Function at 0x1400876b0
Capabilities:
Get session user name

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11bd0]
mov eax, 0x11cd0
call fcn.1400e2af0
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x11d00], rbx
mov qword [rsp + 0x11d08], rsi
mov qword [rsp + 0x11d10], rdi
movaps xmmword [rsp + 0x11cc0], xmm6
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x11bb0], rax
mov rax, qword [0x140183748]
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
test cl, cl
je 0x140087739
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
jmp 0x140087eed
lea rcx, [rax + 0x108]
lea rdx, [rsp + 0x58]
call fcn.140086cc0
test eax, eax
jne 0x140087783
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x14008776d
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400892b0
mov rcx, rdi
call fcn.1400d4d78
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
xor eax, eax
jmp 0x140087ef2
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rsi, [0x14012f710]
mov rdi, rsi
shr rdi, 0x10
test rdi, rdi
jne 0x1400877cf
movzx ebx, si
mov ecx, ebx
call fcn.140002830
test rax, rax
je 0x1400877df
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400029f0
jmp 0x1400877df
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140002120
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, [0x140129a38]
test rdx, 0xffffffffffff0000
jne 0x14008782a
movzx ebx, dx
mov ecx, ebx
call fcn.140002830
test rax, rax
je 0x140087838
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400029f0
jmp 0x140087838
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.140002120
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
test rdi, rdi
jne 0x140087878
movzx edi, si
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14008788d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400029f0
jmp 0x140087888
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140002120
mov rbx, qword [rsp + 0x50]
mov dword [rbp - 0x74], 0x100
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x100
or eax, ecx
jge 0x1400878bc
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.1400020c0
mov rbx, qword [rsp + 0x50]
lea rdx, [rbp - 0x74]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400878f9
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4f10
test eax, eax
js 0x1400878ee
cmp eax, dword [rbx - 0xc]
jg 0x1400878ee
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
jmp 0x1400878f9
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r13d, r14d
mov qword [rbp + 0x180], r14
mov edx, 0x400
lea rcx, [rbp + 0x180]
call fcn.14001c170
nop
or r15, 0xffffffffffffffff
mov r12, qword [rsp + 0x58]
cmp r12, qword [rsp + 0x60]
je 0x140087cc6
add r12, 8
nop dword [rax]
mov dword [rbp + 0xbb0], r14d
xor edx, edx
mov r8d, 0xffc
lea rcx, [rbp + 0xbb4]
call fcn.1400dd9f0
mov dword [rbp + 0x3b0], r14d
xor edx, edx
mov r8d, 0x7fc
lea rcx, [rbp + 0x3b4]
call fcn.1400dd9f0
mov dword [rbp + 0x210], r14d
xor edx, edx
mov r8d, SetErrorInfo
lea rcx, [rbp + 0x214]
call fcn.1400dd9f0
mov dword [rbp + 0x2e0], r14d
xor edx, edx
mov r8d, SetErrorInfo
lea rcx, [rbp + 0x2e4]
call fcn.1400dd9f0
mov rdx, qword [r12]
cmp dword [rdx - 0x10], 0x200
jle 0x1400879ee
mov ecx, 1
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, 0x200
or eax, ecx
jge 0x1400879ca
mov edx, 0x200
mov rcx, r12
call fcn.1400020c0
mov rax, qword [r12]
cmp dword [rax - 0xc], 0x200
jl 0x140087cbb
mov dword [rax - 0x10], 0x200
mov rax, qword [r12]
mov word [rax + 0x400], r14w
mov dword [rsp + 0x38], 1
mov rax, qword [r12]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x4e3
mov r9, qword [r12 - 8]
lea r8, str._s__ld__s__s_c
mov edx, 0x400
lea rcx, [rbp + 0x3b0]
call fcn.1400d9998
movsd xmm6, qword [r12 + 8]
lea rdx, [rbp + 0x160]
movapd xmm0, xmm6
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x140087a58
mov r8d, eax
lea rdx, [rbp + 0x160]
movapd xmm0, xmm6
call fcn.140016470
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movaps xmm5, xmmword [rbp + 0x150]
movdqa xmmword [rbp + 0x160], xmm5
mov rcx, qword [rbp + 0x158]
mov rsi, rcx
shr rsi, 0x30
mov rax, rcx
shr rax, 0x20
movzx r11d, ax
mov rax, rcx
shr rax, 0x10
movzx r8d, ax
movzx r10d, cx
mov rcx, qword [rbp + 0x150]
movzx edi, cx
mov rax, rcx
shr rax, 0x10
movzx edx, ax
shr rcx, 0x30
mov r9d, ecx
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edx
lea r8, str._0.2u._0.2u._0.2u__0.2u:_0.2u:_0.2u:_d_
mov edx, 0x64
lea rcx, [rbp + 0x210]
call fcn.1400d9998
movsd xmm5, qword [r12 + 8]
movsd qword [rbp - 0x70], xmm5
mov edx, dword [r12 + 0x10]
lea rcx, [rbp - 0x70]
call fcn.140089470
movsd xmm6, qword [rbp - 0x70]
lea rdx, [rbp + 0x170]
movapd xmm0, xmm6
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x140087b3a
mov r8d, eax
lea rdx, [rbp + 0x170]
movapd xmm0, xmm6
call fcn.140016470
movaps xmm0, xmmword [rbp + 0x170]
movdqa xmmword [rbp + 0x160], xmm0
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movaps xmm5, xmmword [rbp + 0x150]
movdqa xmmword [rbp + 0x160], xmm5
mov rcx, qword [rbp + 0x158]
mov rsi, rcx
shr rsi, 0x30
mov rax, rcx
shr rax, 0x20
movzx r11d, ax
mov rax, rcx
shr rax, 0x10
movzx r8d, ax
movzx r10d, cx
mov rcx, qword [rbp + 0x150]
movzx edi, cx
mov rax, rcx
shr rax, 0x10
movzx edx, ax
shr rcx, 0x30
mov r9d, ecx
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edx
lea r8, str._0.2u._0.2u._0.2u__0.2u:_0.2u:_0.2u:_d_r_n
mov edx, 0x64
lea rcx, [rbp + 0x2e0]
call fcn.1400d9998
lea rdx, [rbp + 0x2e0]
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3b0]
lea r8, str._s_s_s
mov edx, 0x800
lea rcx, [rbp + 0xbb0]
call fcn.1400d9998
mov edx, 0x800
lea rcx, [rbp + 0xbb0]
call fcn.1400d4f10
mov rsi, rax
lea r14d, [rax + rax]
mov rcx, r15
test r14d, r14d
je 0x140087c70
lea rdx, [rbp + 0xbb0]
mov edi, r14d
lea rbx, [0x14017e9a4]
nop dword [rax]
cmp rcx, 4
jl 0x140087c5a
xor ecx, ecx
jmp 0x140087c5d
inc rcx
movzx eax, byte [rcx + rbx]
xor byte [rdx], al
inc rdx
dec rdi
jne 0x140087c50
mov rbx, qword [rsp + 0x50]
add rsi, rsi
movsxd rdi, r13d
lea rdx, [rdi + rsi]
lea rcx, [rbp + 0x180]
call fcn.140079f40
mov rdx, qword [rbp + 0x180]
lea rcx, [rdi + rdx]
mov r8, rsi
lea rdx, [rbp + 0xbb0]
call fcn.1400d5d30
add r13d, r14d
add r12, 0x20
lea rax, [r12 - 8]
xor r14d, r14d
cmp rax, qword [rsp + 0x60]
je 0x140087cc6
jmp 0x140087930
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov rsi, qword [0x1401835d0]
test rsi, rsi
jne 0x140087cfa
lea ecx, [rsi + 0x70]
call fcn.1400d5224
mov qword [rbp - 0x58], rax
test rax, rax
je 0x140087cf0
mov rcx, rax
call fcn.140037eb0
mov rsi, rax
jmp 0x140087cf3
mov rsi, r14
mov qword [0x1401835d0], rsi
lea rcx, [rbp - 0x40]
call fcn.14001f830
nop
lea rax, vtable.CProcLogEntry.0
mov qword [rbp - 0x40], rax
mov qword [rbp + 0xf8], r14
mov qword [rbp + 0x100], 0
lea rcx, [rbp + 0x108]
call fcn.14002d2b0
nop
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 0
mov r14, qword [rbp + 0x180]
mov qword [rbp - 0x68], r14
mov dword [rbp - 0x60], r13d
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x140087d70
call fcn.1400d6134
mov qword [rbp + 0xf8], 0
xor edi, edi
mov qword [rbp + 0x100], rdi
jmp 0x140087d76
mov edi, dword [rbp + 0x100]
test r13d, r13d
je 0x140087db3
mov r12d, r13d
mov ecx, r13d
call fcn.1400d886c
mov qword [rbp + 0xf8], rax
test rax, rax
je 0x140087da3
mov dword [rbp + 0x104], r13d
mov edi, r13d
mov dword [rbp + 0x100], r13d
mov edx, edi
mov r9, r12
mov r8, r14
mov rcx, rax
call fcn.1400d4e34
mov dword [rbp - 0x78], 0x7fff
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x1bb0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov rcx, r15
lea rdi, [rbp + 0x1bb0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x1bb0]
lea rcx, [rbp + 0x38]
call fcn.140002120
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.140038c90
nop
lea rax, [rbp + 0x108]
mov qword [rbp - 0x58], rax
lea rcx, [rbp + 0x108]
call fcn.140032aa0
nop
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x140087e39
call fcn.1400d6134
xor esi, esi
mov qword [rbp + 0xf8], rsi
mov qword [rbp + 0x100], rsi
jmp 0x140087e3b
xor esi, esi
lea rcx, [rbp - 0x40]
call fcn.14001f9e0
nop
lea rax, [rbp + 0x188]
cmp qword [rbp + 0x180], rax
je 0x140087e62
lea rcx, [rbp + 0x180]
call fcn.140043680
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140087e7e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140087e9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
dec r15d
test r15d, r15d
jg 0x140087ebf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x140087ede
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400892b0
mov rcx, rdi
call fcn.1400d4d78
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov eax, 1
mov rcx, qword [rbp + 0x11bb0]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x11cd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret