Function at 0x140043490
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140072040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r13d, r13d
test cl, cl
jne 0x14000c953
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r13 + 5]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_executed_files_with_UsageLogs...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r13 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x38]
call fcn.140046cc0
nop dword [rax]
test al, al
je 0x14000ce1a
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov edi, 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x28], r13w
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
nop dword [rax]
test eax, eax
je 0x14000cdb4
lea rax, [rbp - 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000c9b3
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x28]
call fcn.140007ce0
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov rsi, qword [rsp + 0x38]
sub rax, rsi
cmp rax, 9
jb 0x14000ce7f
lea r12, [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
cmp rdi, 7
cmova r12, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea r15, [rsi + 9]
mov ebx, 7
lea r14, [rsp + 0x48]
movabs rax, 0x7fffffffffffffff
lea edx, [rbx + 3]
cmp r15, rbx
jbe 0x14000ca6c
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14000cb2d
mov rbx, rcx
mov rcx, rax
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbx
movups xmm0, xmmword [str.C:Users_]
movups xmmword [r14], xmm0
movzx ecx, word [0x1400517d0]
mov word [r14 + 0x10], cx
lea rcx, [r14 + 0x12]
lea r8, [rsi + rsi]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + r15*2], r13w
mov r8d, 0x2e
lea rdx, str.AppDataLocalMicrosoftCLR_v4.0_32UsageLogs
lea rcx, [rsp + 0x48]
call fcn.140007e40
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14000cb53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cb4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14000ce73
jmp 0x14000ca4f
call fcn.140049760
movdqa xmm0, xmmword [0x1400621c0]
movdqu xmmword ds:[rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, 9
jb 0x14000ce6d
lea r12, [rsp + 0x28]
cmp rdi, 7
cmova r12, qword [rsp + 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea r15, [rsi + 9]
mov ebx, 7
lea r14, [rsp + 0x68]
cmp r15, rbx
jbe 0x14000cbf7
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14000ccb2
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rsp + 0x68], rax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], rbx
movups xmm0, xmmword [str.C:Users_]
movups xmmword [r14], xmm0
movzx ecx, word [0x1400517d0]
mov word [r14 + 0x10], cx
lea rcx, [r14 + 0x12]
lea r8, [rsi + rsi]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov word ds:[r14 + r15*2], r13w
mov r8d, 0x2b
lea rdx, str.AppDataLocalMicrosoftCLR_v4.0UsageLogs
lea rcx, [rsp + 0x68]
call fcn.140007e40
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x14000cce5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ccdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ccdb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000ce79
jmp 0x14000cbda
nop dword [rax + rax]
call fcn.140049760
movdqa xmm0, xmmword [0x1400621c0]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r13w
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x58]
call fcn.14000c4c0
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x78]
call fcn.14000c4c0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000cd57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cd52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cd52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140049760
movdqa xmm0, xmmword [0x1400621c0]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x14000cdd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cdad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cdad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140049760
jmp 0x14000cdd8
lea rdx, str.Failed_to_retrieve_current_username.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad40
lea rdx, [0x14000d160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp rdi, 7
jbe 0x14000ce3d
lea rdx, [rdi*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ce13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ce13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140049760
jmp 0x14000ce3d
lea rdx, str.Failed_to_retrieve_last_logon_time.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ad40
lea rdx, [0x14000d160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140049740
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003f80
nop
call fcn.140003ed0
nop
call fcn.140003ed0
nop
nop
call fcn.140003f80
int3
movzx ecx, dl
jmp 0x14000c8c0