Function at 0x1400fa9d0
Capabilities:
Get hostname
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140159040]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rcx
mov dword [rbp + 8], pe_nt_image_headers64
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x88], eax
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rbx, 0xffffffffffffffff
mov r14d, 0xd0017af8
lea r15d, [rbx - 0xd]
lea r12d, [rbx - 7]
test eax, eax
je 0x1400fac30
movd xmm6, r14d
movd xmm0, r15d
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x20], al
movd xmm0, r12d
vpxor xmm1, xmm0, xmm6
movd edi, xmm1
mov byte [rbp - 0x1f], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rbp + 0x90]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400faab0
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x20]
call fcn.1400d16c0
mov eax, 0xffffffab
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd ecx, xmm1
mov byte [rbp - 0x18], cl
mov eax, 0xffffffa1
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x17], al
mov byte [rbp - 0x16], cl
mov eax, 0xffffffac
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x15], al
mov eax, 0xffffffbd
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd r8d, xmm1
mov byte [rbp - 0x14], r8b
mov eax, 0xffffffb5
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd ecx, xmm1
mov byte [rbp - 0x13], cl
mov eax, 0xffffffd8
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd edx, xmm1
mov byte [rbp - 0x12], dl
mov eax, 0xffffffb6
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x11], al
mov eax, 0xffffffb9
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x10], al
mov byte [rbp - 0xf], cl
mov byte [rbp - 0xe], r8b
mov eax, 0xffffffc2
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0xd], al
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xb], dil
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x80]
call fcn.1400dcaf0
lea rcx, [rbp - 0x20]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x1400fabb0
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1400d3e90
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x18]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
mov rcx, rsi
call fcn.1400d3e90
lea rcx, [rbp - 0x18]
call fcn.1400d1610
lea rcx, [rbp - 0x80]
call fcn.1400d1610
lea rcx, [rsp + 0x20]
call fcn.1400d1610
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400fadc0
movd xmm6, r14d
movd xmm0, r15d
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x20], al
movd xmm0, r12d
vpxor xmm1, xmm0, xmm6
movd edi, xmm1
mov byte [rbp - 0x1f], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp + 0x90]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400fac90
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.1400d16c0
mov eax, 0xffffffad
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x18], al
mov eax, 0xffffffab
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x17], al
mov eax, 0xffffffbd
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x16], al
mov eax, 0xffffffaa
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x15], al
mov eax, 0xffffffc2
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x14], al
mov eax, 0xffffffd8
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x13], al
mov byte [rbp - 0x12], dil
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x60]
call fcn.1400dcaf0
lea rcx, [rbp - 0x20]
mov r8, rbx
inc r8
cmp byte [rcx + r8], 0
jne 0x1400fad40
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1400d3e90
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x18]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
mov rcx, rsi
call fcn.1400d3e90
lea rcx, [rbp - 0x18]
call fcn.1400d1610
lea rcx, [rbp - 0x60]
call fcn.1400d1610
lea rcx, [rsp + 0x40]
call fcn.1400d1610
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x1400faee4
movd xmm2, r14d
movd xmm0, r15d
vpxor xmm1, xmm0, xmm2
movd eax, xmm1
mov byte [rbp - 0x20], al
movd xmm0, r12d
vpxor xmm1, xmm0, xmm2
movd eax, xmm1
mov byte [rbp - 0x1f], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x14]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400fae10
lea rdx, [rbp + 0x14]
lea rcx, [rsp + 0x60]
call fcn.1400d16c0
movdqa xmm0, xmmword [0x140143a70]
movdqu xmmword [rbp - 0x18], xmm0
mov dword [rbp - 8], 0xb1adbfd8
mov dword [rbp - 4], 0xf8d8c2bc
lea rcx, [rbp - 0x18]
call fcn.1400faf20
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400dcaf0
lea rcx, [rbp - 0x20]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400fae61
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1400d3e90
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x18]
movq r8, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, r8
movq r8, xmm1
mov rcx, rsi
call fcn.1400d3e90
lea rcx, [rbp - 0x18]
call fcn.1400d1610
lea rcx, [rbp - 0x40]
call fcn.1400d1610
lea rcx, [rsp + 0x60]
call fcn.1400d1610
nop
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400fbcf0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret