Function at 0x140016900
Capabilities:
Get hostname
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2d8]
sub rsp, 0x3b0
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
mov eax, dword [0x14018a918]
lea rdx, [rsp + 0x40]
movsd xmm0, qword [str.No_CAB]
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x70], eax
mov ebx, 0x101
movzx eax, word [0x14018a91c]
mov word [rsp + 0x74], ax
movsd qword [rsp + 0x68], xmm0
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
or r12, 0xffffffffffffffff
xor r15d, r15d
test eax, eax
jne 0x140016993
mov r9, r12
lea r8, str.unknown_user
mov edx, ebx
lea rcx, [rbp - 0x80]
call fcn.14014f790
mov ebx, InitCommonControls
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x1400169d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, r12
lea r8, [0x14018ab58]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x40], eax
mov edx, ebx
call fcn.14014f790
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, str.crash.log
mov esi, 0x104
mov edx, esi
mov qword [rsp + 0x20], rax
lea r9, [0x1402311c0]
lea r8, [0x140189ea8]
lea rcx, [rbp + 0x90]
call fcn.140003dbc
mov rax, qword [0x1402451c0]
cmp dword [rax], r15d
je 0x140016a1b
mov edx, reloc.Cabinet.dll_FDIIsCabinet
jmp 0x140016a3c
mov rcx, qword [0x1402313c8]
test rcx, rcx
je 0x140016a36
mov rax, r12
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140016a2a
jmp 0x140016a39
mov rax, r15
lea edx, [rax + rax]
lea rcx, [rsp + 0x58]
mov rax, r12
inc rax
cmp byte [rcx + rax], r15b
jne 0x140016a44
lea r8, [rbp - 0x80]
mov rcx, r12
inc rcx
cmp byte [r8 + rcx], r15b
jne 0x140016a54
add eax, ecx
lea edi, [rdx + 0x1a]
add edi, eax
movsxd rcx, edi
call fcn.14015319c
mov rbx, rax
test rax, rax
je 0x140016ccb
mov r8d, edi
lea rcx, [rsp + 0x48]
mov rdx, rax
call fcn.1400264fc
mov rcx, r12
inc rcx
cmp byte [rbx + rcx], r15b
jne 0x140016a8b
mov eax, edi
lea r9, str._t_s_t_s_t
sub eax, ecx
mov r8, r12
movsxd rdx, eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
movsxd rcx, ecx
add rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14000b754
mov rax, r12
inc rax
cmp byte [rbx + rax], r15b
jne 0x140016ac6
mov r8, qword [0x1402451c0]
sub edi, eax
movsxd rcx, eax
add rcx, rbx
movsxd rdx, edi
mov r9d, dword [r8]
test r9d, r9d
je 0x140016b07
mov eax, dword [r8 + 4]
mov r8, r12
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r9d
lea r9, str._d_t_d_r_n
call fcn.14000b754
jmp 0x140016b22
mov rax, qword [0x1402313c8]
lea r9, str._S_r_n
mov r8, r12
mov qword [rsp + 0x20], rax
call fcn.14000b754
lea rdx, [rbp + 0x90]
mov rcx, rbx
call fcn.140025aa4
mov rcx, rbx
call fcn.140152ed8
mov rcx, qword [0x1402313e0]
test rcx, rcx
je 0x140016b58
call fcn.140025e70
cmp word [rax], 0x5c
lea r14, [rax + 2]
cmovne r14, rax
jmp 0x140016b5d
lea r14, [rsp + 0x68]
mov rcx, qword [str.ETW0]
test rcx, rcx
je 0x140016b78
mov rax, r12
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140016b6c
jmp 0x140016b7b
mov rax, r15
lea r13, str.hits.log
mov rcx, r12
inc rcx
cmp word [r13 + rcx*2], r15w
jne 0x140016b85
lea r8d, [rcx + 2]
add r8d, eax
cmp r8d, esi
jle 0x140016bdc
cmp dword [0x1401e3f88], r15d
je 0x140016ccb
cmp dword [0x1401e3f90], r15d
je 0x140016ccb
cmp word [0x1402321a0], r15w
je 0x140016ccb
lea rdx, [0x1402321a0]
lea rcx, str.Tracking_filename_length_greater_than_MAX_PATH__wont_write_to_it._r_n
call fcn.140025aa4
jmp 0x140016ccb
lea rax, [rsp + 0x58]
mov rcx, r12
inc rcx
cmp byte [rcx + rax], r15b
jne 0x140016be4
lea rax, [rbp - 0x80]
mov rdx, r12
inc rdx
cmp byte [rax + rdx], r15b
jne 0x140016bf4
test r14, r14
je 0x140016c11
mov rax, r12
inc rax
cmp word [r14 + rax*2], r15w
jne 0x140016c05
jmp 0x140016c14
mov rax, r15
add ecx, 0x1a
movsxd rdi, r8d
lea ebx, [rdx + rax*2]
add ebx, ecx
lea rcx, [rdi + rdi]
call fcn.14015319c
mov rsi, rax
test rax, rax
je 0x140016ccb
mov r9, qword [str.ETW0]
lea r8, [0x140189ea8]
mov rdx, rdi
mov qword [rsp + 0x20], r13
mov rcx, rax
call fcn.140003dbc
movsxd rcx, ebx
call fcn.14015319c
mov rdi, rax
test rax, rax
je 0x140016cc3
mov r8d, ebx
lea rcx, [rsp + 0x48]
mov rdx, rax
call fcn.1400264fc
mov rcx, r12
inc rcx
cmp byte [rdi + rcx], r15b
jne 0x140016c75
sub ebx, ecx
mov qword [rsp + 0x30], r14
lea rax, [rbp - 0x80]
movsxd rcx, ecx
mov qword [rsp + 0x28], rax
lea r9, str._t_s_t_s_t_S_r_n
lea rax, [rsp + 0x58]
movsxd rdx, ebx
add rcx, rdi
mov qword [rsp + 0x20], rax
mov r8, r12
call fcn.14000b754
mov rdx, rsi
mov rcx, rdi
call fcn.140025aa4
mov rcx, rdi
call fcn.140152ed8
mov rcx, rsi
call fcn.140152ed8
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.14012e400
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret