Function at 0x18005b6b0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov byte [rsp + 0x30], 0x5e
movabs rax, 0xb7631f6aa46cc
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xf8], 0x5c
movzx eax, byte [0x1800a6848]
mov byte [rsp + 0x21], al
mov dword [rsp + 0x70], 0xe7
movsxd rax, dword [0x1800a6894]
mov qword [rsp + 0x100], rax
movsxd rax, dword [0x1800a6894]
mov qword [rsp + 0xf0], rax
mov eax, dword [0x1800a68a4]
mov dword [rsp + 0x2c], eax
mov rax, qword [0x1800a6840]
mov dword [rsp + 0x90], eax
mov eax, dword [str.s_3EU]
mov word [rsp + 0x28], ax
mov qword [rsp + 0xb8], 0xef
mov rax, qword [0x1800a6850]
mov dword [rsp + 0x74], eax
mov dword [rsp + 0xd0], 0x4f
mov dword [rsp + 0x9c], 0xdb7c
mov eax, dword [0x1800a68a4]
mov eax, eax
mov qword [rsp + 0xa0], rax
movzx eax, byte [0x1800a6747]
mov dword [rsp + 0x48], eax
movabs rax, 0x61d16c108719
mov qword [rsp + 0x108], rax
movzx eax, byte [0x1800a6747]
mov byte [rsp + 0x20], al
mov rax, qword [0x1800a6878]
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x24], 0xcf8205ab
mov eax, 0x329b
mov word [rsp + 0x34], ax
mov eax, 0x2e41
mov word [rsp + 0x38], ax
mov eax, dword [0x1800a68a4]
mov word [rsp + 0x7c], ax
movzx eax, word [0x1800a689c]
mov word [rsp + 0x80], ax
mov rax, qword [0x1800a6880]
mov dword [rsp + 0x54], eax
movzx eax, byte [0x1800a688c]
mov byte [rsp + 0x31], al
mov qword [rsp + 0x110], 0xd058
movsx eax, byte [str.rRegistryHelper::Se]
mov dword [rsp + 0xd4], eax
mov qword [rsp + 0x118], 0x79fa2cbf
mov eax, dword [0x1800a6830]
mov dword [rsp + 0xd8], eax
mov rax, qword [0x1800a6850]
mov dword [rsp + 0xdc], eax
mov rax, qword [0x1800a6830]
mov qword [rsp + 0x120], rax
mov eax, 0xfb7e
mov word [rsp + 0x84], ax
mov byte [rsp + 0x32], 0x51
mov eax, 0x6114
mov word [rsp + 0x88], ax
lea rdx, [0x180087020]
lea rcx, str.OutputDebugStringW
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov dword [0x180acbe90], eax
movzx eax, word [0x1800a68a0]
mov word [0x1800a6864], ax
movzx eax, byte [rsp + 0x20]
movsx eax, al
shl eax, 2
mov dword [rsp + 0x70], eax
mov eax, dword [0x180acbe90]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
add eax, 0x3bf
mov dword [rsp + 0xe0], eax
mov eax, dword [rsp + 0x3c]
add eax, 0x36e
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x3c]
add eax, 0x25d
mov dword [rsp + 0xe4], eax
movzx eax, byte [0x1800a6746]
movsx eax, al
mov ecx, dword [rsp + 0x24]
imul eax, ecx
movzx ecx, byte [0x1800a6746]
movsx ecx, cl
sub ecx, eax
mov eax, ecx
mov byte [0x1800a6746], al
mov dword [rsp + 0x8c], 0xa4
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0x130]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov eax, dword [rsp + 0x58]
imul eax, eax, 0x1fd
mov ecx, dword [rsp + 0x58]
sub ecx, 0x10b
cmp eax, ecx
je 0x18005bd85
mov eax, dword [rsp + 0x24]
add eax, 0x4900
mov byte [0x1800a6747], al
mov rdx, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x130]
call fcn.180078480
test eax, eax
je 0x18005bd85
mov eax, dword [0x1800a681c]
shl eax, 2
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x21]
movsx eax, al
mov ecx, dword [0x1800a6890]
sub ecx, eax
mov eax, ecx
mov dword [0x1800a6890], eax
movzx eax, word [rsp + 0x28]
movsx rax, ax
mov rcx, qword [rsp + 0xb8]
cmp rax, rcx
jne 0x18005ba44
movsx eax, byte [str.rRegistryHelper::Se]
mov ecx, dword [rsp + 0x54]
cmp eax, ecx
jb 0x18005b9bb
mov dword [rsp + 0x60], 1
jmp 0x18005b9c3
mov dword [rsp + 0x60], 0
movsx eax, byte [str.rRegistryHelper::Se]
cmp eax, 0x5f
jl 0x18005b9d9
mov dword [rsp + 0x5c], 1
jmp 0x18005b9e1
mov dword [rsp + 0x5c], 0
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x60], eax
jne 0x18005ba24
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x18005ba05
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xa8], rax
jmp 0x18005ba16
movzx eax, byte [rsp + 0x21]
movsx rax, al
mov qword [rsp + 0xa8], rax
movzx eax, byte [rsp + 0xa8]
mov byte [rsp + 0x20], al
jmp 0x18005ba42
mov eax, dword [rsp + 0x2c]
mov ecx, dword [0x1800a6894]
sub ecx, eax
mov eax, ecx
mov ecx, dword [0x1800a6894]
sub ecx, eax
mov eax, ecx
mov dword [0x1800a6894], eax
jmp 0x18005ba5b
movzx eax, byte [0x1800a6717]
test eax, eax
je 0x18005ba5b
mov eax, 0x90b6
mov word [0x1800a6804], ax
mov eax, dword [0x180acbe90]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [0x1800a6864], ax
mov eax, dword [rsp + 0x44]
add eax, 0x153
mov dword [rsp + 0x94], eax
movzx eax, byte [0x1800a675f]
test eax, eax
je 0x18005baab
mov eax, 0xd3148781
mov rcx, qword [0x1800a6848]
imul rcx, rax
mov rax, rcx
mov dword [0x1800a681c], eax
jmp 0x18005bb60
movzx eax, word [0x1800a6858]
test eax, eax
je 0x18005bb60
movsx eax, word [0x1800a67ec]
test eax, eax
jne 0x18005bacf
mov dword [rsp + 0x64], 1
jmp 0x18005bad7
mov dword [rsp + 0x64], 0
movzx eax, byte [rsp + 0x20]
movsx eax, al
cmp eax, dword [rsp + 0x64]
jle 0x18005bb60
movzx eax, word [rsp + 0x34]
cwde
sub eax, dword [0x1800a68a8]
movzx ecx, byte [rsp + 0x20]
movsx ecx, cl
mov edx, dword [rsp + 0x74]
sub edx, ecx
mov ecx, edx
imul eax, ecx
cdqe
movsx rcx, byte [0x1800a6743]
mov rdx, qword [rsp + 0xa0]
imul rcx, rdx
mov edx, dword [0x1800a6870]
mov r8d, dword [str.s_3EU]
sub edx, r8d
mov edx, edx
sub rcx, rdx
add rax, rcx
test rax, rax
jne 0x18005bb45
mov qword [rsp + 0xb0], 1
jmp 0x18005bb51
mov qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0xb0]
mov qword [0x1800a6880], rax
mov eax, dword [rsp + 0x44]
add eax, 0x91
mov dword [rsp + 0xe8], eax
mov dword [rsp + 0x24], 2
mov eax, dword [0x180acbe90]
mov dword [0x1800a68a8], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x18005bba3
cmp dword [rsp + 0x40], 1
je 0x18005bbb4
cmp dword [rsp + 0x40], 2
je 0x18005bbce
jmp 0x18005bbe1
mov rax, qword [rsp + 0xc0]
mov qword [0x1800a6880], rax
jmp 0x18005bbe1
mov eax, dword [rsp + 0x90]
add eax, 0xf221f3a
mov ecx, dword [rsp + 0x24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
jmp 0x18005bbe1
mov eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
not eax
mov word [rsp + 0x28], ax
mov eax, dword [rsp + 0x44]
add eax, 0x49
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x94]
mov ecx, dword [rsp + 0x98]
or eax, ecx
cmp eax, 0x322
je 0x18005bd85
mov eax, dword [rsp + 0x9c]
test eax, eax
jne 0x18005bc1f
mov dword [rsp + 0x68], 1
jmp 0x18005bc27
mov dword [rsp + 0x68], 0
movzx eax, word [rsp + 0x38]
cwde
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
test eax, eax
jne 0x18005bc43
mov dword [rsp + 0x6c], 1
jmp 0x18005bc4b
mov dword [rsp + 0x6c], 0
movsx eax, byte [str.rRegistryHelper::Se]
movzx ecx, byte [rsp + 0x21]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0x6c]
imul ecx, eax
mov eax, ecx
cdqe
movzx ecx, byte [0x1800a675f]
mov rdx, qword [rsp + 0xa0]
sub rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x70]
sub rcx, rdx
xor rax, rcx
mov qword [0x1800a6830], rax
mov rax, qword [rsp + 0xb8]
movzx ecx, byte [0x1800a6746]
movsx rcx, cl
cmp rax, rcx
jl 0x18005bd7b
mov rax, qword [0x1800a6850]
cmp rax, qword [rsp + 0xc0]
jae 0x18005bd24
mov eax, dword [rsp + 0x74]
test eax, eax
jne 0x18005bccc
mov dword [rsp + 0x78], 1
jmp 0x18005bcd4
mov dword [rsp + 0x78], 0
movzx eax, byte [0x1800a6746]
movsx eax, al
and eax, dword [rsp + 0x78]
cdqe
movzx ecx, word [0x1800a675c]
mov rdx, qword [0x1800a68b0]
xor rdx, rcx
mov rcx, rdx
not rcx
sub rax, rcx
mov dword [0x1800a6888], eax
mov eax, dword [0x1800a681c]
imul eax, eax, 0x5e08
movsx ecx, word [0x1800a67ec]
add ecx, eax
mov eax, ecx
mov word [0x1800a67ec], ax
jmp 0x18005bd7b
movsxd rax, dword [0x1800a689c]
movabs rcx, 0xd5a098943885a
imul rax, rcx
mov ecx, dword [0x1800a6888]
not ecx
mov ecx, ecx
sub rax, rcx
movzx ecx, word [0x1800a6860]
movzx ecx, cx
mov rdx, qword [rsp + 0xa0]
or rdx, 0xfc
sub rcx, rdx
sub rax, rcx
mov dword [rsp + 0x48], eax
mov rax, qword [0x1800a6840]
imul rax, rax, 0x8b
mov dword [rsp + 0x2c], eax
mov eax, 0xffffffff
jmp 0x18005be52
movzx eax, word [0x1800a68a0]
movsx rax, ax
mov rcx, qword [0x1800a68b8]
cmp rax, rcx
jae 0x18005bda6
mov dword [rsp + 0x50], 1
jmp 0x18005bdae
mov dword [rsp + 0x50], 0
movzx eax, word [0x1800a68a0]
cwde
cmp eax, 0x18
jge 0x18005bdc5
mov dword [rsp + 0x4c], 1
jmp 0x18005bdcd
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x4c]
cmp dword [rsp + 0x50], eax
jg 0x18005be07
movzx eax, byte [0x1800a6746]
movsx eax, al
mov ecx, dword [rsp + 0x2c]
imul ecx, eax
mov eax, ecx
mov ecx, dword [0x1800a68a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0xf0]
mov dword [0x1800a681c], eax
jmp 0x18005be50
mov rax, qword [rsp + 0xf8]
mov rcx, qword [0x1800a6830]
sub rcx, rax
mov rax, rcx
mov qword [0x1800a6830], rax
movzx eax, byte [0x1800a675e]
movsx rax, al
mov rcx, qword [rsp + 0xc8]
sub rax, rcx
movzx ecx, byte [0x1800a675e]
movsx rcx, cl
sub rcx, rax
mov rax, rcx
mov byte [0x1800a675e], al
xor eax, eax
add rsp, 0x1e8
ret