Function at 0x140057ff8
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov r12, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x270], rax
call fcn.14002e592
movzx ebp, byte [r12 + 0x17]
test bpl, bpl
mov rcx, qword [r12 + 8]
mov rax, rbp
cmovs rax, rcx
test rax, rax
je 0x14005886a
cmp rax, 1
je 0x1400580b6
test bpl, bpl
mov rdx, qword [r12]
mov rbx, r12
cmovs rbx, rdx
movzx edi, word [rbx]
cmp di, 0x27
je 0x140058070
cmp di, 0x22
jne 0x1400580b6
cmp word [rbx + rax*2 - 2], 0x22
je 0x140058078
jmp 0x1400580b6
cmp word [rbx + rax*2 - 2], 0x27
jne 0x1400580b6
test bpl, bpl
js 0x140058090
lea rax, [rbp - 1]
mov byte [r12 + 0x17], al
lea rax, [r12 + rbp*2]
add rax, 0xfffffffffffffffe
jmp 0x1400580a1
lea rax, [rcx - 1]
mov qword [r12 + 8], rax
lea rax, [rdx + rcx*2]
add rax, 0xfffffffffffffffe
mov word [rax], 0
mov r8d, 1
mov rcx, r12
xor edx, edx
call fcn.14002eff2
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rsp + 0x38], rax
je 0x1400580e4
lea rdx, [0x14019ecc6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
jmp 0x1400580e4
xor r15d, r15d
mov r13, r15
shl r13, 4
lea rax, str._windows
mov rbp, qword [r13 + rax]
mov rcx, rbp
call fcn.140184604
movzx ebx, byte [r12 + 0x17]
mov rcx, r12
test bl, bl
jns 0x140058113
mov rcx, qword [r12]
test rax, rax
je 0x14005819e
test bl, bl
jns 0x140058125
mov rbx, qword [r12 + 8]
cmp rbx, rax
jl 0x1400582bd
lea r8, [rcx + rbx*2]
movzx esi, word [rbp]
mov rdi, rcx
mov rdx, rbx
sub rdx, rax
inc rdx
je 0x1400582bd
inc rbx
cmp word [rdi], si
je 0x140058161
add rdi, 2
dec rbx
cmp rax, rbx
jne 0x14005814b
jmp 0x1400582bd
test rdi, rdi
je 0x1400582bd
mov edx, 1
cmp rax, rdx
je 0x14005825c
movzx ebx, word [rdi + rdx*2]
cmp bx, word [rbp + rdx*2]
lea rdx, [rdx + 1]
je 0x14005816f
add rdi, 2
mov rbx, r8
sub rbx, rdi
sar rbx, 1
cmp rbx, rax
jge 0x140058139
jmp 0x1400582bd
xor edi, edi
lea rsi, [rsp + 0x60]
mov rcx, rbp
call fcn.140184604
mov r14, rax
lea rax, str._windows
mov r8d, dword [r13 + rax + 8]
xor ecx, ecx
mov rdx, rsi
xor r9d, r9d
call qword [rsp + 0x28]
test eax, eax
jne 0x1400581d3
mov word [rsp + 0x60], 0
lea r13, [rsp + 0x48]
mov rcx, r13
mov rdx, rsi
call fcn.140003584
movzx esi, byte [rsp + 0x5f]
test sil, sil
mov rcx, qword [rsp + 0x50]
mov rax, rsi
cmovs rax, rcx
test rax, rax
je 0x140058282
test sil, sil
mov rdx, qword [rsp + 0x48]
mov rbp, r13
cmovs rbp, rdx
cmp word [rbp + rax*2 - 2], 0x5c
jne 0x140058282
movzx ebx, byte [r12 + 0x17]
mov rax, rbx
test bl, bl
jns 0x140058229
mov rax, qword [r12 + 8]
mov rbp, r14
add rbp, rdi
cmp rax, rbp
jbe 0x140058282
mov rax, r12
test bl, bl
jns 0x14005823f
mov rax, qword [r12]
cmp word [rax + rbp*2], 0x5c
jne 0x140058282
test sil, sil
js 0x140058272
lea rax, [rsi - 1]
mov byte [rsp + 0x5f], al
mov word [rsp + rsi*2 + 0x46], 0
jmp 0x140058282
cmp r8, rdi
je 0x1400582bd
sub rdi, rcx
cmp rdi, 0xfffffffffffffffe
je 0x1400582bd
sar rdi, 1
jmp 0x1400581a0
lea rax, [rcx - 1]
mov qword [rsp + 0x50], rax
mov word [rdx + rcx*2 - 2], 0
movzx eax, byte [rsp + 0x5f]
test al, al
cmovs rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
cmovns r9, r13
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rdi
mov r8, r14
call fcn.14002f076
xor eax, eax
cmp byte [rsp + 0x5f], al
jns 0x1400582bd
mov rcx, qword [rsp + 0x48]
call fcn.140163a8c
inc r15
cmp r15, 7
jne 0x1400580e7
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x1400582f6
lea rdx, [0x14019ed52]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x1400582f6
mov dl, byte [r12 + 0x17]
test dl, dl
mov r9, qword [r12]
mov r10, qword [r12 + 8]
mov rbx, r12
cmovs rbx, r9
movzx eax, dl
mov rcx, rax
cmovs rcx, r10
cmp rcx, 0xc
jl 0x14005843c
lea r8, [rbx + rcx*2]
lea rsi, str._user_name
mov rdi, rbx
add rcx, 0xfffffffffffffff5
je 0x14005843c
cmp word [rdi], 0x24
je 0x14005834d
add rdi, 2
dec rcx
jne 0x140058339
jmp 0x14005843c
test rdi, rdi
je 0x14005843c
mov ecx, 1
cmp rcx, 0xc
je 0x14005838a
movzx ebp, word [rdi + rcx*2]
cmp bp, word [rsi + rcx*2]
lea rcx, [rcx + 1]
je 0x14005835b
add rdi, 2
mov rbp, r8
sub rbp, rdi
mov rcx, rbp
sar rcx, 1
cmp rbp, 0x18
jge 0x14005832f
jmp 0x14005843c
cmp r8, rdi
je 0x14005843c
sub rdi, rbx
cmp rdi, 0xfffffffffffffffe
je 0x14005843c
lea rbp, [rsp + 0x48]
mov dword [rbp], 0
xor ecx, ecx
mov rdx, rbp
call r14
mov ecx, dword [rbp]
test rcx, rcx
je 0x14005842b
sar rdi, 1
add rcx, rcx
call fcn.140163acc
mov rbp, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call r14
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov rdx, rbp
call fcn.140003584
movzx eax, byte [rsp + 0x77]
test al, al
jns 0x1400583f8
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xc
mov rcx, r12
mov rdx, rdi
mov r9, rsi
call fcn.14002f076
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x140058423
mov rcx, qword [rsp + 0x60]
call fcn.140163a8c
mov rcx, rbp
call fcn.140163ad4
mov dl, byte [r12 + 0x17]
mov r9, qword [r12]
mov r10, qword [r12 + 8]
movzx eax, dl
test dl, dl
cmovns r9, r12
cmovs rax, r10
cmp rax, 0xf
jl 0x140058568
lea rdx, [r9 + rax*2]
lea rbp, str._machine_name
mov rdi, r9
add rax, 0xfffffffffffffff2
je 0x140058568
cmp word [rdi], 0x24
je 0x14005847c
add rdi, 2
dec rax
jne 0x140058468
jmp 0x140058568
test rdi, rdi
je 0x140058568
mov eax, 1
cmp rax, 0xf
je 0x1400584ba
movzx ecx, word [rdi + rax*2]
cmp cx, word [rbp + rax*2]
lea rax, [rax + 1]
je 0x14005848a
add rdi, 2
mov rcx, rdx
sub rcx, rdi
mov rax, rcx
sar rax, 1
cmp rcx, 0x1e
jge 0x14005845e
jmp 0x140058568
cmp rdx, rdi
je 0x140058568
sub rdi, r9
cmp rdi, 0xfffffffffffffffe
je 0x140058568
lea rbx, [rsp + 0x48]
mov dword [rbx], 0
mov ecx, 5
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [rbx]
test rcx, rcx
je 0x140058568
sar rdi, 1
add rcx, rcx
call fcn.140163acc
mov rbx, rax
lea r8, [rsp + 0x48]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rbp, [rsp + 0x60]
mov rcx, rbp
mov rdx, rbx
call fcn.140003584
movzx eax, byte [rbp + 0x17]
test al, al
jns 0x140058535
mov rax, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r12
mov rdx, rdi
mov r9, rbp
call fcn.14002f076
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x140058560
mov rcx, qword [rsp + 0x60]
call fcn.140163a8c
mov rcx, rbx
call fcn.140163ad4
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x140058594
lea rdx, [0x14019edc2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
jmp 0x140058594
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
je 0x1400585bb
lea rdx, [0x14019edfa]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400585bb
mov r15b, byte [r12 + 0x17]
test r15b, r15b
mov r10, qword [r12]
mov r9, qword [r12 + 8]
mov rbx, r12
cmovs rbx, r10
movzx edi, r15b
mov rcx, rdi
cmovs rcx, r9
cmp rcx, 0xe
jl 0x14005870b
lea r8, [rbx + rcx*2]
lea rsi, str._client_name
mov rbp, rbx
add rcx, 0xfffffffffffffff3
je 0x14005870b
cmp word [rbp], 0x24
je 0x140058615
add rbp, 2
dec rcx
jne 0x140058600
jmp 0x14005870b
test rbp, rbp
je 0x14005870b
mov ecx, 1
cmp rcx, 0xe
je 0x140058653
movzx edx, word [rbp + rcx*2]
cmp dx, word [rsi + rcx*2]
lea rcx, [rcx + 1]
je 0x140058623
add rbp, 2
mov r11, r8
sub r11, rbp
mov rcx, r11
sar rcx, 1
cmp r11, 0x1c
jge 0x1400585f6
jmp 0x14005870b
cmp r8, rbp
je 0x14005870b
sub rbp, rbx
cmp rbp, 0xfffffffffffffffe
je 0x14005870b
mov rbx, rax
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
call qword [rsp + 0x30]
test eax, eax
je 0x1400586f6
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140003584
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400586c4
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xe
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.14002f076
mov rcx, qword [rsp + 0x48]
call rbx
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400586f6
mov rcx, qword [rsp + 0x60]
call fcn.140163a8c
mov r15b, byte [r12 + 0x17]
mov r10, qword [r12]
mov r9, qword [r12 + 8]
movzx edi, r15b
mov rax, rbx
test r15b, r15b
cmovns r10, r12
cmovs rdi, r9
cmp rdi, 0xf
jl 0x14005882e
lea rdx, [r10 + rdi*2]
lea rbx, str._session_name
mov rbp, r10
add rdi, 0xfffffffffffffff2
je 0x14005882e
cmp word [rbp], 0x24
je 0x14005874d
add rbp, 2
dec rdi
jne 0x140058738
jmp 0x14005882e
test rbp, rbp
je 0x14005882e
mov ecx, 1
cmp rcx, 0xf
je 0x14005878b
movzx edi, word [rbp + rcx*2]
cmp di, word [rbx + rcx*2]
lea rcx, [rcx + 1]
je 0x14005875b
add rbp, 2
mov rcx, rdx
sub rcx, rbp
mov rdi, rcx
sar rdi, 1
cmp rcx, 0x1e
jge 0x14005872e
jmp 0x14005882e
cmp rdx, rbp
je 0x14005882e
sub rbp, r10
cmp rbp, 0xfffffffffffffffe
je 0x14005882e
mov rdi, rax
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
call qword [rsp + 0x30]
test eax, eax
je 0x14005882e
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140003584
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400587fc
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.14002f076
mov rcx, qword [rsp + 0x48]
call rdi
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x14005882e
mov rcx, qword [rsp + 0x60]
call fcn.140163a8c
test r13, r13
je 0x14005883c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x14005884a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14005885a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14005886a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140163e00
mov rax, r12
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret