Function at 0x180003730
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x188
mov rax, qword [0x1800c3380]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0xd8]
call fcn.1800042f0
mov rcx, rax
call fcn.18000fbf0
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x150], rcx
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xd0]
call fcn.180004ae0
mov rcx, rax
call fcn.18000fd90
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x158], rcx
add rax, 8
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xc8]
call fcn.180005110
mov rcx, rax
call fcn.18000fd90
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x4c], 0x7df9c993
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x34], eax
sub eax, 0x8622600c
je 0x180003e4b
jmp 0x1800037ef
mov eax, dword [rsp + 0x34]
sub eax, 0x8c4df6f6
je 0x1800042d9
jmp 0x180003803
mov eax, dword [rsp + 0x34]
sub eax, 0x92d49f6d
je 0x180003fc5
jmp 0x180003817
mov eax, dword [rsp + 0x34]
sub eax, 0x9a1fab23
je 0x180003d3f
jmp 0x18000382b
mov eax, dword [rsp + 0x34]
sub eax, 0x9ddc98d3
je 0x180003b62
jmp 0x18000383f
mov eax, dword [rsp + 0x34]
sub eax, 0xa4e68c14
je 0x18000412c
jmp 0x180003853
mov eax, dword [rsp + 0x34]
sub eax, 0xa6753bf5
je 0x180004252
jmp 0x180003867
mov eax, dword [rsp + 0x34]
sub eax, 0xae4e70bb
je 0x180003e31
jmp 0x18000387b
mov eax, dword [rsp + 0x34]
sub eax, 0xbde78201
je 0x1800042ba
jmp 0x18000388f
mov eax, dword [rsp + 0x34]
sub eax, 0xc2d896f3
je 0x180004153
jmp 0x1800038a3
mov eax, dword [rsp + 0x34]
sub eax, 0xc592870c
je 0x180004084
jmp 0x1800038b7
mov eax, dword [rsp + 0x34]
sub eax, 0xce931323
je 0x180003fa7
jmp 0x1800038cb
mov eax, dword [rsp + 0x34]
sub eax, 0xd360dfe4
je 0x180003f8d
jmp 0x1800038df
mov eax, dword [rsp + 0x34]
sub eax, 0xd4674d8e
je 0x1800042ad
jmp 0x1800038f3
mov eax, dword [rsp + 0x34]
sub eax, 0xd8a987cc
je 0x180003f7b
jmp 0x180003907
mov eax, dword [rsp + 0x34]
sub eax, 0xe48d3c77
je 0x1800042a0
jmp 0x18000391b
mov eax, dword [rsp + 0x34]
sub eax, 0xf6e1cf47
je 0x180004139
jmp 0x18000392f
mov eax, dword [rsp + 0x34]
sub eax, 0x274251f
je 0x180003d8f
jmp 0x180003943
mov eax, dword [rsp + 0x34]
sub eax, 0x7960b97
je 0x180003f9a
jmp 0x180003957
mov eax, dword [rsp + 0x34]
sub eax, 0xda86626
je 0x180003c49
jmp 0x18000396b
mov eax, dword [rsp + 0x34]
sub eax, 0xf1a252e
je 0x180003c3c
jmp 0x18000397f
mov eax, dword [rsp + 0x34]
sub eax, 0x23e7ee76
je 0x18000402f
jmp 0x180003993
mov eax, dword [rsp + 0x34]
sub eax, 0x2452a27b
je 0x18000428b
jmp 0x1800039a7
mov eax, dword [rsp + 0x34]
sub eax, 0x288397c9
je 0x1800040dc
jmp 0x1800039bb
mov eax, dword [rsp + 0x34]
sub eax, 0x354e29ab
je 0x1800041d0
jmp 0x1800039cf
mov eax, dword [rsp + 0x34]
sub eax, 0x391f7a8a
je 0x180003bdf
jmp 0x1800039e3
mov eax, dword [rsp + 0x34]
sub eax, 0x3cf071e0
je 0x180003e89
jmp 0x1800039f7
mov eax, dword [rsp + 0x34]
sub eax, 0x44597360
je 0x180003d32
jmp 0x180003a0b
mov eax, dword [rsp + 0x34]
sub eax, 0x44743543
je 0x18000427e
jmp 0x180003a1f
mov eax, dword [rsp + 0x34]
sub eax, 0x51f9c8b5
je 0x180003fdf
jmp 0x180003a33
mov eax, dword [rsp + 0x34]
sub eax, 0x533acbd5
je 0x180004091
jmp 0x180003a47
mov eax, dword [rsp + 0x34]
sub eax, 0x5a957974
je 0x1800042cc
jmp 0x180003a5b
mov eax, dword [rsp + 0x34]
sub eax, 0x5b47f552
je 0x180003b94
jmp 0x180003a6f
mov eax, dword [rsp + 0x34]
sub eax, 0x724c2f2f
je 0x180003e11
jmp 0x180003a83
mov eax, dword [rsp + 0x34]
sub eax, 0x7a28eee7
je 0x180003f5b
jmp 0x180003a97
mov eax, dword [rsp + 0x34]
sub eax, 0x7d9544af
je 0x180003f0b
jmp 0x180003aab
mov eax, dword [rsp + 0x34]
sub eax, 0x7df9c993
je 0x180003ad8
jmp 0x180003abf
mov eax, dword [rsp + 0x34]
sub eax, 0x7e2a844f
je 0x180003c99
jmp 0x180003ad3
jmp 0x1800042e1
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov qword [rax], rcx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xc0]
call fcn.180005980
mov rcx, rax
call fcn.18000fbf0
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rax + 8], rcx
lea rcx, [rsp + 0xb8]
call fcn.180006110
mov rcx, rax
call fcn.18000fbf0
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10], rcx
mov dword [rsp + 0xb4], 0x64
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0xb4]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x4c], 0x9ddc98d3
jmp 0x1800042e1
lea rax, [rsp + 0x150]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x68]
add rax, 0x28
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x4c], 0x5b47f552
jmp 0x1800042e1
mov eax, dword [0x1800c6bec]
mov ecx, dword [0x1800c6be8]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x44743543
mov ecx, 0x391f7a8a
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x88], rax
mov eax, dword [0x1800c6bec]
mov ecx, dword [0x1800c6be8]
mov edx, eax
add edx, 0xd0727bfa
sub edx, 1
sub edx, 0xd0727bfa
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x44743543
mov ecx, 0xf1a252e
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0xda86626
jmp 0x1800042e1
mov eax, dword [0x1800c6bec]
mov ecx, dword [0x1800c6be8]
mov edx, eax
add edx, 0x5150b029
sub edx, 1
sub edx, 0x5150b029
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2452a27b
mov ecx, 0x7e2a844f
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x88]
cmp rax, rcx
setne al
and al, 1
mov byte [rsp + 0x97], al
mov ecx, dword [0x1800c6bec]
mov eax, dword [0x1800c6be8]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2452a27b
mov ecx, 0x44597360
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0x9a1fab23
jmp 0x1800042e1
mov eax, dword [0x1800c6bec]
mov ecx, dword [0x1800c6be8]
mov edx, eax
add edx, 0xd6863b82
sub edx, 1
sub edx, 0xd6863b82
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe48d3c77
mov ecx, 0x274251f
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov ecx, dword [0x1800c6bec]
mov eax, dword [0x1800c6be8]
mov edx, ecx
sub edx, 0xde14cf3a
sub edx, 1
add edx, 0xde14cf3a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe48d3c77
mov ecx, 0x724c2f2f
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov dl, byte [rsp + 0x97]
mov eax, 0x51f9c8b5
mov ecx, 0xae4e70bb
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x4c], 0x8622600c
jmp 0x1800042e1
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xe0]
call fcn.180092600
cmp eax, 0
sete al
and al, 1
mov byte [rsp + 0xa7], al
mov dword [rsp + 0x4c], 0x3cf071e0
jmp 0x1800042e1
mov ecx, dword [0x1800c6bec]
mov eax, dword [0x1800c6be8]
mov edx, ecx
sub edx, 0xd588b143
sub edx, 1
add edx, 0xd588b143
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd4674d8e
mov ecx, 0x7d9544af
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov eax, dword [0x1800c6bec]
mov ecx, dword [0x1800c6be8]
mov edx, eax
add edx, 0x8fb76545
sub edx, 1
sub edx, 0x8fb76545
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd4674d8e
mov ecx, 0x7a28eee7
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov dl, byte [rsp + 0xa7]
mov eax, 0x7960b97
mov ecx, 0xd8a987cc
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov byte [rsp + 0x77], 1
mov dword [rsp + 0x4c], 0xd360dfe4
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0xf6e1cf47
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0xce931323
jmp 0x1800042e1
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x4c], 0x92d49f6d
jmp 0x1800042e1
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x4c], 0x5b47f552
jmp 0x1800042e1
mov eax, dword [0x1800c6bec]
mov ecx, dword [0x1800c6be8]
mov edx, eax
sub edx, 0xe45b14d8
sub edx, 1
add edx, 0xe45b14d8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbde78201
mov ecx, 0x23e7ee76
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov byte [rsp + 0x77], 0
mov eax, dword [0x1800c6bec]
mov ecx, dword [0x1800c6be8]
mov edx, eax
sub edx, 0x3fe5890f
sub edx, 1
add edx, 0x3fe5890f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbde78201
mov ecx, 0xc592870c
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0x533acbd5
jmp 0x1800042e1
mov eax, dword [0x1800c6bec]
mov ecx, dword [0x1800c6be8]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5a957974
mov ecx, 0x288397c9
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov eax, dword [0x1800c6bec]
mov ecx, dword [0x1800c6be8]
mov edx, eax
sub edx, 0xbac8fd55
sub edx, 1
add edx, 0xbac8fd55
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5a957974
mov ecx, 0xa4e68c14
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0xf6e1cf47
jmp 0x1800042e1
mov al, byte [rsp + 0x77]
and al, 1
mov byte [rsp + 0xb3], al
mov dword [rsp + 0x4c], 0xc2d896f3
jmp 0x1800042e1
mov ecx, dword [0x1800c6bec]
mov eax, dword [0x1800c6be8]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8c4df6f6
mov ecx, 0x354e29ab
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov ecx, dword [0x1800c6bec]
mov eax, dword [0x1800c6be8]
mov edx, ecx
sub edx, 0xa9ad5e60
sub edx, 1
add edx, 0xa9ad5e60
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8c4df6f6
mov ecx, 0xa6753bf5
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x4c], eax
jmp 0x1800042e1
mov al, byte [rsp + 0xb3]
and al, 1
movzx eax, al
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180088f10
mov eax, dword [rsp + 0x24]
add rsp, 0x188
ret
mov dword [rsp + 0x4c], 0x391f7a8a
jmp 0x1800042e1
mov rax, qword [rsp + 0x88]
mov dword [rsp + 0x4c], 0x7e2a844f
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0x274251f
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0x7d9544af
jmp 0x1800042e1
mov byte [rsp + 0x77], 0
mov dword [rsp + 0x4c], 0x23e7ee76
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0x288397c9
jmp 0x1800042e1
mov dword [rsp + 0x4c], 0x354e29ab
jmp 0x1800037d7