Function at 0x14000b0a8
Capabilities:
Create process on windows
Get hostname

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14012bd38]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, r9
mov rdi, r8
mov ebx, edx
mov r14, rcx
mov qword [rbp - 9], r8
mov qword [rbp - 1], r9
cmp dword [rcx + 0xc47c], 0
je 0x14000b2ec
mov rax, qword [rcx + 0xc028]
cmp dword [rax - 0x10], 0
je 0x14000b2ec
mov dword [rbp - 0x19], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call fcn.140077d4c
mov rcx, rax
test rax, rax
je 0x14000b351
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x21], rax
call fcn.140077d4c
mov rcx, rax
test rax, rax
je 0x14000b35c
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x29], rax
call fcn.140077d4c
mov rcx, rax
test rax, rax
je 0x14000b346
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x11], rax
mov dword [rsp + 0x20], ebx
mov r9, qword [rdi]
lea r8, [rbp + 7]
lea rdx, str._CDI___s__s___d_
lea rcx, [rbp - 0x21]
call fcn.140002f84
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9, qword [rdi]
lea r8, [rbp + 7]
lea rdx, str._s__s_r_n__d___s
lea rcx, [rbp - 0x29]
call fcn.140002f84
mov r9, qword [rbp - 0x29]
mov r8, qword [rbp - 0x21]
lea rdx, str.Subject__s__Body__s_
lea rcx, [rbp - 0x11]
call fcn.140002f84
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
mov rbx, qword [rbp - 0x11]
mov r9, rbx
mov r8, qword [r14 + 0xc028]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
cmp rax, 0x20
mov eax, ebx
jle 0x14000b294
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b211
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b230
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b24f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b26d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b28a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x14000b32c
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b2a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b2c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b2e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
jmp 0x14000b2f2
mov rdx, qword [r8]
or ebx, 0xffffffff
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b30d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000b32a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400b0010
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001860
nop
mov ecx, 0x80004005
call fcn.140001860
nop
mov ecx, 0x80004005
call fcn.140001860
int3