Function at 0x180001ef4
Capabilities:
Get hostname
Get session user name

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov ecx, dword [0x18000f73c]
xor eax, eax
xor ebx, ebx
mov byte [rsp + 0x30], bl
mov qword [r11 - 0x27], rax
mov qword [r11 - 0x1f], rax
mov qword [r11 - 0x17], rax
lea rdx, [r11 - 0x28]
mov word [rsp + 0x49], ax
mov byte [rsp + 0x4b], al
call fcn.1800022f8
test eax, eax
je 0x180001f51
mov al, byte [rsp + 0x31]
cmp al, 2
jbe 0x180001f51
movzx eax, al
sub eax, 2
test eax, eax
jle 0x180001f51
lea rcx, [rsp + 0x3c]
mov edx, eax
add ebx, dword [rcx]
add rcx, 4
sub rdx, 1
jne 0x180001f45
mov dword [0x18000f770], ebx
test ebx, ebx
jne 0x180001f63
lea eax, [rbx + 5]
jmp 0x180002151
mov rcx, qword [0x18000f730]
xor ebx, 0xcf8558fc
xor edx, edx
mov r8d, 0xa0
mov dword [0x18000f770], ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, 8
mov qword [0x18000f888], rax
test rax, rax
je 0x180001fcb
xor edx, edx
mov r8d, 0xa0
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x18000f888]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x18000f888]
lea rdx, [0x1800114f5]
mov qword [rax], rdx
xor eax, eax
jmp 0x180001fcd
mov eax, ebx
test eax, eax
jne 0x180002151
mov rcx, qword [0x18000f730]
lea r8d, [rax + 0x43]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x18000f790], rax
test rax, rax
je 0x180002024
movzx r9d, byte [0x18000f749]
movzx r8d, byte [0x18000f748]
lea rcx, [0x18001144c]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1800111e7]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
jmp 0x180002026
mov eax, ebx
test eax, eax
jne 0x180002151
and dword [rsp + 0x60], eax
mov eax, dword [0x18000f770]
lea rdx, [rsp + 0x68]
lea rcx, [0x18000f238]
mov dword [rsp + 0x68], eax
call fcn.180002158
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x1800020b7
mov rcx, qword [0x18000f730]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1800020b7
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1800020a5
mov edx, dword [rsp + 0x60]
mov rcx, rbx
add edx, edx
call fcn.180005874
xor dword [0x18000f238], eax
mov rcx, qword [0x18000f730]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and dword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x180002126
mov rcx, qword [0x18000f730]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180002126
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x180002114
mov edx, dword [rsp + 0x60]
mov rcx, rbx
add edx, edx
call fcn.180005874
xor dword [0x18000f244], eax
mov rcx, qword [0x18000f730]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
cpuid
mov r8d, eax
mov eax, dword [0x18000f23c]
mov dword [rsp + 0x34], ebx
xor eax, edx
xor eax, ecx
xor eax, r8d
mov dword [0x18000f23c], eax
call fcn.1800012b8
call fcn.180001d40
add rsp, 0x50
pop rbx
ret