Function at 0x1400ec500
Capabilities:
Get hostname
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140146040]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rcx
mov dword [rbp + 8], pe_nt_image_headers64
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x88], eax
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rbx, 0xffffffffffffffff
mov r14d, 0xd83a0b9e
mov r15d, 0xffffff94
mov r12d, 0xffffff9e
test eax, eax
je 0x1400ec760
movd xmm6, r14d
movd xmm0, r15d
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x20], al
movd xmm0, r12d
vpxor xmm1, xmm0, xmm6
movd edi, xmm1
mov byte [rbp - 0x1f], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rbp + 0x90]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400ec5e1
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x20]
call fcn.1400d19d0
mov eax, 0xffffffcd
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd ecx, xmm1
mov byte [rbp - 0x18], cl
mov eax, 0xffffffc7
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x17], al
mov byte [rbp - 0x16], cl
mov eax, 0xffffffca
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x15], al
mov eax, 0xffffffdb
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd r8d, xmm1
mov byte [rbp - 0x14], r8b
mov eax, 0xffffffd3
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd ecx, xmm1
mov byte [rbp - 0x13], cl
mov eax, 0xffffffbe
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd edx, xmm1
mov byte [rbp - 0x12], dl
mov eax, 0xffffffd0
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x11], al
mov eax, 0xffffffdf
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x10], al
mov byte [rbp - 0xf], cl
mov byte [rbp - 0xe], r8b
mov eax, 0xffffffa4
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0xd], al
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xb], dil
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x80]
call fcn.1400daee0
lea rcx, [rbp - 0x20]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x1400ec6e0
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1400d2b50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x18]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
mov rcx, rsi
call fcn.1400d2b50
lea rcx, [rbp - 0x18]
call fcn.1400d1970
lea rcx, [rbp - 0x80]
call fcn.1400d1970
lea rcx, [rsp + 0x20]
call fcn.1400d1970
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400ec8f0
movd xmm6, r14d
movd xmm0, r15d
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x20], al
movd xmm0, r12d
vpxor xmm1, xmm0, xmm6
movd edi, xmm1
mov byte [rbp - 0x1f], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp + 0x90]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400ec7c0
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.1400d19d0
mov eax, 0xffffffcb
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x18], al
mov eax, 0xffffffcd
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x17], al
mov eax, 0xffffffdb
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x16], al
mov eax, 0xffffffcc
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x15], al
mov eax, 0xffffffa4
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x14], al
mov eax, 0xffffffbe
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x13], al
mov byte [rbp - 0x12], dil
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x60]
call fcn.1400daee0
lea rcx, [rbp - 0x20]
mov r8, rbx
inc r8
cmp byte [rcx + r8], 0
jne 0x1400ec870
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1400d2b50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x18]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
mov rcx, rsi
call fcn.1400d2b50
lea rcx, [rbp - 0x18]
call fcn.1400d1970
lea rcx, [rbp - 0x60]
call fcn.1400d1970
lea rcx, [rsp + 0x40]
call fcn.1400d1970
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x1400eca14
movd xmm2, r14d
movd xmm0, r15d
vpxor xmm1, xmm0, xmm2
movd eax, xmm1
mov byte [rbp - 0x20], al
movd xmm0, r12d
vpxor xmm1, xmm0, xmm2
movd eax, xmm1
mov byte [rbp - 0x1f], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x14]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400ec940
lea rdx, [rbp + 0x14]
lea rcx, [rsp + 0x60]
call fcn.1400d19d0
movdqa xmm0, xmmword [0x140132ba0]
movdqu xmmword [rbp - 0x18], xmm0
mov dword [rbp - 8], 0xd7cbd9be
mov dword [rbp - 4], 0x9ebea4da
lea rcx, [rbp - 0x18]
call fcn.1400eca50
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400daee0
lea rcx, [rbp - 0x20]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400ec991
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1400d2b50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x18]
movq r8, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, r8
movq r8, xmm1
mov rcx, rsi
call fcn.1400d2b50
lea rcx, [rbp - 0x18]
call fcn.1400d1970
lea rcx, [rbp - 0x40]
call fcn.1400d1970
lea rcx, [rsp + 0x60]
call fcn.1400d1970
nop
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400ed420
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret