Function at 0x1400655c8
Capabilities:
Get hostname
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x370
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov r14, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x90
movups xmmword [rbp - 0x20], xmm0
call fcn.14006c5b0
mov esi, 0x100
lea rcx, [rbp + 0x60]
mov r8d, esi
xor edx, edx
call fcn.14006c5b0
xorps xmm0, xmm0
lea rcx, [rbp + 0x160]
xorps xmm1, xmm1
xor eax, eax
mov r8d, esi
mov word [rbp + 0x58], ax
xor edx, edx
mov word [rbp + 0x20], ax
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp - 0x10], xmm1
movups xmmword [rbp], xmm1
movups xmmword [rbp + 0x10], xmm1
call fcn.14006c5b0
xor edi, edi
mov dword [rsp + 0x30], esi
lea rdx, [rsp + 0x30]
mov ebx, edi
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], esi
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.140063730
mov r8d, esi
lea rdx, [rbp + 0x160]
xor ecx, ecx
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400656d2
lea edx, [rdi + 0x5c]
lea rcx, [rbp + 0x160]
call fcn.14006c938
mov rbx, rax
test rax, rax
je 0x1400656cb
inc rbx
jmp 0x1400656d2
lea rbx, [0x1400a24f2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [rsp + 0x44]
mov dword [0x1400bf928], eax
call qword [sym.imp.KERNEL32.dll_GetACP]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp - 0x20]
mov r12d, eax
call sub.cryptdll.dll_CDGenerateRandomBits
lea rcx, [rbp - 0x20]
call fcn.140067fd4
mov edx, 4
lea rcx, [0x1400c0148]
call sub.cryptdll.dll_CDGenerateRandomBits
mov ecx, dword [0x1400c0148]
lea rax, [rbp - 0x10]
and ecx, 0x7ffffffe
mov qword [rsp + 0x28], rbx
mov dword [0x1400c0148], ecx
lea r9, [rbp + 0x28]
mov dword [0x1400bfd40], ecx
lea r8, str._s_t_s_t_s
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov rdx, rsi
call fcn.140064e0c
or rbx, 0xffffffffffffffff
lea rax, [rbp + 0x60]
mov rsi, rbx
inc rsi
cmp byte [rax + rsi], dil
jne 0x140065771
mov eax, 0x3a
cmp esi, eax
cmovg esi, eax
call fcn.140067ae4
neg eax
sbb dil, dil
and dil, 2
call fcn.140067ae4
test eax, eax
jne 0x1400657a7
mov rcx, rbx
call fcn.140067a8c
test eax, eax
je 0x1400657ab
or dil, 4
call fcn.140065904
lea ecx, [rsi + 0x33]
mov ebx, eax
mov dword [rsp + 0x30], ecx
mov ecx, 0xbeef
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [rsp + 0x30]
mov dword [r14], eax
call qword [sym.imp.WS2_32.dll_htonl]
movups xmm0, xmmword [rbp - 0x20]
mov dword [r14 + 4], eax
movdqu xmmword [r14 + 8], xmm0
mov word [r14 + 0x18], r15w
mov word [r14 + 0x1a], r12w
mov ecx, dword [0x1400c0148]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [r14 + 0x1c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [r14 + 0x20], eax
xor edx, edx
mov word [r14 + 0x24], dx
mov al, dil
or al, 8
movzx ecx, al
test ebx, ebx
movzx eax, dil
cmove ecx, eax
mov al, byte [rsp + 0x44]
mov byte [r14 + 0x26], cl
mov ecx, r13d
mov byte [r14 + 0x27], al
mov al, byte [rsp + 0x48]
mov byte [r14 + 0x28], al
movzx eax, word [rsp + 0x4c]
mov word [r14 + 0x29], ax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
sar rax, 0x20
mov dword [r14 + 0x2b], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [r14 + 0x2f], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [r14 + 0x33], eax
call qword [sym.imp.WS2_32.dll_htonl]
movsxd r8, esi
lea rcx, [r14 + 0x3b]
lea rdx, [rbp + 0x60]
mov dword [r14 + 0x37], eax
call fcn.14006bf10
mov ebx, dword [rsp + 0x30]
lea rcx, [0x1400bfd48]
add ebx, 8
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x30], ebx
call fcn.14006c5b0
mov rcx, qword [0x1400b3fb8]
lea rax, [0x1400bfd44]
mov dword [0x1400bfd44], 0x80
lea r9, [0x1400bfd48]
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, qword [rcx + 0x48]
call fcn.140067b58
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140068c30
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret