Function at 0x14000e9d0
Capabilities:
Check for sandbox username or hostname
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x7a0]
sub rsp, 0x8a0
mov rax, qword [0x1400da880]
xor rax, rsp
mov qword [rbp + 0x790], rax
lea rdx, str._DEBUG__Verifying_machine_hostname..._n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov dword [rsp + 0x20], 0x400
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [0x1400dc4b0]
test eax, eax
je 0x14000ec91
lea rdx, str._DEBUG__Current_hostname:
call fcn.14000aa90
mov rcx, rax
lea rdx, [rbp - 0x70]
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000ea90
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x28]
call fcn.14000b460
nop
lea r11, str.SANDBOX
mov qword [rsp + 0x50], r11
lea rax, str.VIRUS
mov qword [rsp + 0x58], rax
lea rax, str.MALWARE
mov qword [rsp + 0x60], rax
lea rax, str.ANALYSIS
mov qword [rsp + 0x68], rax
lea rax, str.SAMPLE
mov qword [rsp + 0x70], rax
lea rax, [0x1400cb3e0]
mov qword [rsp + 0x78], rax
lea rax, str.SECURITY
mov qword [rbp - 0x80], rax
lea rax, str.VIRTUAL
mov qword [rbp - 0x78], rax
lea rsi, [rsp + 0x50]
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
mov r14, qword [rsp + 0x28]
nop dword [rax]
mov r10, 0xffffffffffffffff
nop word [rax + rax]
inc r10
cmp word [r11 + r10*2], 0
jne 0x14000eb30
lea rbx, [rsp + 0x28]
cmp r15, 7
cmova rbx, r14
cmp r10, r12
ja 0x14000ebd0
mov rax, r12
sub rax, r10
test r10, r10
je 0x14000ebeb
inc rax
lea rdi, [rbx + rax*2]
mov rax, rbx
nop word [rax + rax]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
je 0x14000ebd0
movzx edx, word [r11]
nop
cmp word [rax], dx
je 0x14000eb91
add rax, 2
sub rcx, 1
jne 0x14000eb80
jmp 0x14000ebd0
test rax, rax
je 0x14000ebd0
mov r8, r10
mov rdx, r11
test r10, r10
je 0x14000ebc4
mov r9, rax
sub r9, r11
nop word [rax + rax]
movzx ecx, word [rdx]
cmp word [r9 + rdx], cx
jne 0x14000ebe5
add rdx, 2
sub r8, 1
jne 0x14000ebb0
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x14000ebeb
add rsi, 8
lea rax, [rbp - 0x70]
cmp rsi, rax
je 0x14000ec58
mov r11, qword [rsi]
jmp 0x14000eb20
add rax, 2
jmp 0x14000eb70
lea rdx, str._DEBUG__Suspicious_hostname_detected:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, qword [rsi]
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
nop
cmp r15, 7
jbe 0x14000ec54
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000ec4c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ece2
mov rcx, r14
call fcn.140077c10
mov al, 1
jmp 0x14000ecb2
cmp r15, 7
jbe 0x14000ec9d
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000ec87
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ece2
mov rcx, r14
call fcn.140077c10
jmp 0x14000ec9d
lea rdx, str._DEBUG__Failed_to_get_computer_name_n
call fcn.14000aa90
lea rdx, str._DEBUG__No_suspicious_hostname_detected_n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
xor al, al
mov rcx, qword [rbp + 0x790]
xor rcx, rsp
call fcn.140077bf0
lea r11, [rsp + 0x8a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400850bc
int3