Function at 0x180009020
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x310
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800851e8]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r14, rcx
movdqa xmm0, xmmword [0x1800602e0]
movdqu xmmword [rbp - 0x80], xmm0
xor r15d, r15d
mov word [rsp + 0x70], r15w
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.18003ab60
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x1800602e0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x50]
call fcn.180003ed0
nop
lea rcx, [rbp - 0x30]
call fcn.180007ad0
nop
cmp byte [r14 + 0xd0], r15b
jne 0x18000922b
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call fcn.1800071e0
test al, al
je 0x18000922b
xor r8d, r8d
lea edx, [r15 + 0x1a]
lea rcx, [rsp + 0x30]
call fcn.1800079f0
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x180009156
lea rcx, [rsp + 0x70]
call fcn.180003c70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180009198
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009193
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800097f1
call fcn.18001c898
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x30]
call fcn.1800079f0
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x1800091e1
lea rcx, [rsp + 0x50]
call fcn.180003c70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1800093cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800093ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800097eb
jmp 0x1800093ca
lea rcx, [rsp + 0x30]
call fcn.180007c90
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x30]
call fcn.180003d50
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
lea r9, str.AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x70]
call fcn.180006690
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x1800092ac
lea rcx, [rsp + 0x70]
call fcn.180003c70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1800092ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800092e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800097f7
call fcn.18001c898
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x70]
call fcn.180006690
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x18000934c
lea rcx, [rsp + 0x50]
call fcn.180003c70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000938d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009387
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800097fd
call fcn.18001c898
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1800093cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800093ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009803
call fcn.18001c898
lea rbx, [r14 + 0x70]
lea rax, [rsp + 0x70]
cmp rbx, rax
je 0x1800093f9
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
mov rcx, rbx
call fcn.180003ed0
lea rdi, [r14 + 0x90]
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x180009428
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.180003ed0
mov rcx, rbx
call fcn.1800071a0
test eax, eax
jne 0x180009447
lea r8d, [rax + 1]
lea rdx, [0x1800602c4]
mov rcx, rbx
call fcn.180003d50
mov rcx, rdi
call fcn.1800071a0
test eax, eax
jne 0x180009466
lea r8d, [rax + 1]
lea rdx, [0x1800602c4]
mov rcx, rdi
call fcn.180003d50
lea rdx, str.SOFT_NAME_EN
lea rcx, [rbp - 0x70]
call fcn.18000dc30
nop
cmp qword [rax + 0x18], 8
jb 0x180009481
mov rax, qword [rax]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000948e
mov r8, qword [rbx]
mov r9, rax
lea rdx, str._s_s_
lea rcx, [rsp + 0x30]
call fcn.180006cc0
mov rsi, rax
lea rdi, [r14 + 0x30]
cmp rdi, rax
je 0x1800094d4
mov rcx, rdi
call fcn.180003c70
movups xmm0, xmmword [rsi]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 7
mov word [rsi], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180009516
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009511
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009809
call fcn.18001c898
movdqa xmm0, xmmword [0x1800602e0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000956a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009565
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000980f
call fcn.18001c898
cmp qword [rdi + 0x18], 8
jb 0x180009574
mov rdi, qword [rdi]
mov rcx, rdi
call fcn.180007660
lea rdx, str.APPDATA_RETAIN_FOLDER
lea rcx, [rbp - 0x70]
call fcn.18000dc30
nop
cmp qword [rax + 0x18], 8
jb 0x180009597
mov rax, qword [rax]
cmp qword [rbx + 0x18], 8
jb 0x1800095a1
mov rbx, qword [rbx]
mov r9, rax
mov r8, rbx
lea rdx, str._s_s_
lea rcx, [rsp + 0x30]
call fcn.180006cc0
mov rdi, rax
lea rbx, [r14 + 0x50]
cmp rbx, rax
je 0x1800095ea
mov rcx, rbx
call fcn.180003c70
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000962c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009627
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009815
call fcn.18001c898
movdqa xmm0, xmmword [0x1800602e0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x180009680
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000967b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000981b
call fcn.18001c898
cmp qword [rbx + 0x18], 8
jb 0x18000968a
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.180007660
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1800096d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800096ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009821
call fcn.18001c898
movdqa xmm0, xmmword [0x1800602e0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180009725
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009720
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009827
call fcn.18001c898
movdqa xmm0, xmmword [0x1800602e0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000977a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009774
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000982d
call fcn.18001c898
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1800097b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800097b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800097e5
call fcn.18001c898
mov al, 1
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.18001c9b0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
int3
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
int3