Function at 0x100009fc4
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x100080218]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor esi, esi
mov rdi, rcx
movabs r14, 0x8001000000000001
mov dword [rsp + 0x20], esi
cmp dword [0x1000814c4], esi
je 0x10000a04c
mov al, byte [0x1000814c8]
cmp al, 4
jb 0x10000aa39
test qword [0x1000814b0], r14
je 0x10000a04c
mov rcx, qword [0x1000814b8]
mov rax, rcx
and rax, r14
cmp rax, rcx
jne 0x10000a04c
mov rcx, qword [0x100081a88]
lea rdx, [0x1000762a8]
call fcn.100009c50
mov rax, qword [rdi + 8]
mov qword [0x1000802b8], rax
mov rax, qword [rdi]
mov qword [0x100080260], rax
call fcn.10000dc58
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x198
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebp, 1
lea r13, [0x1000762b8]
lea r12, [0x100080210]
cmp eax, esi
jne 0x10000aa47
mov dword [0x1000801f0], ebp
call sym.spoolsv.exe_PrvSplIsUpgrade
mov r15d, 0x5c
lea rdx, [rsp + 0x24]
lea rcx, [0x100080a5c]
mov word [0x100080a5a], r15w
mov word [0x100080a58], r15w
mov dword [rsp + 0x24], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, esi
je 0x10000aa78
call fcn.10000d288
mov ecx, eax
call fcn.10000d950
cmp eax, esi
mov ebx, eax
jl 0x10000aacf
lea rdx, [0x100081ab0]
lea rcx, [0x100081ab8]
call sym.spoolsv.exe_PrvBuildOtherNamesFromMachineName
cmp eax, esi
je 0x10000ab28
mov rax, qword [0x100081ab8]
mov word [0x100080b60], r15w
mov word [0x100080b62], r15w
mov r8, qword [rax + 8]
mov edx, 0x102
lea rcx, [0x100080b64]
lea rax, [rdx + 0x7ffffefc]
cmp rax, rsi
je 0x10000a163
movzx eax, word [r8]
cmp ax, si
je 0x10000a163
mov word [rcx], ax
add r8, 2
add rcx, 2
sub rdx, rbp
jne 0x10000a13e
cmp rdx, rsi
je 0x10000ab67
mov word [rcx], si
call fcn.10000d5c4
cmp eax, esi
mov ebx, eax
jl 0x10000ab70
call fcn.10000d488
cmp eax, esi
mov ebx, eax
jl 0x10000abc9
call fcn.10000d190
cmp eax, esi
jne 0x10000a1a7
mov ecx, ebp
call fcn.10000d6d8
cmp eax, esi
mov ebx, eax
jl 0x10000ac22
lea r8, [rsp + 0x20]
lea rcx, [0x100076310]
xor edx, edx
call fcn.100009a9c
mov qword [0x1000802b0], rax
cmp rax, rsi
je 0x10000ac73
mov rcx, qword [rax + 0x10]
call fcn.10000aa14
cmp eax, esi
je 0x10000acc0
call fcn.10000b284
mov rcx, qword [0x100081a90]
call fcn.100008cb8
mov dword [0x1000801ec], ebp
call fcn.10000afa4
call fcn.10000beb0
call fcn.10000ad54
call fcn.10000ae58
call fcn.10000c2f0
call fcn.10000c39c
call fcn.10000c068
mov rcx, rdi
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [0x1000814c4], esi
je 0x10000a261
mov al, byte [0x1000814c8]
cmp al, 4
jb 0x10000ad18
test qword [0x1000814b0], r14
je 0x10000a261
mov rdx, qword [0x1000814b8]
mov rcx, rdx
and rcx, r14
cmp rcx, rdx
jne 0x10000a261
mov rcx, qword [0x100081a88]
lea rdx, [0x100075f08]
call fcn.100009c50
call fcn.10000aea4
int3
cmp al, sil
je 0x10000a01e
jmp 0x10000a04c
mov rcx, qword [0x100080210]
cmp rcx, r12
je 0x10000a0a9
test byte [rcx + 0x1c], bpl
je 0x10000a0a9
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 9]
mov r9d, eax
mov r8, r13
call fcn.10001c06c
jmp 0x10000a0a9
mov rax, qword [0x100080210]
cmp rax, r12
je 0x10000aaaa
test byte [rax + 0x1c], bpl
je 0x10000aaaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100080210]
lea edx, [r15 - 0x51]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c06c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100077858]
xor r8d, r8d
mov edx, eax
call fcn.100033384
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x100080210]
cmp rcx, r12
je 0x10000aaf5
test byte [rcx + 0x1c], bpl
je 0x10000aaf5
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, eax
mov r8, r13
call fcn.10001c06c
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100077898]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100033384
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x100080210]
cmp rax, r12
je 0x10000ab5b
test byte [rax + 0x1c], bpl
je 0x10000ab5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100080210]
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c06c
mov word [0x100080b60], si
jmp 0x10000a16f
sub rcx, 2
jmp 0x10000a16c
mov rcx, qword [0x100080210]
cmp rcx, r12
je 0x10000ab96
test byte [rcx + 0x1c], bpl
je 0x10000ab96
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r9d, eax
mov r8, r13
call fcn.10001c06c
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x100077878]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100033384
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x100080210]
cmp rcx, r12
je 0x10000abef
test byte [rcx + 0x1c], bpl
je 0x10000abef
mov rcx, qword [rcx + 0x10]
mov edx, 0xf
mov r9d, eax
mov r8, r13
call fcn.10001c06c
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x1000778a8]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100033384
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x100080210]
cmp rcx, r12
je 0x10000ac48
test byte [rcx + 0x1c], bpl
je 0x10000ac48
mov rcx, qword [rcx + 0x10]
mov edx, 0x10
mov r9d, eax
mov r8, r13
call fcn.10001c06c
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
lea rcx, [0x1000778b8]
cmove ebx, eax
xor r8d, r8d
mov edx, ebx
call fcn.100033384
nop
jmp 0x10000a1a7
mov rcx, qword [0x100080210]
cmp rcx, r12
je 0x10000ac9b
test byte [rcx + 0x1c], bpl
je 0x10000ac9b
mov r9d, dword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
mov edx, 0x11
mov r8, r13
call fcn.10001c06c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100077868]
xor r8d, r8d
mov edx, eax
call fcn.100033384
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x100080210]
cmp rax, r12
je 0x10000acf3
test byte [rax + 0x1c], bpl
je 0x10000acf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100080210]
mov edx, 0x12
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.10001c06c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100077868]
xor r8d, r8d
mov edx, eax
call fcn.100033384
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp al, sil
jne 0x10000a261
jmp 0x10000a233