Function at 0x1800079f0
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x248]
sub rsp, 0x330
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800870b8]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rsi, rcx
movdqa xmm0, xmmword [0x180062a70]
movdqu xmmword [rsp + 0x60], xmm0
xor r14d, r14d
mov word [rsp + 0x50], r14w
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call fcn.180036320
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x180062a70]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x70]
call fcn.180002d20
nop
lea rcx, [rbp - 0x50]
call fcn.180004cb0
nop
cmp byte [rsi + 0xd0], r14b
jne 0x180007bf6
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.180003fc0
test al, al
je 0x180007bf6
xor r8d, r8d
lea edx, [r14 + 0x1a]
lea rcx, [rsp + 0x70]
call fcn.180004bd0
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x180007b23
lea rcx, [rsp + 0x50]
call fcn.180002cb0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180007b64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007b5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008025
call fcn.180017a30
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x70]
call fcn.180004bd0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x180007bad
lea rcx, [rsp + 0x30]
call fcn.180002cb0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180007d98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007d93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000801f
jmp 0x180007d93
lea rcx, [rsp + 0x70]
call fcn.180004d90
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x70]
call fcn.180002800
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea r9, str.AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x30]
call fcn.180002a20
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x180007c77
lea rcx, [rsp + 0x50]
call fcn.180002cb0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x180007cb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007cb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000802b
call fcn.180017a30
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x30]
call fcn.180002a20
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x180007d16
lea rcx, [rsp + 0x30]
call fcn.180002cb0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x180007d57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007d51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008031
call fcn.180017a30
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180007d98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007d93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008037
call fcn.180017a30
lea rdi, [rsi + 0x50]
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x180007dc4
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.180002d20
lea rbx, [rsi + 0x70]
lea rax, [rsp + 0x30]
cmp rbx, rax
je 0x180007df0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180002d20
mov rcx, rdi
call fcn.180003f40
test eax, eax
jne 0x180007e0f
lea r8d, [rax + 1]
lea rdx, [0x180062a00]
mov rcx, rdi
call fcn.180002800
mov rcx, rbx
call fcn.180003f40
test eax, eax
jne 0x180007e2e
lea r8d, [rax + 1]
lea rdx, [0x180062a00]
mov rcx, rbx
call fcn.180002800
lea rbx, [rsi + 0x30]
cmp rbx, rdi
je 0x180007e50
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x180007e44
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call fcn.180002d20
lea rdx, [rsi + 0xb0]
cmp qword [rsi + 0xc8], 8
jb 0x180007e68
mov rdx, qword [rsi + 0xb0]
mov r8, qword [rsi + 0xc0]
mov rcx, rbx
call fcn.180002800
mov rcx, rbx
call fcn.180003f40
test eax, eax
jne 0x180007e96
lea r8d, [rax + 1]
lea rdx, [0x180062a00]
mov rcx, rbx
call fcn.180002800
mov qword [rbp + 8], r14
cmp qword [rbx + 0x18], 8
jb 0x180007ea4
mov rbx, qword [rbx]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.1800049b0
nop
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x180007ecb
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180007f0b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007f06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000803d
call fcn.180017a30
movdqa xmm0, xmmword [0x180062a70]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x180007f5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007f58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008043
call fcn.180017a30
movdqa xmm0, xmmword [0x180062a70]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180007fb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007fac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008049
call fcn.180017a30
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180007ff0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007feb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008019
call fcn.180017a30
mov al, 1
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1800181c0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180039384
nop
call fcn.180039384
nop
call fcn.180039384
nop
call fcn.180039384
int3
call fcn.180039384
nop
call fcn.180039384
nop
call fcn.180039384
nop
call fcn.180039384
nop
call fcn.180039384
int3