Function at 0x180032d00
Capabilities:
Get hostname
Get user security identifier

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x220
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180141088]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rdi, rcx
xor r13d, r13d
mov dword [rsp + 0x70], r13d
mov ebx, 0x104
mov dword [rbp - 0x54], ebx
lea rdx, [rbp - 0x54]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor r8d, r8d
test eax, eax
jne 0x180032d8b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r13
mov byte [rdi], r13b
lea rdx, [0x1800fd01d]
mov rcx, rdi
call fcn.180009ff0
jmp 0x1800332d6
mov dword [rbp - 0x80], r13d
mov dword [rbp - 0x7c], r13d
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x80]
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov eax, dword [rbp - 0x80]
test eax, eax
jne 0x180032ec3
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
lea rdx, [rbp + rcx - 1]
lea rsi, [0x1800ff5cc]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x180032ec0
mov rcx, rbx
lea rax, [rbp]
cmp byte [rax], r13b
je 0x180032e04
inc rax
sub rcx, 1
jne 0x180032df6
mov edx, 0x80070057
test rcx, rcx
cmovne edx, r13d
je 0x180032e1a
mov rax, rbx
sub rax, rcx
jmp 0x180032e1d
mov rax, r13
test edx, edx
js 0x180032e69
sub rbx, rax
lea rcx, [rbp]
lea rcx, [rcx + rax]
je 0x180032e5b
add rax, 0x7ffffefa
add rax, rbx
sub rsi, rcx
nop word [rax + rax]
test rax, rax
je 0x180032e5b
movzx edx, byte [rcx + rsi]
test dl, dl
je 0x180032e5b
mov byte [rcx], dl
inc rcx
dec rax
sub rbx, 1
jne 0x180032e40
lea rax, [rcx - 1]
test rbx, rbx
cmovne rax, rcx
mov byte [rax], r13b
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov eax, dword [rbp - 0x80]
test eax, eax
jne 0x180032ec3
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r13
mov byte [rdi], r13b
xor r8d, r8d
lea rdx, [0x1800fd01d]
mov rcx, rdi
call fcn.180009ff0
jmp 0x1800332d6
mov eax, dword [rbp - 0x80]
xor ecx, ecx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rcx
mov edx, eax
lea rcx, [rbp - 0x38]
call fcn.18002d0d0
nop
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov edx, dword [rbp - 0x7c]
lea rcx, [rbp - 0x50]
call fcn.18002d0d0
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r14, qword [rbp - 0x38]
mov r8, r14
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x180032f63
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r13
cmp qword [rdi + 0x18], 0x10
jb 0x180032f46
mov rax, qword [rdi]
jmp 0x180032f49
mov rax, rdi
mov byte [rax], 0
xor r8d, r8d
lea rdx, [0x1800fd01d]
mov rcx, rdi
call fcn.180009ff0
jmp 0x1800332c3
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x180032f2e
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov rsi, rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx r15d, byte [rax]
lea ecx, [r15 + r15*2]
lea ecx, [rcx*4 + 0x1c]
mov ebx, ecx
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov edx, ecx
lea rcx, [rbp - 0x20]
call fcn.18002d0d0
nop
mov r12, qword [rbp - 0x20]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x30], 1
lea rax, str.S__lu_
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
mov edx, ebx
mov rcx, r12
call fcn.180032a90
movzx r10d, byte [rsi]
test r10b, r10b
jne 0x180033049
cmp byte [rsi + 1], r10b
jne 0x180033049
movzx ecx, byte [rsi + 2]
shl ecx, 0x18
movzx eax, byte [rsi + 3]
shl eax, 0x10
add ecx, eax
movzx eax, byte [rsi + 4]
shl eax, 8
add ecx, eax
movzx eax, byte [rsi + 5]
add ecx, eax
mov dword [rsp + 0x30], ecx
lea rax, [0x180102494]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.180032a90
jmp 0x1800330a8
movzx eax, byte [rsi + 5]
movzx ecx, byte [rsi + 4]
movzx edx, byte [rsi + 3]
movzx r8d, byte [rsi + 2]
movzx r9d, byte [rsi + 1]
movzx r10d, r10b
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r10d
lea rax, str.0x_02hx_02hx_02hx_02hx_02hx_02hx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.180032a90
mov ebx, r13d
test r15d, r15d
je 0x1800330fb
lea rsi, str.__lu
nop word [rax + rax]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [rax]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.180032a90
inc ebx
cmp ebx, r15d
jb 0x1800330c0
mov qword [rbp - 0x60], 0xf
mov qword [rbp - 0x68], r13
mov byte [rbp - 0x78], 0
mov r8, qword [rbp - 0x18]
cmp r12, r8
je 0x180033124
sub r8, r12
mov rdx, r12
lea rcx, [rbp - 0x78]
call fcn.180009ff0
nop
mov rcx, r13
mov ebx, r13d
nop word [rax + rax]
mov r9d, 1
mov r8, rcx
lea rdx, [0x1801024a0]
lea rcx, [rbp - 0x78]
call fcn.18001a130
cmp rax, 0xffffffffffffffff
je 0x18003318a
lea rcx, [rax + 1]
cmp ebx, 6
jne 0x180033174
cmp qword [rbp - 0x68], rcx
jb 0x18003317d
mov qword [rbp - 0x68], rcx
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rax, qword [rbp - 0x78]
mov byte [rax + rcx], 0
inc ebx
cmp ebx, 7
jge 0x18003318a
jmp 0x180033130
lea rcx, str.invalid_string_position
call fcn.1800acb04
int3
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x1800331f6
cmp rbx, 1
jb 0x1800331f6
lea rsi, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rsi, qword [rbp - 0x78]
test rbx, rbx
je 0x1800331f2
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.1800b1dd4
mov rcx, rax
test rax, rax
je 0x1800331f2
cmp byte [rax], 0
je 0x1800331d5
sub rsi, rax
dec rsi
add rbx, rsi
lea rsi, [rax + 1]
jmp 0x1800331a7
lea rax, [rbp - 0x78]
mov rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x60]
cmp r8, 0x10
cmovae rax, rdx
sub rcx, rax
mov rbx, qword [rbp - 0x68]
jmp 0x180033202
mov rbx, qword [rbp - 0x68]
or rcx, 0xffffffffffffffff
mov r8, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x78]
cmp rbx, rcx
jae 0x180033214
lea rcx, str.invalid_string_position
call fcn.1800acb04
int3
mov qword [rbp - 0x68], rcx
lea rax, [rbp - 0x78]
cmp r8, 0x10
cmovae rax, rdx
mov byte [rax + rcx], 0
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r13
cmp qword [rdi + 0x18], 0x10
jb 0x180033240
mov rax, qword [rdi]
jmp 0x180033243
mov rax, rdi
mov byte [rax], 0
lea rdx, [rbp - 0x78]
mov rcx, rdi
call fcn.18000a5f0
nop
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x1800332a9
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, 0x1000
jb 0x1800332a4
test cl, 0x1f
je 0x180033277
call fcn.1800c0d4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180033286
call fcn.1800c0d4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180033295
call fcn.1800c0d4c
int3
cmp rcx, 0x27
jbe 0x1800332a1
call fcn.1800c0d4c
int3
mov rcx, rax
call fcn.1800af3bc
mov qword [rbp - 0x60], 0xf
mov qword [rbp - 0x68], r13
mov byte [rbp - 0x78], 0
lea rcx, [rbp - 0x20]
call fcn.180024260
nop
lea rcx, [rbp - 0x50]
call fcn.180024260
nop
lea rcx, [rbp - 0x38]
call fcn.180024260
mov rax, rdi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1800ae8d0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret