Function at 0x180072600
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2e0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x18029b200]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r15, rdx
mov qword [rbp - 8], rcx
mov qword [rbp + 0x80], rdx
xor r13d, r13d
mov dword [rsp + 0x44], r13d
mov dword [rbp + 0x88], 0xff
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x180130740]
mov dword [rsp + 0x3c], eax
movzx ecx, word [0x180130744]
mov word [rsp + 0x40], cx
movzx eax, byte [0x180130746]
mov byte [rsp + 0x3c], Ordinal_41
xor byte [rsp + 0x3d], 0x3a
xor byte [rsp + 0x3e], 0x3b
xor byte [rsp + 0x3f], 0x3c
xor cl, 0x3d
mov byte [rsp + 0x40], cl
xor byte [rsp + 0x41], 0x3e
xor al, 0x3f
mov byte [rsp + 0x42], al
mov r14, qword [0x18029e000]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 3
jb 0x180072ee9
lea r12, [0x18029dff0]
cmp qword [0x18029e008], 0xf
cmova r12, qword [0x18029dff0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea rsi, [r14 + 3]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x48]
cmp rsi, rbx
jbe 0x18007278a
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x180072744
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18011e6b4
test rax, rax
je 0x180072776
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180072785
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x18007275e
mov rdi, r13
jmp 0x180072785
cmp rcx, 0x1000
jb 0x18007277d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180072eef
jmp 0x180072729
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6b4
mov rdi, rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x18013074c]
mov word [rdi + r14], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdi + r14 + 2], al
mov byte [rdi + rsi], 0
mov r14d, 1
lea rax, [rbp + 0xb0]
mov rsi, 0xffffffffffffffff
mov rdi, rsi
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800727d4
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18007282a
lea rax, [rdi + rcx]
mov qword [rsp + 0x58], rax
lea rbx, [rsp + 0x48]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x48]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x48]
jmp 0x180072849
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xb0]
movzx r8d, byte [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180035a00
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
or r14d, 2
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
call fcn.18006ba30
mov qword [rbp - 0x58], rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov r8d, gethostname
lea rdx, str.kwws2243_149814:_1666345324142lqlwbsdudpvBxvhuqdph_
lea rcx, [rbp]
call fcn.180035540
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov rdx, r13
mov qword [rsp + 0x78], rdx
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x80], r8
mov byte [rsp + 0x68], dl
or r14d, 4
mov dword [rsp + 0x44], r14d
lea rdi, [rbp]
mov r13, qword [rbp]
mov rbx, qword [rbp + 0x18]
mov qword [rbp - 0x10], rbx
cmp rbx, r8
cmova rdi, r13
lea r12, [rbp]
cmova r12, r13
add r12, qword [rbp + 0x10]
cmp rdi, r12
je 0x18007295a
movzx ebx, byte [rsp + 0x30]
nop word [rax + rax]
movzx r9d, byte [rdi]
sub r9b, 3
cmp rdx, r8
jae 0x180072930
lea rax, [rdx + 1]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
cmp r8, 0xf
cmova rax, qword [rsp + 0x68]
mov byte [rax + rdx], r9b
mov byte [rax + rdx + 1], 0
jmp 0x180072943
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.180044450
inc rdi
cmp rdi, r12
je 0x180072956
mov r8, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x78]
jmp 0x180072900
mov rbx, qword [rbp - 0x10]
mov eax, dword [str.ZOIP]
mov dword [rsp + 0x34], eax
movzx eax, word [0x18013073c]
mov word [rsp + 0x38], ax
movzx eax, byte [0x18013073e]
mov byte [rsp + 0x34], 0x63
xor byte [rsp + 0x35], 0x3a
xor byte [rsp + 0x36], 0x3b
xor byte [rsp + 0x37], 0x3c
xor byte [rsp + 0x38], 0x3d
xor byte [rsp + 0x39], 0x3e
xor al, 0x3f
mov byte [rsp + 0x3a], al
lea r8, [rsp + 0x34]
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.18006d8d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
xor edi, edi
mov qword [rax + 0x10], rdi
mov byte [rax], dil
or r14d, 8
mov dword [rsp + 0x44], r14d
mov r9, qword [rbp - 0x58]
lea r8, [rbp - 0x50]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.1800644e0
or r14d, 0x10
mov dword [rsp + 0x44], r14d
lea rax, [rsp + 0x3c]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180072a00
lea rdx, [rsp + 0x3c]
lea rcx, [rbp + 0x20]
call fcn.1800406c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
or r14d, 0x20
mov dword [rsp + 0x44], r14d
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x180072a5b
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
lea rcx, [rbp - 0x30]
call fcn.1800406c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
or r14d, 0x40
mov dword [rsp + 0x44], r14d
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180072ad3
lea rax, [rcx + 1]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x78]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x78]
mov word [rax + rcx], Ordinal_35
lea rax, [rbp - 0x78]
jmp 0x180072af7
mov qword [rsp + 0x20], 1
lea r9, [0x180130748]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
lea rcx, [rbp - 0x78]
call fcn.180035a00
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x90], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm6
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x180072b59
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072b54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072b54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6f0
movdqa xmm0, xmmword [0x18012c5a0]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x180072bb0
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072ba3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072ba3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6f0
movdqa xmm0, xmmword [0x18012c5a0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x180072bff
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072bf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072bf2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6f0
movdqa xmm0, xmmword [0x18012c5a0]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x180072c4e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072c41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072c41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6f0
movdqa xmm0, xmmword [0x18012c5a0]
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x180072c95
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072c88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072c88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6f0
movdqa xmm0, xmmword [0x18012c5a0]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
cmp rbx, 0xf
jbe 0x180072ce9
lea rdx, [rbx + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x180072cd9
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072cd9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.18011e6f0
movdqa xmm0, xmmword [0x18012c5a0]
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x180072d2f
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072d22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072d22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6f0
movdqa xmm0, xmmword [0x18012c5a0]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x180072d7e
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072d71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072d71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6f0
movdqa xmm0, xmmword [0x18012c5a0]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x180072dc6
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072db9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072db9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6f0
movdqa xmm0, xmmword [0x18012c5a0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
lea rdx, [rbp + 0x90]
movq rcx, xmm7
psrldq xmm6, 8
movq rax, xmm6
cmp rax, 0xf
cmova rdx, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
nop
inc rsi
cmp byte [rdx + rsi], 0
jne 0x180072e00
mov r8, rsi
lea rcx, [rbp - 0x50]
call fcn.180035540
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 8]
call fcn.180069b40
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x180072e68
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072e62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180072e62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18011e6f0
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x180072e9e
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x180072e99
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180072ee2
mov rcx, r8
call fcn.18011e6f0
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r15], 0
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.18011eca0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180040680
nop
call fcn.18001ba80
int3