Function at 0x402314
Capabilities:
Get session user name

Disassembly:
push rbp
push rdi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
call sym.rand
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
and eax, 7
test eax, eax
jne 0x402373
lea rax, [rbp - 0x30]
movabs rdi, 0x544f4e204f445c3a
mov qword [rax], rdi
movabs rdi, 0x2e214b43494c4320
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 0x6b6e6c
jmp 0x40260e
mov eax, dword [rbp - 4]
and eax, 3
test eax, eax
jne 0x40256e
mov dword [rbp - 0x54], 0x14
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
call sym.rand
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
and eax, 7
test eax, eax
jne 0x402407
lea rax, [rbp - 0x30]
movabs rdi, 0x2073736f425c3a
mov qword [rax], rdi
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x30]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x30]
add rax, rdx
mov dword [rax], 0x6b6e6c2e
mov byte [rax + 4], 0
jmp 0x40260e
mov eax, dword [rbp - 4]
and eax, 3
test eax, eax
jne 0x40247b
lea rax, [rbp - 0x30]
mov word [rax], 0x5c3a
mov byte [rax + 2], 0
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x30]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x30]
add rax, rdx
movabs rdi, 0x2065687420736920
mov qword [rax], rdi
movabs rdi, 0x6b6e6c2e74736562
mov qword [rax + 8], rdi
mov byte [rax + 0x10], 0
jmp 0x40260e
mov eax, dword [rbp - 4]
and eax, 1
test eax, eax
jne 0x4024fd
lea rax, [rbp - 0x30]
movabs rdi, 0x206f6c6c65485c3a
mov qword [rax], rdi
mov byte [rax + 8], 0
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x30]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x30]
add rax, rdx
movabs rdi, 0x6d20646f6f672021
mov qword [rax], rdi
movabs rdi, 0x6c2e676e696e726f
mov qword [rax + 8], rdi
mov word [rax + 0x10], 0x6b6e
mov byte [rax + 0x12], 0
jmp 0x40260e
lea rax, [rbp - 0x30]
mov word [rax], 0x5c3a
mov byte [rax + 2], 0
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x30]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x30]
add rax, rdx
movabs rdi, 0x657361656c702021
mov qword [rax], rdi
movabs rdi, 0x656d20706c656820
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 0x6b6e6c2e
mov byte [rax + 0x14], 0
jmp 0x40260e
mov eax, dword [rbp - 4]
and eax, 1
test eax, eax
jne 0x4025ae
lea rax, [rbp - 0x30]
movabs rdi, 0x6c6c697720495c3a
mov qword [rax], rdi
movabs rdi, 0x6f79206c6c696b20
mov qword [rax + 8], rdi
movabs rcx, 0x2e21202120212075
mov qword [rax + 0x10], rcx
mov dword [rax + 0x18], 0x6b6e6c
jmp 0x40260e
mov ecx, dword [rbp - 4]
mov edx, 0x55555556
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
mov edx, eax
add edx, edx
add edx, eax
mov eax, ecx
sub eax, edx
test eax, eax
jne 0x4025eb
lea rax, [rbp - 0x30]
movabs rdi, 0x2e353d322b325c3a
mov qword [rax], rdi
mov dword [rax + 8], 0x6b6e6c
jmp 0x40260e
lea rax, [rbp - 0x30]
movabs rcx, 0x455320504f545c3a
mov qword [rax], rcx
movabs rdi, 0x6b6e6c2e54455243
mov qword [rax + 8], rdi
mov byte [rax + 0x10], 0
mov eax, 0
add rsp, 0x88
pop rdi
pop rbp
ret