Function at 0x180004340
Capabilities:
Get common file path
Get hostname

Disassembly:
push rbx
sub rsp, 0x290
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800140a0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x61]
call fcn.1800062a0
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [rsp + 0x60]
mov edx, 0x104
lea rcx, [0x180017ad0]
call fcn.180005490
lea rdx, [0x180010848]
lea rcx, [rsp + 0x60]
call fcn.1800054f4
mov byte [rax + 1], 0
lea r8, [rsp + 0x60]
mov edx, 0x104
lea rcx, [0x180017be0]
call fcn.180005490
mov rbx, qword [0x180016060]
test rbx, rbx
jne 0x180004416
movzx ecx, word [0x180016050]
call fcn.180004840
mov rbx, rax
movzx r8d, word [0x180016050]
mov rdx, qword [0x180016058]
mov rcx, rax
call fcn.180004d00
movzx edx, word [0x180016050]
dec edx
mov rcx, rbx
call fcn.180001bf0
mov qword [0x180016060], rbx
mov r9, rbx
lea r8, [0x180017be0]
lea rdx, [0x180011c4c]
lea rcx, [0x1800179c0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [0x180015820]
test rbx, rbx
jne 0x18000447e
movzx ecx, word [0x180015810]
call fcn.180004840
mov rbx, rax
movzx r8d, word [0x180015810]
mov rdx, qword [str.5_nx__tH]
mov rcx, rax
call fcn.180004d00
movzx edx, word [0x180015810]
dec edx
mov rcx, rbx
call fcn.180001bf0
mov qword [0x180015820], rbx
mov r9, rbx
lea r8, [0x1800179c0]
lea rdx, str._s_s
lea rcx, [0x1800178b0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [0x180016048]
test rbx, rbx
jne 0x1800044e6
movzx ecx, word [0x180016038]
call fcn.180004840
mov rbx, rax
movzx r8d, word [0x180016038]
mov rdx, qword [0x180016040]
mov rcx, rax
call fcn.180004d00
movzx edx, word [0x180016038]
dec edx
mov rcx, rbx
call fcn.180001bf0
mov qword [0x180016048], rbx
mov r9, rbx
lea r8, [0x1800179c0]
lea rdx, str._s_s
lea rcx, [0x1800177a0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [0x180015838]
test rbx, rbx
jne 0x18000454e
movzx ecx, word [0x180015828]
call fcn.180004840
mov rbx, rax
movzx r8d, word [0x180015828]
mov rdx, qword [0x180015830]
mov rcx, rax
call fcn.180004d00
movzx edx, word [0x180015828]
dec edx
mov rcx, rbx
call fcn.180001bf0
mov qword [0x180015838], rbx
mov r9, rbx
lea r8, [0x1800179c0]
lea rdx, str._s_s
lea rcx, [0x180017690]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [0x180015850]
test rbx, rbx
jne 0x1800045b6
movzx ecx, word [0x180015840]
call fcn.180004840
mov rbx, rax
movzx r8d, word [0x180015840]
mov rdx, qword [0x180015848]
mov rcx, rax
call fcn.180004d00
movzx edx, word [0x180015840]
dec edx
mov rcx, rbx
call fcn.180001bf0
mov qword [0x180015850], rbx
mov r9, rbx
lea r8, [0x1800179c0]
lea rdx, str._s_s
lea rcx, [0x180017580]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [0x180016198]
test rbx, rbx
jne 0x18000461e
movzx ecx, word [0x180016188]
call fcn.180004840
mov rbx, rax
movzx r8d, word [0x180016188]
mov rdx, qword [0x180016190]
mov rcx, rax
call fcn.180004d00
movzx edx, word [0x180016188]
dec edx
mov rcx, rbx
call fcn.180001bf0
mov qword [0x180016198], rbx
mov r9, rbx
lea r8, [0x180017ad0]
lea rdx, str._s_s
lea rcx, [0x180017470]
call qword [sym.imp.USER32.dll_wsprintfA]
mov dword [rsp + 0x20], 0x104
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x170]
call fcn.1800062a0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x30]
call fcn.180002150
nop
xor edx, edx
mov r8d, 0x104
lea rcx, str._Unkown_
call fcn.1800062a0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rcx, str._Unkown_
call fcn.180004d00
call fcn.1800046f0
nop
cmp qword [rsp + 0x48], 0x10
jb 0x1800046cd
mov rcx, qword [rsp + 0x30]
call fcn.180004ce8
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180004970
add rsp, 0x290
pop rbx
ret