Function at 0x1400e5994
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x298
movaps xmmword [rsp + 0x280], xmm6
mov r14, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x278], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
mov qword [rcx + 0x10], rax
movaps xmm6, xmmword [0x1401146a0]
movups xmmword [rcx], xmm6
cmp byte [rdx + 0x17], 0
js 0x1400e5a3d
mov rax, qword [rdx + 0x10]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [r14], xmm0
movzx ebp, byte [r14 + 0x17]
test bpl, bpl
mov rcx, qword [r14 + 8]
mov rax, rbp
cmovs rax, rcx
test rax, rax
jne 0x1400e5a51
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140079ea0
mov rax, r14
movaps xmm6, xmmword [rsp + 0x280]
add rsp, 0x298
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, r14
mov rdx, rax
call fcn.140063364
jmp 0x1400e59f6
cmp rax, 1
jne 0x1400e5f01
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
test rsi, rsi
je 0x1400e5a94
lea rdx, [0x14011e8ea]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rsi
mov esi, 8
lea r13, str._windows
lea r15, [rsp + 0x70]
mov rbp, qword [rsi + r13 - 8]
mov rcx, r14
mov rdx, rbp
xor r8d, r8d
call fcn.140063260
cmp rax, 0xffffffffffffffff
jne 0x1400e5ad2
add rsi, 0x10
cmp rsi, 0x78
jne 0x1400e5aaa
jmp 0x1400e5c20
mov rdi, rax
mov rcx, rbp
call fcn.140077408
mov r12, rax
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.14007c4d0
mov r8d, dword [rsi + r13]
xor ecx, ecx
mov rdx, r15
xor r9d, r9d
call qword [rsp + 0x38]
test eax, eax
jne 0x1400e5b0b
mov word [rsp + 0x70], 0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x60], rax
movaps xmmword [rsp + 0x50], xmm6
mov rcx, r15
call fcn.140077408
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov rdx, r15
mov r8, rax
call fcn.140070e26
mov dl, byte [rsp + 0x67]
test dl, dl
mov rcx, qword [rsp + 0x58]
movzx ebx, dl
mov rax, rbx
cmovs rax, rcx
test rax, rax
jne 0x1400e5b90
test dl, dl
cmovs rbx, rcx
mov r9, qword [rsp + 0x50]
cmovns r9, rbp
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
mov r8, r12
call fcn.1400e0bfa
cmp byte [rsp + 0x67], 0
jns 0x1400e5ac3
mov rcx, qword [rsp + 0x50]
call fcn.140076eb8
jmp 0x1400e5ac3
test dl, dl
mov r8, qword [rsp + 0x50]
cmovs rbp, r8
cmp word [rbp + rax*2 - 2], 0x5c
jne 0x1400e5bf0
movzx ebp, byte [r14 + 0x17]
mov rax, rbp
test bpl, bpl
jns 0x1400e5bb4
mov rax, qword [r14 + 8]
lea r9, [r12 + rdi]
cmp rax, r9
jbe 0x1400e5bf0
mov rax, r14
test bpl, bpl
jns 0x1400e5bc8
mov rax, qword [r14]
cmp word [rax + r9*2], 0x5c
lea rbp, [rsp + 0x50]
jne 0x1400e5b54
test dl, dl
jns 0x1400e5bfa
lea rax, [rcx - 1]
mov qword [rsp + 0x58], rax
lea rax, [r8 + rcx*2]
add rax, 0xfffffffffffffffe
jmp 0x1400e5c0a
lea rbp, [rsp + 0x50]
jmp 0x1400e5b54
lea rax, [rbx - 1]
mov byte [rsp + 0x67], al
lea rax, [rsp + rbx*2]
add rax, 0x4e
mov word [rax], 0
mov dl, byte [rsp + 0x67]
mov rcx, qword [rsp + 0x58]
movzx ebx, dl
jmp 0x1400e5b54
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
movabs rbp, 0xaaaaaaaaaaaaaaaa
test rax, rax
je 0x1400e5c52
lea rdx, [0x14011e992]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
lea rdx, str._user_name
mov rcx, r14
xor r8d, r8d
call fcn.140063260
cmp rax, 0xffffffffffffffff
je 0x1400e5c8a
mov rsi, rax
lea rdi, [rsp + 0x50]
mov dword [rdi], 0
xor ecx, ecx
mov rdx, rdi
call rbp
mov ecx, dword [rdi]
test rcx, rcx
jne 0x1400e5f36
lea rdx, str._machine_name
mov rcx, r14
xor r8d, r8d
call fcn.140063260
cmp rax, 0xffffffffffffffff
je 0x1400e5ccb
mov rdi, rax
lea rbx, [rsp + 0x50]
mov dword [rbx], 0
mov ecx, 5
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [rbx]
test rcx, rcx
jne 0x1400e5fd1
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
test rax, rax
je 0x1400e5cfd
lea rdx, [0x14011ea02]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x1400e5d27
lea rdx, [0x14011ea3a]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
lea rdx, str._client_name
mov rcx, r14
xor r8d, r8d
call fcn.140063260
cmp rax, 0xffffffffffffffff
je 0x1400e5df4
mov rbp, rax
lea r9, [rsp + 0x50]
mov qword [r9], 0
lea rax, [rsp + 0x4c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
call rdi
test eax, eax
je 0x1400e5df4
mov rbx, r15
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x70]
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm6
mov r15, qword [rsp + 0x50]
mov rcx, r15
call fcn.140077408
mov rcx, rsi
mov rdx, r15
mov r8, rax
call fcn.140070e26
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400e5dbb
mov rax, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r8d, 0xe
mov rcx, r14
mov rdx, rbp
mov r9, rsi
call fcn.1400e0bfa
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x30]
cmp byte [rsp + 0x87], 0
jns 0x1400e5df1
mov rcx, qword [rsp + 0x70]
call fcn.140076eb8
mov r15, rbx
lea rdx, str._session_name
mov rcx, r14
xor r8d, r8d
call fcn.140063260
cmp rax, 0xffffffffffffffff
je 0x1400e5ebb
mov rbp, rax
lea r9, [rsp + 0x50]
mov qword [r9], 0
lea rax, [rsp + 0x4c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
call rdi
test eax, eax
je 0x1400e5ebb
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x70]
mov qword [rdi + 0x10], rax
movaps xmmword [rdi], xmm6
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140077408
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.140070e26
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x1400e5e85
mov rax, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r14
mov rdx, rbp
mov r9, rdi
call fcn.1400e0bfa
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x30]
cmp byte [rsp + 0x87], 0
jns 0x1400e5ebb
mov rcx, qword [rsp + 0x70]
call fcn.140076eb8
test r12, r12
je 0x1400e5ec9
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
mov rsi, qword [rsp + 0x40]
je 0x1400e5edc
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r13, r13
je 0x1400e5eea
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rsi, rsi
je 0x1400e5a0e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400e5a0e
test bpl, bpl
mov rdx, qword [r14]
mov rbx, r14
cmovs rbx, rdx
movzx edi, word [rbx]
cmp di, 0x27
je 0x1400e6071
cmp di, 0x22
jne 0x1400e5a5b
cmp word [rbx + rax*2 - 2], 0x22
jne 0x1400e5a5b
jmp 0x1400e607d
add rcx, rcx
call fcn.140077350
mov r12, rax
lea rdx, [rsp + 0x50]
mov rcx, rax
call rbp
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x80], rax
movaps xmmword [rsp + 0x70], xmm6
mov rcx, r12
call fcn.140077408
mov rcx, r15
mov rdx, r12
mov r8, rax
call fcn.140070e26
movzx eax, byte [rsp + 0x87]
test al, al
jns 0x1400e5f8e
mov rax, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r8d, 0xc
mov rcx, r14
mov rdx, rsi
mov r9, r15
call fcn.1400e0bfa
cmp byte [rsp + 0x87], 0
jns 0x1400e5fbb
mov rcx, qword [rsp + 0x70]
call fcn.140076eb8
test r12, r12
je 0x1400e5c8a
mov rcx, r12
call fcn.140076ec0
jmp 0x1400e5c8a
add rcx, rcx
call fcn.140077350
mov rbx, rax
lea r8, [rsp + 0x50]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x10], rax
movaps xmmword [rbp], xmm6
mov rcx, rbx
call fcn.140077408
mov rcx, rbp
mov rdx, rbx
mov r8, rax
call fcn.140070e26
movzx eax, byte [rbp + 0x17]
test al, al
jns 0x1400e602e
mov rax, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r14
mov rdx, rdi
mov r9, rbp
call fcn.1400e0bfa
cmp byte [rsp + 0x87], 0
jns 0x1400e605b
mov rcx, qword [rsp + 0x70]
call fcn.140076eb8
test rbx, rbx
je 0x1400e5ccb
mov rcx, rbx
call fcn.140076ec0
jmp 0x1400e5ccb
cmp word [rbx + rax*2 - 2], 0x27
jne 0x1400e5a5b
test bpl, bpl
jns 0x1400e6094
lea rax, [rcx - 1]
mov qword [r14 + 8], rax
lea rax, [rdx + rcx*2]
add rax, 0xfffffffffffffffe
jmp 0x1400e60a4
lea rax, [rbp - 1]
mov byte [r14 + 0x17], al
lea rax, [r14 + rbp*2]
add rax, 0xfffffffffffffffe
mov word [rax], 0
mov r8d, 1
mov rcx, r14
xor edx, edx
call fcn.140073b5e
jmp 0x1400e5a5b