Function at 0x40235a
Capabilities:
Get session user name

Disassembly:
push rbp
push rdi
sub rsp, 0x78
lea rbp, [rsp + 0x80]
mov ecx, 0
call sub.msvcrt.dll__time64
mov ecx, eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
and eax, 7
test eax, eax
jne 0x4023b6
lea rax, [rbp - 0x60]
movabs rdi, 0x544f4e204f445c3a
mov qword [rax], rdi
movabs rdi, 0x2e214b43494c4320
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 0x6b6e6c
jmp 0x402653
mov eax, dword [rbp - 0x14]
and eax, 3
test eax, eax
jne 0x4025b3
mov dword [rbp - 0x34], 0x14
lea rdx, [rbp - 0x34]
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
call sub.msvcrt.dll_rand
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
and eax, 7
test eax, eax
jne 0x40244a
lea rax, [rbp - 0x60]
movabs rdi, 0x2073736f425c3a
mov qword [rax], rdi
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
mov dword [rax], 0x6b6e6c2e
mov byte [rax + 4], 0
jmp 0x4025ae
mov eax, dword [rbp - 0x14]
and eax, 3
test eax, eax
jne 0x4024be
lea rax, [rbp - 0x60]
mov word [rax], 0x5c3a
mov byte [rax + 2], 0
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
movabs rdi, 0x2065687420736920
mov qword [rax], rdi
movabs rdi, 0x6b6e6c2e74736562
mov qword [rax + 8], rdi
mov byte [rax + 0x10], 0
jmp 0x4025ae
mov eax, dword [rbp - 0x14]
and eax, 1
test eax, eax
jne 0x40253d
lea rax, [rbp - 0x60]
movabs rdi, 0x206f6c6c65485c3a
mov qword [rax], rdi
mov byte [rax + 8], 0
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
movabs rdi, 0x6d20646f6f672021
mov qword [rax], rdi
movabs rdi, 0x6c2e676e696e726f
mov qword [rax + 8], rdi
mov word [rax + 0x10], 0x6b6e
mov byte [rax + 0x12], 0
jmp 0x4025ae
lea rax, [rbp - 0x60]
mov word [rax], 0x5c3a
mov byte [rax + 2], 0
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
movabs rdi, 0x657361656c702021
mov qword [rax], rdi
movabs rdi, 0x656d20706c656820
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 0x6b6e6c2e
mov byte [rax + 0x14], 0
jmp 0x402653
jmp 0x402653
mov eax, dword [rbp - 0x14]
and eax, 1
test eax, eax
jne 0x4025f3
lea rax, [rbp - 0x60]
movabs rdi, 0x6c6c697720495c3a
mov qword [rax], rdi
movabs rdi, 0x6f79206c6c696b20
mov qword [rax + 8], rdi
movabs rcx, 0x2e21202120212075
mov qword [rax + 0x10], rcx
mov dword [rax + 0x18], 0x6b6e6c
jmp 0x402653
mov ecx, dword [rbp - 0x14]
mov edx, 0x55555556
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
mov edx, eax
add edx, edx
add edx, eax
mov eax, ecx
sub eax, edx
test eax, eax
jne 0x402630
lea rax, [rbp - 0x60]
movabs rdi, 0x2e353d322b325c3a
mov qword [rax], rdi
mov dword [rax + 8], 0x6b6e6c
jmp 0x402653
lea rax, [rbp - 0x60]
movabs rcx, 0x455320504f545c3a
mov qword [rax], rcx
movabs rdi, 0x6b6e6c2e54455243
mov qword [rax + 8], rdi
mov byte [rax + 0x10], 0
lea rax, [rbp - 0x60]
add rsp, 0x78
pop rdi
pop rbp
ret