Function at 0x14004ac50
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x14007b040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r13d, r13d
test cl, cl
jne 0x14000ca73
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r13 + 5]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_executed_files_with_UsageLogs...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r13 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x38]
call fcn.14004e4c0
nop dword [rax]
test al, al
je 0x14000cf3a
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov edi, 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x28], r13w
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
nop dword [rax]
test eax, eax
je 0x14000ced4
lea rax, [rbp - 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000cad3
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x28]
call fcn.140007ce0
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov rsi, qword [rsp + 0x38]
sub rax, rsi
cmp rax, 9
jb 0x14000cf9f
lea r12, [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
cmp rdi, 7
cmova r12, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea r15, [rsi + 9]
mov ebx, 7
lea r14, [rsp + 0x48]
movabs rax, 0x7fffffffffffffff
lea edx, [rbx + 3]
cmp r15, rbx
jbe 0x14000cb8c
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14000cc4d
mov rbx, rcx
mov rcx, rax
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbx
movups xmm0, xmmword [str.C:Users_]
movups xmmword [r14], xmm0
movzx ecx, word [0x140059870]
mov word [r14 + 0x10], cx
lea rcx, [r14 + 0x12]
lea r8, [rsi + rsi]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + r15*2], r13w
mov r8d, 0x2e
lea rdx, str.AppDataLocalMicrosoftCLR_v4.0_32UsageLogs
lea rcx, [rsp + 0x48]
call fcn.140007e40
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14000cc73
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cc6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14000cf93
jmp 0x14000cb6f
call fcn.140050f60
movdqa xmm0, xmmword [0x14006ad80]
movdqu xmmword ds:[rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, 9
jb 0x14000cf8d
lea r12, [rsp + 0x28]
cmp rdi, 7
cmova r12, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea r15, [rsi + 9]
mov ebx, 7
lea r14, [rsp + 0x68]
cmp r15, rbx
jbe 0x14000cd17
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14000cdd2
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rsp + 0x68], rax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], rbx
movups xmm0, xmmword [str.C:Users_]
movups xmmword [r14], xmm0
movzx ecx, word [0x140059870]
mov word [r14 + 0x10], cx
lea rcx, [r14 + 0x12]
lea r8, [rsi + rsi]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov word ds:[r14 + r15*2], r13w
mov r8d, 0x2b
lea rdx, str.AppDataLocalMicrosoftCLR_v4.0UsageLogs
lea rcx, [rsp + 0x68]
call fcn.140007e40
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x14000ce05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cdfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cdfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000cf99
jmp 0x14000ccfa
nop dword [rax + rax]
call fcn.140050f60
movdqa xmm0, xmmword [0x14006ad80]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r13w
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x58]
call fcn.14000c5e0
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x78]
call fcn.14000c5e0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000ce77
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ce72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ce72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050f60
movdqa xmm0, xmmword [0x14006ad80]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x14000cef8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cecd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cecd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050f60
jmp 0x14000cef8
lea rdx, str.Failed_to_retrieve_current_username.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ada0
lea rdx, [0x14000d280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp rdi, 7
jbe 0x14000cf5d
lea rdx, [rdi*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cf33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cf33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050f60
jmp 0x14000cf5d
lea rdx, str.Failed_to_retrieve_last_logon_time.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ada0
lea rdx, [0x14000d280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140050f40
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003f80
nop
call fcn.140003ed0
nop
call fcn.140003ed0
nop
nop
call fcn.140003f80
int3
movzx ecx, dl
jmp 0x14000c9e0