Function at 0x140024c70
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x288]
sub rsp, 0x360
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor ebx, ebx
cmp byte [0x1400af1cc], bl
je 0x140025789
mov rax, qword [0x1400f5830]
mov rax, qword [rax + 0x4b20]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.14002cb00
mov rsi, rax
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov qword [rbp + 0x88], rdx
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rbp + 0x90]
lea r8, str._H:_M:_S
lea edx, [rbx + 9]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
mov dword [rbp], pe_nt_image_headers64
lea rdx, [rbp]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], rbx
lea r8d, [rbx + 7]
lea rdx, str.Proteus
lea rcx, [rbp + 0x68]
call fcn.140003660
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], rbx
lea r8d, [rbx + 9]
lea rdx, str.Developer
lea rcx, [rbp + 0x48]
call fcn.140003660
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp + 0x78]
sub rax, r14
cmp rax, 3
jb 0x1400257e1
lea r13, [rbp + 0x68]
mov r12, qword [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova r13, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r15, [r14 + 3]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp r15, rbx
jbe 0x140024e9c
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x140024e57
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14008fef0
test rax, rax
je 0x140024e7f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140024e97
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140024e86
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400257e7
jmp 0x140024e3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140024e95
call fcn.14008fef0
mov rdi, rax
jmp 0x140024e97
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rbx
mov r8, r14
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x140095f28]
mov word [rdi + r14], ax
movzx eax, byte [0x140095f2a]
mov byte [rdi + r14 + 2], al
mov byte [rdi + r15], 0
lea rax, [rbp + 0xd0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140024ee1
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.140011a10
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r8d, [r14 + 3]
lea rdx, [0x140095f28]
lea rcx, [rbp - 0x20]
call fcn.140011a10
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.140011a10
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r8d, [r14 + 3]
lea rdx, [0x140095f28]
lea rcx, [rbp - 0x60]
call fcn.140011a10
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea rax, [rbp + 0xb8]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140025000
lea rdx, [rbp + 0xb8]
lea rcx, [rbp - 0x80]
call fcn.140011a10
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140025085
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025080
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025080
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
movdqa xmm0, xmmword [0x1400a0760]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400250d4
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400250cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400250cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
movdqa xmm0, xmmword [0x1400a0760]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140025123
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002511e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002511e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
movdqa xmm0, xmmword [0x1400a0760]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140025172
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002516d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002516d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
movdqa xmm0, xmmword [0x1400a0760]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400251c3
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400251be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400251be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
movdqa xmm0, xmmword [0x1400a0760]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rcx, qword [rbp + 8]
mov rax, qword [0x1400f5830]
movss xmm8, dword [rax + 0x3d40]
movss xmm6, dword [0x1400a06b4]
movss xmm7, dword [0x1400a0690]
movss xmm10, dword [0x1400a04f4]
xorps xmm9, xmm9
test rcx, rcx
jne 0x14002521c
xorps xmm11, xmm11
jmp 0x140025263
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rcx
movss dword [rsp + 0x20], xmm6
movaps xmm3, xmm7
movaps xmm2, xmm8
lea rdx, [rsp + 0x70]
mov rcx, qword [rax + 0x3d38]
call fcn.140053670
movss xmm0, dword [rsp + 0x70]
addss xmm0, xmm10
cvttss2si eax, xmm0
movd xmm11, eax
cvtdq2ps xmm11, xmm11
movss xmm8, dword [rsp + 0x74]
lea rcx, [rbp + 0x28]
call fcn.140023d30
nop
lea rax, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova rax, qword [rbp + 0x28]
mov rdi, qword [0x1400f5830]
movss xmm1, dword [rdi + 0x3d40]
test rax, rax
jne 0x140025295
xorps xmm10, xmm10
jmp 0x1400252da
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm6
movaps xmm3, xmm7
movaps xmm2, xmm1
lea rdx, [rsp + 0x70]
mov rcx, qword [rdi + 0x3d38]
call fcn.140053670
movss xmm0, dword [rsp + 0x70]
addss xmm0, xmm10
cvttss2si eax, xmm0
movd xmm10, eax
cvtdq2ps xmm10, xmm10
movss xmm1, dword [rsp + 0x74]
addss xmm1, xmm1
addss xmm1, xmm8
subss xmm1, dword [0x1400a059c]
movaps xmm0, xmm11
movss xmm12, dword [0x1400a05b8]
addss xmm0, xmm12
movss dword [rdi + 0x4a30], xmm0
movss dword [rdi + 0x4a34], xmm1
mov dword [rdi + 0x4a18], 1
or dword [rdi + 0x4a10], 3
mov dword [rdi + 0x4a20], 0x41200000
mov qword [rdi + 0x4a24], 0x41200000
mov dword [rdi + 0x4a2c], r14d
mov dword [rdi + 0x4a14], 2
xor edx, edx
mov r8d, 0xbb
lea rcx, [0x14009cf90]
call fcn.140032e70
mov rax, qword [0x1400f5830]
mov rcx, qword [rax + 0x4010]
movsd xmm6, qword [rcx + 0x28]
movaps xmm0, xmmword [0x1400a09f0]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140028bd0
movaps xmm0, xmm8
addss xmm0, xmm8
movaps xmm13, xmm6
shufps xmm13, xmm13, 0x55
movsd qword [rsp + 0x70], xmm6
addss xmm0, xmm13
subss xmm0, dword [0x1400a059c]
movss xmm7, dword [rsp + 0x70]
addss xmm11, xmm7
addss xmm11, xmm12
movss dword [rsp + 0x50], xmm11
movss dword [rsp + 0x54], xmm0
mov dword [rsp + 0x28], r14d
movss dword [rsp + 0x20], xmm9
mov r9d, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14004e7f0
movaps xmm0, xmmword [0x1400a0a20]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140028bd0
movaps xmm0, xmm13
addss xmm0, dword [0x1400a0550]
movss dword [rsp + 0x50], xmm11
movss dword [rsp + 0x54], xmm0
mov dword [rsp + 0x28], r14d
movss dword [rsp + 0x20], xmm9
mov r9d, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14004e7f0
lea r8, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova r8, qword [rbp + 8]
movaps xmm0, xmmword [0x1400a0a30]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140028bd0
mov r9d, eax
movaps xmm1, xmm8
mulss xmm1, dword [0x1400a04b8]
addss xmm1, xmm13
subss xmm1, dword [0x1400a0550]
movaps xmm0, xmm7
addss xmm0, dword [0x1400a0590]
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x54], xmm1
test eax, 0xff000000
je 0x1400254f5
test r8, r8
je 0x1400254f5
cmp byte [r8], 0
je 0x1400254f5
mov rcx, rbx
inc rcx
cmp byte [r8 + rcx], 0
jne 0x1400254a0
add rcx, r8
mov rax, qword [rsi + 0x38]
movups xmm0, xmmword [rsi + 0x60]
movups xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm9
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r9d
lea r9, [rsp + 0x50]
movss xmm2, dword [rax + 0x10]
mov rdx, rsi
mov rcx, qword [rax + 8]
call fcn.140053890
movaps xmm0, xmmword [0x1400a09f0]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140028bd0
addss xmm8, xmm13
movaps xmm6, xmm8
addss xmm6, dword [0x1400a05d0]
addss xmm10, xmm7
addss xmm10, xmm12
movss dword [rsp + 0x50], xmm10
movss dword [rsp + 0x54], xmm6
addss xmm8, xmm12
movss dword [rsp + 0x70], xmm7
movss dword [rsp + 0x74], xmm8
mov dword [rsp + 0x28], r14d
movss dword [rsp + 0x20], xmm9
mov r9d, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14004e7f0
movaps xmm0, xmmword [0x1400a0a20]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140028bd0
movaps xmm0, xmm7
addss xmm0, dword [0x1400a0550]
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x54], xmm6
movss dword [rsp + 0x70], xmm7
movss dword [rsp + 0x74], xmm8
mov dword [rsp + 0x28], r14d
movss dword [rsp + 0x20], xmm9
mov r9d, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14004e7f0
lea r8, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova r8, qword [rbp + 0x28]
movaps xmm0, xmmword [0x1400a0a30]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140028bd0
mov ecx, eax
addss xmm7, dword [0x1400a05b0]
movss dword [rsp + 0x50], xmm7
movss dword [rsp + 0x54], xmm8
test eax, 0xff000000
je 0x140025664
test r8, r8
je 0x140025664
cmp byte [r8], 0
je 0x140025664
nop
inc rbx
cmp byte [r8 + rbx], 0
jne 0x140025610
add rbx, r8
mov rax, qword [rsi + 0x38]
movups xmm0, xmmword [rsi + 0x60]
movups xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm9
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r8
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x50]
movss xmm2, dword [rax + 0x10]
mov rdx, rsi
mov rcx, qword [rax + 8]
call fcn.140053890
call fcn.1400354e0
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x1400256a8
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400256a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400256a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
movdqa xmm0, xmmword [0x1400a0760]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x1400256f7
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400256f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400256f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
movdqa xmm0, xmmword [0x1400a0760]
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x140025747
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025741
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025741
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009016c
nop
mov rax, qword [rbp + 0x80]
cmp rax, 0xf
jbe 0x140025789
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140025781
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025781
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.14009016c
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14008fdb0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001400
nop
call fcn.140001360
int3