Function at 0x180096790
Capabilities:
Get hostname
Get session user name

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xa10
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0xa00], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor esi, esi
mov dword [rsp + 0x4c], esi
lea ecx, [rsi + 8]
call fcn.18009a960
cmp rax, rsi
je 0x1800967e2
mov qword [rax], rbx
jmp 0x1800967e5
mov rax, rsi
mov qword [rbx], rax
mov rcx, rbx
call fcn.18005673c
mov qword [rbx + 0x30], rax
mov byte [rax + 0x69], 1
mov rax, qword [rbx + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rbx + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 0x30]
mov qword [rax + 0x10], rax
mov qword [rbx + 0x38], rsi
mov dword [rsp + 0x4c], 1
mov r13d, 7
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
lea rcx, [rsp + 0x90]
call fcn.180040860
nop
lea rcx, [rsp + 0x90]
call fcn.180078360
or r12, 0xffffffffffffffff
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x60]
call fcn.18000db80
cmp qword [rsp + 0x78], rsi
jne 0x1800968d2
mov word [rsp + 0x200], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x202]
call fcn.18009e990
mov dword [rsp + 0x48], 0x400
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x200]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x60]
call fcn.18000f510
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
mov r8d, 0xa
lea rdx, str.PCNAME
lea rcx, [rsp + 0x20]
call fcn.18000f510
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180054a88
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18000db80
nop
cmp qword [rsp + 0x40], 8
jb 0x18009692c
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
xor r8d, r8d
lea rdx, [0x1800cda60]
lea rcx, [rsp + 0x60]
call fcn.18000f510
cmp qword [rsp + 0x78], rsi
jne 0x1800969a8
mov word [rsp + 0x200], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x202]
call fcn.18009e990
mov dword [rsp + 0x48], 0x400
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x200]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x200]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x60]
call fcn.18000f510
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
mov r8d, sendto
lea rdx, str.ACCOUNTNAME
lea rcx, [rsp + 0x20]
call fcn.18000f510
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180054a88
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18000db80
nop
cmp qword [rsp + 0x40], 8
jb 0x180096a02
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x90]
call fcn.180040930
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18000db80
nop
cmp qword [rsp + 0x40], 8
jb 0x180096a3b
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
cmp qword [rsp + 0x78], rsi
jne 0x180096a59
mov r8d, 4
lea rdx, str._u7b5f
lea rcx, [rsp + 0x60]
call fcn.18000f510
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
mov r8d, 0xc
lea rdx, str.NICKNAME
lea rcx, [rsp + 0x20]
call fcn.18000f510
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180054a88
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18000db80
nop
cmp qword [rsp + 0x40], 8
jb 0x180096ab3
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.180001500
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18000db80
nop
cmp qword [rsp + 0x40], 8
jb 0x180096aec
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
cmp qword [rsp + 0x78], rsi
jne 0x180096b0a
mov r8d, 0xd
lea rdx, str.192.168.1.100
lea rcx, [rsp + 0x60]
call fcn.18000f510
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
mov r8d, 6
lea rdx, str.IP
lea rcx, [rsp + 0x20]
call fcn.18000f510
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180054a88
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18000db80
nop
cmp qword [rsp + 0x40], 8
jb 0x180096b64
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x20]
call fcn.180001500
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18000db80
nop
cmp qword [rsp + 0x40], 8
jb 0x180096b9d
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
cmp qword [rsp + 0x78], rsi
jne 0x180096bbb
mov r8d, sendto
lea rdx, str.00_00_00_00_00_00
lea rcx, [rsp + 0x60]
call fcn.18000f510
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
mov r8, r13
lea rdx, str.MAC
lea rcx, [rsp + 0x20]
call fcn.18000f510
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180054a88
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18000db80
nop
cmp qword [rsp + 0x40], 8
jb 0x180096c13
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
nop
lea rcx, [rsp + 0x90]
call fcn.180041120
nop
cmp qword [rsp + 0x80], 8
jb 0x180096c36
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
mov rax, rbx
mov rcx, qword [rsp + 0xa00]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0xa10]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret