Function at 0x140004ed0
Capabilities:
Get hostname
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1401a90c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rax
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x50], xmm1
mov r8d, 6
lea rdx, str.VMWARE
lea rcx, [rsp + 0x40]
call fcn.1400068a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x70], xmm1
mov r8d, 4
lea rdx, str.VBOX
lea rcx, [rsp + 0x60]
call fcn.1400068a0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x70], xmm1
mov r8d, 7
lea rdx, str.VIRTUAL
lea rcx, [rbp - 0x80]
call fcn.1400068a0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
mov r8d, 4
lea rdx, str.QEMU
lea rcx, [rbp - 0x60]
call fcn.1400068a0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
mov r8d, 3
lea rdx, [0x140179800]
lea rcx, [rbp - 0x40]
call fcn.1400068a0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm1
mov r8d, 9
lea rdx, str.PARALLELS
lea rcx, [rbp - 0x20]
call fcn.1400068a0
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x28]
call fcn.140006060
nop
lea r9, [fcn.1400061a0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, 6
lea rcx, [rsp + 0x40]
call fcn.14014887c
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rbp], 0x100
lea rdx, [rbp]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
lea rax, [rbp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140005082
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 8]
call fcn.1400068a0
mov rbx, qword [rbp + 0x28]
mov rsi, qword [rbp + 0x20]
mov rdi, qword [rbp + 8]
mov r14, qword [rbp + 0x30]
cmp rbx, r14
je 0x1400050ee
mov r15, qword [rbp + 0x18]
mov rax, qword [rbx + 0x10]
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400050c3
mov r9, qword [rbx]
lea rcx, [rbp + 8]
cmp rsi, 0xf
cmova rcx, rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r15
call fcn.1400067d0
cmp rax, 0xffffffffffffffff
jne 0x140005122
add rbx, 0x20
cmp rbx, r14
jne 0x1400050b2
xor bl, bl
cmp rsi, 0xf
jbe 0x14000512e
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140005126
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005126
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov bl, 1
jmp 0x1400050f0
mov rcx, rdi
call fcn.140148954
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], 0
lea rcx, [rbp + 0x28]
call fcn.140006360
movzx eax, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140148580
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret