Function at 0x14005ac00
Capabilities:
Get hostname

Disassembly:
sub rsp, 0x538
mov rax, qword [0x1400e6480]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov rax, qword [0x1400e79b0]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x6c], 0xffffffff
mov dword [rsp + 0x40], 0
cmp dword [0x1400e7998], 0
je 0x14005ac51
xor eax, eax
jmp 0x14005b10e
call fcn.1400826c8
mov dword [rax], 0
mov qword [rsp + 0x58], 0
mov r8, qword [0x1400e79a8]
lea rdx, [0x1400e18b0]
lea rcx, str._s:_extracting_all_groups_of_user__s
call fcn.140002e20
mov dword [rsp + 0x70], shutdown
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_GetComputerNameW]
test eax, eax
jne 0x14005acca
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1400e18e8]
lea rcx, str._s:_GetComputerNameW___failed:__d
call fcn.140002e50
call fcn.1400826c8
mov dword [rax], 0x83
jmp 0x14005b077
mov dword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
jne 0x14005ad04
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x14005ad1c
mov eax, dword [rsp + 0x60]
mov ecx, eax
call fcn.140078014
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14005ad48
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1400e1920]
lea rcx, str._s:_GetTokenInformation___failed:__d
call fcn.140002e50
call fcn.1400826c8
mov dword [rax], 0x83
jmp 0x14005b077
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x60]
mov r8, qword [rsp + 0x50]
mov edx, 2
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
jne 0x14005ad9f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1400e1958]
lea rcx, str._s:_GetTokenInformation___failed_with_error__d
call fcn.140002e50
call fcn.1400826c8
mov dword [rax], 0x83
jmp 0x14005b077
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
shl rax, 3
mov rcx, rax
call fcn.140078014
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14005adcf
call fcn.1400826c8
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
jmp 0x14005b077
mov dword [rsp + 0x44], 0
jmp 0x14005ade3
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
cmp dword [rsp + 0x44], eax
jae 0x14005b03f
mov eax, dword [rsp + 0x44]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 0x10]
and eax, 4
test eax, eax
je 0x14005ae28
mov eax, dword [rsp + 0x44]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + rax + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidSid]
test eax, eax
jne 0x14005ae2a
jmp 0x14005add9
mov eax, dword [rsp + 0x44]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x80], rax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx + rax + 8]
mov dword [rsp + 0x64], eax
mov byte [rsp + 0x90], 0
mov byte [rsp + 0x91], 0
mov byte [rsp + 0x92], 0
mov byte [rsp + 0x93], 0
mov byte [rsp + 0x94], 0
mov byte [rsp + 0x95], 5
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetSidIdentifierAuthority]
mov r8d, 6
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400766c0
test eax, eax
jne 0x14005b03a
cmp dword [rsp + 0x64], 0x15
je 0x14005aecb
cmp dword [rsp + 0x64], 0x20
jne 0x14005b03a
mov dword [rsp + 0x7c], 0x101
mov dword [rsp + 0x78], shutdown
mov dword [rsp + 0x74], 0
lea rax, [rsp + 0x74]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
lea r8, [rsp + 0x310]
mov rdx, qword [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountSidW]
test eax, eax
jne 0x14005af51
call fcn.1400826c8
mov dword [rax], 2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1400e1998]
lea rcx, [0x1400e19a8]
call fcn.140002df0
jmp 0x14005b077
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x64], 0x20
je 0x14005af83
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xb8]
call fcn.140084d84
test eax, eax
jne 0x14005afa6
lea r9, [rsp + 0x310]
lea r8, [0x1400e19cc]
mov edx, 0x111
lea rcx, [rsp + 0xe0]
call fcn.140054bc0
jmp 0x14005afd4
lea rax, [rsp + 0x310]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
lea r8, [0x1400e19d8]
mov edx, 0x111
lea rcx, [rsp + 0xe0]
call fcn.140054bc0
mov edx, 0x111
lea rcx, [rsp + 0xe0]
call fcn.140085698
mov r8, qword [0x1400e79a8]
lea rdx, [rsp + 0xe0]
lea rcx, str.Added_group__ls_for_user__s
call fcn.140002e50
lea rcx, [rsp + 0xe0]
call fcn.14005f430
movsxd rcx, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
cmp qword [rcx + rax*8], 0
jne 0x14005b03a
call fcn.1400826c8
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
jmp 0x14005b077
jmp 0x14005add9
mov eax, dword [rsp + 0x40]
mov dword [0x1400e799c], eax
movsxd rax, dword [rsp + 0x40]
shl rax, 3
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call fcn.1400856ec
mov qword [0x1400e79a0], rax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x6c], 0
cmp qword [rsp + 0x50], 0
je 0x14005b089
mov rcx, qword [rsp + 0x50]
call fcn.140078000
cmp qword [rsp + 0x58], 0
je 0x14005b0e6
cmp dword [rsp + 0x40], 0
je 0x14005b0e6
mov dword [rsp + 0x48], 0
jmp 0x14005b0ac
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x48], eax
jge 0x14005b0dc
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
cmp qword [rcx + rax*8], 0
je 0x14005b0da
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx + rax*8]
call fcn.140078000
jmp 0x14005b0a2
mov rcx, qword [rsp + 0x58]
call fcn.140078000
mov r8, qword [0x1400e79a8]
lea rdx, str.get_user_groups
lea rcx, str._s:_done_extracting_all_groups_of_user__s
call fcn.140002e20
mov dword [0x1400e7998], 1
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.1400758f0
add rsp, 0x538
ret