Function at 0x1400e2c08
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov r12, rcx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x270], rax
call fcn.1400659c6
movzx ebp, byte [r12 + 0x17]
test bpl, bpl
mov rcx, qword [r12 + 8]
mov rax, rbp
cmovs rax, rcx
test rax, rax
je 0x1400e30ca
cmp rax, 1
je 0x1400e2cc6
test bpl, bpl
mov rdx, qword [r12]
mov rbx, r12
cmovs rbx, rdx
movzx edi, word [rbx]
cmp di, 0x27
je 0x1400e2c80
cmp di, 0x22
jne 0x1400e2cc6
cmp word [rbx + rax*2 - 2], 0x22
je 0x1400e2c88
jmp 0x1400e2cc6
cmp word [rbx + rax*2 - 2], 0x27
jne 0x1400e2cc6
test bpl, bpl
js 0x1400e2ca0
lea rax, [rbp - 1]
mov byte [r12 + 0x17], al
lea rax, [r12 + rbp*2]
add rax, 0xfffffffffffffffe
jmp 0x1400e2cb1
lea rax, [rcx - 1]
mov qword [r12 + 8], rax
lea rax, [rdx + rcx*2]
add rax, 0xfffffffffffffffe
mov word [rax], 0
mov r8d, 1
mov rcx, r12
xor edx, edx
call fcn.140066414
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rsp + 0x38], rax
je 0x1400e2cf4
lea rdx, [0x1401daa22]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
jmp 0x1400e2cf4
xor r15d, r15d
mov r13, r15
shl r13, 4
lea rax, str._windows
mov rbp, qword [r13 + rax]
mov rcx, rbp
call fcn.1401a82e8
movzx ebx, byte [r12 + 0x17]
mov rcx, r12
test bl, bl
jns 0x1400e2d23
mov rcx, qword [r12]
test rax, rax
je 0x1400e2da1
test bl, bl
jns 0x1400e2d31
mov rbx, qword [r12 + 8]
cmp rbx, rax
jl 0x1400e2ec0
lea r8, [rcx + rbx*2]
movzx esi, word [rbp]
mov rdi, rcx
mov rdx, rbx
sub rdx, rax
inc rdx
je 0x1400e2ec0
inc rbx
cmp word [rdi], si
je 0x1400e2d6d
add rdi, 2
dec rbx
cmp rax, rbx
jne 0x1400e2d57
jmp 0x1400e2ec0
mov edx, 1
cmp rax, rdx
je 0x1400e2e5f
movzx ebx, word [rdi + rdx*2]
cmp bx, word [rbp + rdx*2]
lea rdx, [rdx + 1]
je 0x1400e2d72
add rdi, 2
mov rbx, r8
sub rbx, rdi
sar rbx, 1
cmp rbx, rax
jge 0x1400e2d45
jmp 0x1400e2ec0
xor edi, edi
mov rcx, rbp
call fcn.1401a82e8
mov r14, rax
lea rax, str._windows
mov r8d, dword [r13 + rax + 8]
xor ecx, ecx
lea rsi, [rsp + 0x60]
mov rdx, rsi
xor r9d, r9d
call qword [rsp + 0x28]
test eax, eax
jne 0x1400e2dd6
mov word [rsp + 0x60], 0
lea r13, [rsp + 0x48]
mov rcx, r13
mov rdx, rsi
call fcn.1400036d8
movzx esi, byte [rsp + 0x5f]
test sil, sil
mov rcx, qword [rsp + 0x50]
mov rax, rsi
cmovs rax, rcx
test rax, rax
je 0x1400e2e85
test sil, sil
mov rdx, qword [rsp + 0x48]
mov rbp, r13
cmovs rbp, rdx
cmp word [rbp + rax*2 - 2], 0x5c
jne 0x1400e2e85
movzx ebx, byte [r12 + 0x17]
mov rax, rbx
test bl, bl
jns 0x1400e2e2c
mov rax, qword [r12 + 8]
mov rbp, r14
add rbp, rdi
cmp rax, rbp
jbe 0x1400e2e85
mov rax, r12
test bl, bl
jns 0x1400e2e42
mov rax, qword [r12]
cmp word [rax + rbp*2], 0x5c
jne 0x1400e2e85
test sil, sil
js 0x1400e2e75
lea rax, [rsi - 1]
mov byte [rsp + 0x5f], al
mov word [rsp + rsi*2 + 0x46], 0
jmp 0x1400e2e85
cmp r8, rdi
je 0x1400e2ec0
sub rdi, rcx
cmp rdi, 0xfffffffffffffffe
je 0x1400e2ec0
sar rdi, 1
jmp 0x1400e2da3
lea rax, [rcx - 1]
mov qword [rsp + 0x50], rax
mov word [rdx + rcx*2 - 2], 0
movzx eax, byte [rsp + 0x5f]
test al, al
cmovs rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
cmovns r9, r13
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rdi
mov r8, r14
call fcn.140066498
xor eax, eax
cmp byte [rsp + 0x5f], al
jns 0x1400e2ec0
mov rcx, qword [rsp + 0x48]
call fcn.140183668
inc r15
cmp r15, 7
jne 0x1400e2cf7
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x1400e2ef9
lea rdx, [0x1401daad2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x1400e2ef9
mov dl, byte [r12 + 0x17]
test dl, dl
mov r9, qword [r12]
mov r10, qword [r12 + 8]
mov rbx, r12
cmovs rbx, r9
movzx eax, dl
mov rcx, rax
cmovs rcx, r10
cmp rcx, 0xc
jge 0x1400e2f67
test dl, dl
cmovns r9, r12
cmovs rax, r10
cmp rax, 0xf
jge 0x1400e2fc4
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x1400e3029
lea rdx, [0x1401dab42]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
jmp 0x1400e3029
lea r8, [rbx + rcx*2]
lea rsi, str._user_name
mov rdi, rbx
add rcx, 0xfffffffffffffff5
je 0x1400e2f20
cmp word [rdi], 0x24
je 0x1400e2f8c
add rdi, 2
dec rcx
jne 0x1400e2f7b
jmp 0x1400e2f20
mov ecx, 1
cmp rcx, 0xc
je 0x1400e31bd
movzx ebp, word [rdi + rcx*2]
cmp bp, word [rsi + rcx*2]
lea rcx, [rcx + 1]
je 0x1400e2f91
add rdi, 2
mov rbp, r8
sub rbp, rdi
mov rcx, rbp
sar rcx, 1
cmp rbp, 0x18
jge 0x1400e2f75
jmp 0x1400e2f20
lea rdx, [r9 + rax*2]
lea rbp, str._machine_name
mov rdi, r9
add rax, 0xfffffffffffffff2
je 0x1400e2f34
cmp word [rdi], 0x24
je 0x1400e2ff0
add rdi, 2
dec rax
jne 0x1400e2fdc
jmp 0x1400e2f34
mov eax, 1
cmp rax, 0xf
je 0x1400e3274
movzx ecx, word [rdi + rax*2]
cmp cx, word [rbp + rax*2]
lea rax, [rax + 1]
je 0x1400e2ff5
add rdi, 2
mov rcx, rdx
sub rcx, rdi
mov rax, rcx
sar rax, 1
cmp rcx, 0x1e
jge 0x1400e2fd2
jmp 0x1400e2f34
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
je 0x1400e3050
lea rdx, [0x1401dab7a]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400e3050
mov r15b, byte [r12 + 0x17]
test r15b, r15b
mov r10, qword [r12]
mov r9, qword [r12 + 8]
mov rbx, r12
cmovs rbx, r10
movzx edi, r15b
mov rcx, rdi
cmovs rcx, r9
cmp rcx, 0xe
jge 0x1400e30f1
test r15b, r15b
cmovns r10, r12
cmovs rdi, r9
cmp rdi, 0xf
jge 0x1400e3157
test r13, r13
je 0x1400e309c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x1400e30aa
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400e30ba
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400e30ca
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140183a80
mov rax, r12
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [rbx + rcx*2]
lea rsi, str._client_name
mov rbp, rbx
add rcx, 0xfffffffffffffff3
je 0x1400e3079
cmp word [rbp], 0x24
je 0x1400e311e
add rbp, 2
dec rcx
jne 0x1400e3109
jmp 0x1400e3079
mov ecx, 1
cmp rcx, 0xe
je 0x1400e332b
movzx edx, word [rbp + rcx*2]
cmp dx, word [rsi + rcx*2]
lea rcx, [rcx + 1]
je 0x1400e3123
add rbp, 2
mov r11, r8
sub r11, rbp
mov rcx, r11
sar rcx, 1
cmp r11, 0x1c
jge 0x1400e30ff
jmp 0x1400e3079
lea rdx, [r10 + rdi*2]
lea rbx, str._session_name
mov rbp, r10
add rdi, 0xfffffffffffffff2
je 0x1400e308e
cmp word [rbp], 0x24
je 0x1400e3184
add rbp, 2
dec rdi
jne 0x1400e316f
jmp 0x1400e308e
mov ecx, 1
cmp rcx, 0xf
je 0x1400e33e8
movzx edi, word [rbp + rcx*2]
cmp di, word [rbx + rcx*2]
lea rcx, [rcx + 1]
je 0x1400e3189
add rbp, 2
mov rcx, rdx
sub rcx, rbp
mov rdi, rcx
sar rdi, 1
cmp rcx, 0x1e
jge 0x1400e3165
jmp 0x1400e308e
cmp r8, rdi
je 0x1400e2f20
sub rdi, rbx
cmp rdi, 0xfffffffffffffffe
je 0x1400e2f20
lea rbp, [rsp + 0x48]
mov dword [rbp], 0
xor ecx, ecx
mov rdx, rbp
call r14
mov ecx, dword [rbp]
test rcx, rcx
je 0x1400e325e
sar rdi, 1
add rcx, rcx
call fcn.14018369c
mov rbp, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call r14
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov rdx, rbp
call fcn.1400036d8
movzx eax, byte [rsp + 0x77]
test al, al
jns 0x1400e322b
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, ntohs
mov rcx, r12
mov rdx, rdi
mov r9, rsi
call fcn.140066498
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400e3256
mov rcx, qword [rsp + 0x60]
call fcn.140183668
mov rcx, rbp
call fcn.1401836a4
mov dl, byte [r12 + 0x17]
mov r9, qword [r12]
mov r10, qword [r12 + 8]
movzx eax, dl
jmp 0x1400e2f20
cmp rdx, rdi
je 0x1400e2f34
sub rdi, r9
cmp rdi, 0xfffffffffffffffe
je 0x1400e2f34
lea rbx, [rsp + 0x48]
mov dword [rbx], 0
mov ecx, 5
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ecx, dword [rbx]
test rcx, rcx
je 0x1400e2f34
sar rdi, 1
add rcx, rcx
call fcn.14018369c
mov rbx, rax
lea r8, [rsp + 0x48]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rbp, [rsp + 0x60]
mov rcx, rbp
mov rdx, rbx
call fcn.1400036d8
movzx eax, byte [rbp + 0x17]
test al, al
jns 0x1400e32f3
mov rax, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, r12
mov rdx, rdi
mov r9, rbp
call fcn.140066498
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400e331e
mov rcx, qword [rsp + 0x60]
call fcn.140183668
mov rcx, rbx
call fcn.1401836a4
jmp 0x1400e2f34
cmp r8, rbp
je 0x1400e3079
sub rbp, rbx
cmp rbp, 0xfffffffffffffffe
je 0x1400e3079
mov rbx, rax
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 0xa
call qword [rsp + 0x30]
test eax, eax
je 0x1400e33ce
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.1400036d8
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400e339c
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, ntohs
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.140066498
mov rcx, qword [rsp + 0x48]
call rbx
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400e33ce
mov rcx, qword [rsp + 0x60]
call fcn.140183668
mov r15b, byte [r12 + 0x17]
mov r10, qword [r12]
mov r9, qword [r12 + 8]
movzx edi, r15b
mov rax, rbx
jmp 0x1400e3079
cmp rdx, rbp
je 0x1400e308e
sub rbp, r10
cmp rbp, 0xfffffffffffffffe
je 0x1400e308e
mov rdi, rax
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rax, [rsp + 0x44]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, 0xffffffff
mov r8d, 6
call qword [rsp + 0x30]
test eax, eax
je 0x1400e308e
sar rbp, 1
mov rdx, qword [rsp + 0x48]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.1400036d8
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400e345d
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, r12
mov rdx, rbp
mov r9, rsi
call fcn.140066498
mov rcx, qword [rsp + 0x48]
call rdi
xor eax, eax
cmp byte [rsp + 0x77], al
jns 0x1400e308e
mov rcx, qword [rsp + 0x60]
call fcn.140183668
jmp 0x1400e308e