Function at 0x1400faf40
Capabilities:
Get hostname
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140159040]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rcx
mov dword [rbp + 8], 0x100
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x88], eax
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rbx, 0xffffffffffffffff
mov r14d, 0xd50df05a
mov r15d, 0x50
mov r12d, 0x5a
mov r13d, 0xf
test eax, eax
je 0x1400fb1ab
movd xmm6, r14d
movd xmm0, r15d
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x20], al
movd xmm0, r12d
vpxor xmm1, xmm0, xmm6
movd edi, xmm1
mov byte [rbp - 0x1f], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rbp + 0x90]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400fb030
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x20]
call fcn.1400d1ed0
mov eax, 9
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd ecx, xmm1
mov byte [rbp - 0x18], cl
mov eax, 3
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x17], al
mov byte [rbp - 0x16], cl
mov eax, 0xe
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x15], al
mov eax, 0x1f
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd r8d, xmm1
mov byte [rbp - 0x14], r8b
mov eax, 0x17
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd ecx, xmm1
mov byte [rbp - 0x13], cl
mov eax, 0x7a
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd edx, xmm1
mov byte [rbp - 0x12], dl
mov eax, 0x14
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x11], al
mov eax, 0x1b
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x10], al
mov byte [rbp - 0xf], cl
mov byte [rbp - 0xe], r8b
mov eax, 0x60
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0xd], al
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xb], dil
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x80]
call fcn.1400dd590
lea rcx, [rbp - 0x20]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x1400fb130
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1400d4a50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], r13
mov byte [rax], 0
lea rdx, [rbp - 0x18]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, r13
cmova rdx, rcx
movq r8, xmm1
mov rcx, rsi
call fcn.1400d4a50
lea rcx, [rbp - 0x18]
call fcn.1400d1e20
lea rcx, [rbp - 0x80]
call fcn.1400d1e20
lea rcx, [rsp + 0x20]
call fcn.1400d1e20
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400fb32c
movd xmm6, r14d
movd xmm0, r15d
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x20], al
movd xmm0, r12d
vpxor xmm1, xmm0, xmm6
movd edi, xmm1
mov byte [rbp - 0x1f], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp + 0x90]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400fb205
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.1400d1ed0
movd xmm0, r13d
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x18], al
mov eax, 9
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x17], al
mov eax, 0x1f
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x16], al
mov eax, 8
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x15], al
mov eax, 0x60
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x14], al
mov eax, 0x7a
movd xmm0, eax
vpxor xmm1, xmm0, xmm6
movd eax, xmm1
mov byte [rbp - 0x13], al
mov byte [rbp - 0x12], dil
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x60]
call fcn.1400dd590
lea rcx, [rbp - 0x20]
mov r8, rbx
inc r8
cmp byte [rcx + r8], 0
jne 0x1400fb2b1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1400d4a50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], r13
mov byte [rax], 0
lea rdx, [rbp - 0x18]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, r13
cmova rdx, rcx
movq r8, xmm1
mov rcx, rsi
call fcn.1400d4a50
lea rcx, [rbp - 0x18]
call fcn.1400d1e20
lea rcx, [rbp - 0x60]
call fcn.1400d1e20
lea rcx, [rsp + 0x40]
call fcn.1400d1e20
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x1400fb44f
movd xmm2, r14d
movd xmm0, r15d
vpxor xmm1, xmm0, xmm2
movd eax, xmm1
mov byte [rbp - 0x20], al
movd xmm0, r12d
vpxor xmm1, xmm0, xmm2
movd eax, xmm1
mov byte [rbp - 0x1f], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x14]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400fb380
lea rdx, [rbp + 0x14]
lea rcx, [rsp + 0x60]
call fcn.1400d1ed0
movdqa xmm0, xmmword [0x140143580]
movdqu xmmword [rbp - 0x18], xmm0
mov dword [rbp - 8], 0x130f1d7a
mov dword [rbp - 4], 0x5a7a601e
lea rcx, [rbp - 0x18]
call fcn.1400fb490
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400dd590
lea rcx, [rbp - 0x20]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400fb3d1
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1400d4a50
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], r13
mov byte [rax], 0
lea rdx, [rbp - 0x18]
movq r8, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, r13
cmova rdx, r8
movq r8, xmm1
mov rcx, rsi
call fcn.1400d4a50
lea rcx, [rbp - 0x18]
call fcn.1400d1e20
lea rcx, [rbp - 0x40]
call fcn.1400d1e20
lea rcx, [rsp + 0x60]
call fcn.1400d1e20
nop
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400fc020
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret