call fcn.7ff7ed40a088
test al, al
je 0x7ff7ed422b90
mov byte [rbx + 0x2ea], 1
xor edx, edx
mov rcx, r14
call fcn.7ff7ed421864
mov rax, qword [rdi]
mov dword [rax + 0x444], 4
movsd xmm6, qword [0x7ff7ed7491a0]
jmp 0x7ff7ed422c1a
mov rbx, qword [rbx + 0x2f8]
xor ecx, ecx
call fcn.7ff7ed6c74d8
mov rdx, rbx
mov rcx, rax
call fcn.7ff7ed6c74a8
movsd xmm6, qword [0x7ff7ed7491a0]
comisd xmm0, xmm6
jb 0x7ff7ed422bdc
xor ecx, ecx
call fcn.7ff7ed6c74d8
mov rcx, qword [rdi]
mov qword [rcx + 0x2f8], rax
xor edx, edx
mov rcx, r14
call fcn.7ff7ed421864
mov dl, 1
mov rcx, r14
call fcn.7ff7ed421864
mov rax, qword [rdi]
mov byte [rax + 0x2ea], sil
mov rax, qword [rdi]
cmp byte [rax + 0x2e9], sil
je 0x7ff7ed422c64
test r12d, r12d
jg 0x7ff7ed422c69
mov dl, sil
mov rcx, r14
call fcn.7ff7ed421864
mov rdx, qword [rdi]
mov al, byte [rdx + 0x2e9]
neg al
sbb ecx, ecx
neg ecx
add ecx, 2
mov dword [rdx + 0x444], ecx
mov rax, qword [rdi]
mov rbx, qword [rax + 0x2f0]
xor ecx, ecx
call fcn.7ff7ed6c74d8
mov rdx, rbx
mov rcx, rax
call fcn.7ff7ed6c74a8
comisd xmm0, xmm6
jb 0x7ff7ed422c83
xor ecx, ecx
call fcn.7ff7ed6c74d8
mov rcx, qword [rdi]
mov qword [rcx + 0x2f0], rax
mov rcx, r14
call fcn.7ff7ed416944
nop
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
nop
jmp 0x7ff7ed422c83
test r13d, r13d
jle 0x7ff7ed422bf7
mov dl, 1
jmp 0x7ff7ed422bfa
mov eax, dword [rsp + 0x20]
mov rcx, qword [rdi]
cmp byte [rcx + 0x2e9], sil
je 0x7ff7ed422cb7
cmp eax, r12d
je 0x7ff7ed422e13
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov rcx, rax
call fcn.7ff7ed4079d8
mov dword [rax + 0x60], r12d
mov eax, dword [rsp + 0x20]
jmp 0x7ff7ed422cc0
cmp eax, r13d
je 0x7ff7ed422e13
mov rcx, qword [rdi]
cmp byte [rcx + 0x2e9], sil
jne 0x7ff7ed422ce6
cmp eax, r13d
je 0x7ff7ed422ce6
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov rcx, rax
call fcn.7ff7ed4079d8
mov dword [rax + 0x60], r13d
mov rcx, qword [rdi]
cmp byte [rcx + 0x2e9], sil
je 0x7ff7ed422cfc
test r12d, r12d
jg 0x7ff7ed422d05
jmp 0x7ff7ed422e13
test r13d, r13d
jle 0x7ff7ed422e13
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov rcx, rax
call fcn.7ff7ed4079d8
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0x90]
call fcn.7ff7ed406fc4
lea rcx, [rbx + 0x30]
mov rdx, rax
call fcn.7ff7ed411a28
lea rcx, [rsp + 0x90]
call fcn.7ff7ed407414
xor r9d, r9d
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0xc0]
call fcn.7ff7ed39e974
nop
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x30]
call fcn.7ff7ed3a1134
mov rdx, qword [rax]
mov r8, qword [rdx + 0x28]
lea rdx, [rsp + 0xc0]
mov rcx, rax
call r8
mov rax, qword [rdi]
lea rdx, [rsp + 0xc0]
mov rcx, qword [rax + 0x30]
call fcn.7ff7ed3a16e0
mov rax, qword [rdi]
cmp byte [rax + 0x2ea], sil
jne 0x7ff7ed422dbf
mov dl, 1
mov rcx, r14
call fcn.7ff7ed421864
nop
mov rbx, qword [rsp + 0xd8]
test rbx, rbx
je 0x7ff7ed422df4
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov word [rsp + 0xce], si
mov rcx, rbx
call fcn.7ff7ed39ebe8
mov edx, 0x18
mov rcx, rbx
call fcn.7ff7ed6b5394
mov rcx, qword [rsp + 0xf0]
call fcn.7ff7ed6bca50
mov edx, 1
mov rcx, qword [rsp + 0xe8]
call fcn.7ff7ed6b5394
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.7ff7ed6b54e0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.7ff7ed6bc794
nop
call fcn.7ff7ed6bc794
nop
call fcn.7ff7ed6bc794
nop
call fcn.7ff7ed6bc794
nop
call fcn.7ff7ed6bc794
int3
call fcn.7ff7ed6bc794
nop
call fcn.7ff7ed6bc794
int3