Function at 0x140016c8f
Capabilities:
Check for sandbox username or hostname
Get hostname
Terminate process

Disassembly:
jmp 0x140037460
push rbp
push rsi
push rdi
sub rsp, 0x810
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x16c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140053048]
xor rax, rbp
mov qword [rbp + 0x7e8], rax
lea rcx, [0x14005c11c]
call fcn.140017324
mov dword [rbp + 0x34], 0x10
lea rdx, [rbp + 0x34]
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x438]
call fcn.140016866
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea rdx, str.LAPTOP_12345678
mov rcx, qword [rbp + 0x7e0]
call fcn.140016767
mov byte [rbp + 0x414], al
lea rcx, [rbp + 0x438]
call fcn.1400163c5
movzx eax, byte [rbp + 0x414]
test eax, eax
je 0x140037541
lea rdx, str.EW__A_sandboxer__Run_this_in_a_real_machine_you_LOSER_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001624e
mov qword [rbp + 0x7d8], rax
lea rdx, [0x1400160c8]
mov rcx, qword [rbp + 0x7d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
mov edx, 0x20
lea rcx, [rbp + 0x58]
call fcn.1400161bd
lea rcx, [rbp + 0x474]
call fcn.1400163e8
mov qword [rbp + 0x7d8], rax
lea rdx, str.api_ms_win_crt_utility_l1_1_0.dll
lea rcx, [rbp + 0x5c0]
call fcn.140016866
nop
lea rdx, str.api_ms_win_core_file_l1_2_0.dll
lea rcx, [rbp + 0x5e8]
call fcn.140016866
nop
lea rdx, str.api_ms_win_core_file_l2_1_0.dll
lea rcx, [rbp + 0x610]
call fcn.140016866
nop
lea rdx, str.api_ms_win_core_localization_l1_2_0.dll
lea rcx, [rbp + 0x638]
call fcn.140016866
nop
lea rdx, str.api_ms_win_core_processthreads_l1_1_1.dll
lea rcx, [rbp + 0x660]
call fcn.140016866
nop
lea rdx, str.api_ms_win_core_synch_l1_2_0.dll
lea rcx, [rbp + 0x688]
call fcn.140016866
nop
lea rdx, str.MSVCR110.dll
lea rcx, [rbp + 0x6b0]
call fcn.140016866
nop
lea rdx, str.MSVCR71.dll
lea rcx, [rbp + 0x6d8]
call fcn.140016866
nop
lea rdx, str.d3compiler_43.dll
lea rcx, [rbp + 0x700]
call fcn.140016866
nop
lea rdx, str.LogiLDA.dll
lea rcx, [rbp + 0x728]
call fcn.140016866
nop
lea rdx, str.MSVCP140.dll
lea rcx, [rbp + 0x750]
call fcn.140016866
nop
lea rdx, str.api_ms_win_crt_runtime_l1_1_0.dll
lea rcx, [rbp + 0x778]
call fcn.140016866
nop
lea rdx, str.VCRUNTIME140.dll
lea rcx, [rbp + 0x7a0]
call fcn.140016866
nop
lea rax, [rbp + 0x7c8]
mov r8, rax
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x498]
call fcn.14001724d
lea rcx, [rbp + 0x4c8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x590]
lea rcx, [rbp + 0x4c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0x7d8]
lea rdx, [rbp + 0x590]
lea rcx, [rbp + 0x58]
call fcn.140016da2
nop
lea r9, [fcn.1400163c5]
mov r8d, 0xd
mov edx, 0x28
lea rcx, [rbp + 0x5c0]
call fcn.1400164ec
mov edx, 0x20
lea rcx, [rbp + 0x98]
call fcn.140016839
lea rcx, [rbp + 0x98]
call fcn.14001655f
nop
call fcn.140016802
lea rax, [rbp + 0x58]
mov qword [rbp + 0xd8], rax
mov rcx, qword [rbp + 0xd8]
call fcn.140016546
mov qword [rbp + 0xf8], rax
mov rcx, qword [rbp + 0xd8]
call fcn.14001652d
mov qword [rbp + 0x118], rax
jmp 0x140037750
mov rax, qword [rbp + 0xf8]
add rax, 0x28
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0x118]
cmp qword [rbp + 0xf8], rax
je 0x1400377c2
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0x138], rax
mov r8, qword [rbp + 0x138]
lea rdx, [0x140016ded]
lea rcx, [rbp + 0x4f8]
call fcn.1400172bb
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x98]
call fcn.1400171a3
nop
lea rcx, [rbp + 0x4f8]
call fcn.14001685c
jmp 0x14003773e
lea rax, [rbp + 0x98]
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x158]
call fcn.140016c9e
mov qword [rbp + 0x178], rax
mov rcx, qword [rbp + 0x158]
call fcn.140016ec4
mov qword [rbp + 0x198], rax
jmp 0x14003780a
mov rax, qword [rbp + 0x178]
add rax, 0x10
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x198]
cmp qword [rbp + 0x178], rax
je 0x140037836
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x1b8], rax
mov rcx, qword [rbp + 0x1b8]
call fcn.140016014
jmp 0x1400377f8
mov dword [rbp + 0x544], 0xf
lea rdx, [rbp + 0x544]
lea rcx, [rbp + 0x528]
call fcn.140016483
mov rcx, rax
call fcn.1400163d9
call fcn.140016802
xor eax, eax
cmp eax, 1
je 0x14003786e
call fcn.140016d7f
jmp 0x140037860
mov dword [rbp + 0x564], 0
lea rcx, [rbp + 0x98]
call fcn.140016302
nop
lea rcx, [rbp + 0x58]
call fcn.140017243
mov eax, dword [rbp + 0x564]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140048110]
call fcn.140016f91
mov rax, rdi
mov rcx, qword [rbp + 0x7e8]
xor rcx, rbp
call fcn.1400168f7
lea rsp, [rbp + 0x7f0]
pop rdi
pop rsi
pop rbp
ret