Function at 0x14008ef00
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14016c0c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x101
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x101
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14008eff7
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xorps xmm1, xmm1
mov r8, 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm0
movdqu xmmword [rsp + 0x38], xmm1
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14008ef80
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140044850
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x14008efd6
mov rcx, qword [0x140172800]
inc rdx
cmp rdx, 0x1000
jb 0x14008efd1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008eff0
mov rcx, r8
call fcn.1400dde84
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [0x140172800], xmm0
movups xmmword [0x140172810], xmm1
jmp 0x14008f054
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
jb 0x14008f036
lea rbx, [0x140172800]
mov qword [0x140172810], 0xf
cmova rbx, qword [0x140172800]
lea rdx, str.Unkown_Username
mov rcx, rbx
mov r8d, reloc.WS2_32.dll_ntohs
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xf], 0
jmp 0x14008f054
movzx r8d, byte [rsp + 0x20]
lea r9, str.Unkown_Username
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x140172800]
call fcn.14008fcf0
mov eax, dword [0x7ffe0260]
cmp eax, 0x5867
jne 0x14008f0bc
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f0ab
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_11_Version_23h2
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_11_Version_23h2
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x585d
jne 0x14008f11d
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f10c
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_11_Version_22H2
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_11_Version_22H2
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x55f0
jne 0x14008f17e
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f16d
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_11_Version_21H2
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_11_Version_21H2
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x4a65
jne 0x14008f1df
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f1ce
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_22H2
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_22H2
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x4a64
jne 0x14008f240
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f22f
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_21H2
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_21H2
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x4a63
jne 0x14008f2a1
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f290
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_21H1
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_21H1
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x4a62
jne 0x14008f302
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f2f1
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_20H2
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_20H2
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x4a61
jne 0x14008f363
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f352
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_2004
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_2004
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x47bb
jne 0x14008f3c4
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f3b3
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_1909
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_1909
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x47ba
jne 0x14008f425
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f414
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_1903
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_1903
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x4563
jne 0x14008f486
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f475
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_1803
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_1803
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x3fab
jne 0x14008f4e7
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f4d6
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_1709
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_1709
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x3ad7
jne 0x14008f548
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f537
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_1703
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_1703
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x3839
jne 0x14008f5a9
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f598
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_1607
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_1607
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x295a
jne 0x14008f60a
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 0x17
jb 0x14008f5f9
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_1511
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_1511
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp eax, 0x2800
mov rax, qword [reloc.WS2_32.dll_ntohs]
jne 0x14008f665
cmp rax, 0x17
jb 0x14008f657
cmp rax, 0xf
mov qword [0x140172830], 0x17
lea rbx, [0x140172820]
mov r8d, reloc.WS2_32.dll_socket
cmova rbx, qword [0x140172820]
lea rdx, str.Windows_10_Version_1507
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
jmp 0x14008f6c2
lea r9, str.Windows_10_Version_1507
mov edx, reloc.WS2_32.dll_socket
jmp 0x14008f6b0
cmp rax, 0x16
jb 0x14008f6a4
cmp rax, 0xf
mov qword [0x140172830], 0x16
lea rbx, [0x140172820]
mov r8d, reloc.WLDAP32.dll_Ordinal_22
cmova rbx, qword [0x140172820]
lea rdx, str.Unkown_Windows_Version
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
jmp 0x14008f6c2
lea r9, str.Unkown_Windows_Version
mov edx, reloc.WLDAP32.dll_Ordinal_22
movzx r8d, byte [rsp + 0x20]
lea rcx, [0x140172820]
call fcn.14008fcf0
call fcn.14008e9c0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ddac0
add rsp, 0x170
pop rbx
ret