Function at 0x140008860
Capabilities:
Get hostname
Get user security identifier

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x310
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x58], rsp
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x44], r14d
lea rax, [0x14025d868]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x40], r14d
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x100]
call fcn.14012d3f0
mov ecx, 0x200
call fcn.14012a230
mov rbx, rax
mov qword [rsp + 0x70], rax
xor edx, edx
mov r8d, 0x100
mov rcx, rax
call fcn.14012d3f0
nop
mov dword [rsp + 0x48], 0x10
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x14000892b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x88], r14
lea rdx, [0x140008924]
mov rcx, rsp
call fcn.14012ebb0
nop
nop
nop
xor eax, eax
jmp 0x140008ba6
lea r8, [rsp + 0xb0]
mov edx, 0x10
lea rcx, [rsp + 0xd8]
call fcn.14013291c
mov r8d, 1
lea rdx, [0x14025f0bc]
lea rcx, [rsp + 0xb0]
call fcn.14013f678
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x40], r14d
mov rdi, r14
mov qword [rsp + 0x60], r14
mov rsi, r14
mov qword [rsp + 0x68], r14
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [rsp + 0xb0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140008a74
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140008a74
cmp eax, 0x534
jne 0x140008a2d
lea rcx, [rsp + 0xb0]
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], si
jne 0x1400089d4
lea rax, [rax*2 - 2]
cmp rax, 0x22
jae 0x140008a28
mov word [rsp + rax + 0xb0], r14w
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [rsp + 0xb0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
jmp 0x140008a74
call fcn.14012a714
cmp eax, 0x6fd
jne 0x140008a46
call fcn.140008360
mov rbx, rax
mov qword [rsp + 0x70], rax
jmp 0x140008b71
call fcn.140008360
mov qword [rsp + 0x80], rax
lea rdx, [0x140008a67]
mov rcx, qword [rsp + 0x58]
call fcn.14012ebb0
nop
nop
nop
mov rax, qword [rsp + 0x80]
jmp 0x140008ba6
mov ecx, dword [rsp + 0x44]
call fcn.140132458
mov rdi, rax
mov qword [rsp + 0x60], rax
mov ecx, dword [rsp + 0x40]
lea rcx, [rcx*2 + 1]
call fcn.140132458
mov rsi, rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x44]
mov r8, rdi
lea rdx, [rsp + 0xb0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140008afc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x90], r14
lea rdx, [0x140008af5]
mov rcx, qword [rsp + 0x58]
call fcn.14012ebb0
nop
nop
nop
xor eax, eax
jmp 0x140008ba6
mov dword [rsp + 0x48], 0x100
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x140008b18
mov dword [rsp + 0x50], r14d
jmp 0x140008b35
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.1400086b0
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140008b5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x98], r14
lea rdx, [0x140008b57]
mov rcx, qword [rsp + 0x58]
call fcn.14012ebb0
nop
nop
nop
xor eax, eax
jmp 0x140008ba6
lea r8, [rsp + 0x100]
mov edx, 0x100
mov rcx, rbx
call fcn.14013291c
nop
test rdi, rdi
je 0x140008b7e
mov rcx, rdi
call fcn.14012efe0
test rsi, rsi
je 0x140008b8b
mov rcx, rsi
call fcn.14012efe0
jmp 0x140008ba3
mov rax, rbx
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.14012a1e0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret