Function at 0x14000eae0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140019080]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r14, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov dword [rsp + 0x24], 0x101
lea rdx, [rsp + 0x24]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x14000eb60
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x68]
call fcn.140007150
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov rdi, qword [rsp + 0x78]
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rsi, qword [rsp + 0x68]
movabs r13, 0x7fffffffffffffff
cmp rdi, r13
ja 0x14000f0de
movabs rax, 0x8000000000000000
mov ecx, 0x16
mov qword [rbp - 0x60], 0xf
cmp rdi, 0xf
ja 0x14000ebdf
mov rax, rdi
mov qword [rbp - 0x68], rax
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x78], xmm0
jmp 0x14000ec62
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14000ec14
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.140010c2c
mov rcx, rax
test rax, rax
je 0x14000f053
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000ec46
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000ec37
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000f0d8
jmp 0x14000ebf2
test rcx, rcx
je 0x14000ec43
call fcn.140010c2c
jmp 0x14000ec46
mov rax, r15
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdi, [rsp + 0x68]
mov r8, qword [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rdi, r8
lea rcx, [rsp + 0x68]
cmova rcx, r8
mov rsi, qword [rsp + 0x78]
add rsi, rcx
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rbx, r8
cmp rbx, rsi
je 0x14000ecb4
sub rdi, rbx
nop dword [rax]
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx + rdi], al
inc rbx
cmp rbx, rsi
jne 0x14000eca0
mov r12, qword [0x140019628]
mov rax, qword [0x140019630]
mov qword [rsp + 0x30], rax
cmp r12, rax
je 0x14000f010
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rdi, qword [r12 + 0x10]
mov rsi, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x14000ecf6
mov rsi, qword [r12]
cmp rdi, r13
ja 0x14000f0d2
cmp rdi, 0xf
ja 0x14000ed22
mov qword [rsp + 0x58], rdi
mov r13d, 0xf
mov qword [rsp + 0x60], r13
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x48], xmm0
jmp 0x14000edca
mov qword [rsp + 0x60], 0xf
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14000ed4a
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000ed71
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000ed93
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000f0e4
mov rcx, rax
call fcn.140010c2c
mov rcx, rax
test rax, rax
je 0x14000f004
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000eda2
test rcx, rcx
je 0x14000ed9f
call fcn.140010c2c
jmp 0x14000eda2
mov rax, r15
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
lea rsi, [rsp + 0x48]
cmp r13, 0xf
seta al
mov r15, qword [rsp + 0x48]
cmova rsi, r15
lea rcx, [rsp + 0x48]
test al, al
je 0x14000edf1
mov rbx, r15
lea r14, [rdi + r15]
jmp 0x14000edfa
lea r14, [rdi + rcx]
lea rbx, [rsp + 0x48]
cmp rbx, r14
je 0x14000ee25
sub rsi, rbx
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rbx], al
inc rbx
cmp rbx, r14
jne 0x14000ee02
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x48]
lea rsi, [rsp + 0x48]
cmp r13, 0xf
seta byte [rsp + 0x20]
cmova rsi, r15
lea r14, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova r14, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
cmp rdi, rax
ja 0x14000eebc
test rdi, rdi
je 0x14000ef15
sub rax, rdi
inc rax
add rax, r14
mov qword [rsp + 0x40], rax
movsx edx, byte [rsi]
mov r8, rax
sub r8, r14
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14000eebc
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000eeb3
inc rbx
mov r8, qword [rsp + 0x40]
sub r8, rbx
movsx edx, byte [rsi]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x14000ee81
jmp 0x14000eebc
sub rbx, r14
cmp rbx, 0xffffffffffffffff
jne 0x14000ef15
cmp byte [rsp + 0x20], 0
je 0x14000eef4
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000eeec
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f004
mov rcx, r15
call fcn.140010c68
add r12, 0x20
cmp r12, qword [rsp + 0x30]
je 0x14000f00b
xor r15d, r15d
movabs r13, 0x7fffffffffffffff
jmp 0x14000ecd0
lea rdx, [rbp - 0x78]
mov r14, qword [rsp + 0x28]
mov rcx, r14
call fcn.1400095a0
mov byte [r14 + 0x20], 1
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14000ef68
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f004
call fcn.140010c68
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14000efbe
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000efb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000efb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010c68
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14000f09f
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f09a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f09a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r14, qword [rsp + 0x28]
lea rdx, [rbp - 0x78]
mov rcx, r14
call fcn.1400095a0
mov byte [r14 + 0x20], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14000f060
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f05a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f05a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010c68
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14000f09f
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f09a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f09a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010c68
mov rax, r14
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.140010fc0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000ab80
nop
call fcn.14000aa30
int3
call fcn.14000ab80
nop
call fcn.14000aa30
int3