Function at 0x140163100
Capabilities:
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x288
mov r12d, r8d
mov r15, rdx
mov r14, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x280], rax
movabs rbp, 0x7fffffffffffffef
mov r13, qword [rdx + 0x30]
mov rcx, r13
call fcn.14011bf14
cmp rax, rbp
ja 0x1401633f0
mov rsi, rax
cmp rax, 0xb
jae 0x140163384
mov byte [rsp + 0x4f], sil
lea rbx, [rsp + 0x38]
test rsi, rsi
je 0x140163182
cmp rsi, 3
jne 0x1401633ae
movzx eax, word [r13 + 4]
mov word [rbx + 4], ax
mov eax, dword [r13]
mov dword [rbx], eax
mov word [rbx + rsi*2], 0
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x60]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x1401d9dd0]
movaps xmmword [rsi], xmm0
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov edx, r12d
call fcn.1401653b0
lea rcx, str.chrome.exe
lea rbx, [rsp + 0x50]
mov qword [rbx], rcx
call fcn.14011bf14
mov qword [rbx + 8], rax
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.1400d8c10
mov rcx, rdi
call fcn.1400d7bc0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
test r12b, r12b
je 0x14016328c
lea rcx, [rsp + 0x60]
call fcn.1400d7bc0
lea rdx, [rsp + 0x20]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
lea rcx, [rsp + 0x38]
call fcn.1400d60e0
cmp byte [rax + 0x17], 0
js 0x1401633c4
mov rcx, qword [rax + 0x10]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rax]
movups xmmword [r14], xmm0
cmp byte [rsp + 0x37], 0
jns 0x140163254
mov rcx, qword [rsp + 0x20]
call fcn.140100564
cmp byte [rsp + 0x4f], 0
jns 0x140163265
mov rcx, qword [rsp + 0x38]
call fcn.140100564
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401013e0
mov rax, r14
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x20]
call fcn.140061a70
test al, al
je 0x1401632b7
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov r8, r15
xor r9d, r9d
call fcn.140064f00
test al, al
jne 0x140163200
lea rsi, [rsp + 0x80]
mov r8d, 0x200
mov rcx, rsi
mov dl, 0xaa
call fcn.140103d70
lea rdx, [rsp + 0x7c]
mov dword [rdx], 0x100
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140163341
mov edx, dword [rsp + 0x7c]
test edx, edx
je 0x140163341
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.140031930
mov edx, 1
mov rcx, rsi
mov r8w, 0x2e
call fcn.140031ab0
mov r8d, dword [rsp + 0x7c]
dec r8d
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1400d60e0
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8, r15
xor r9d, r9d
call fcn.140064f00
test al, al
jne 0x140163200
cmp byte [rsp + 0x37], 0
js 0x1401633d8
mov word [rsp + 0x20], 0
mov byte [rsp + 0x37], 0
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov r8, r15
xor r9d, r9d
call fcn.140064f00
test al, al
jne 0x140163200
lea rcx, [rsp + 0x20]
call fcn.140061a70
jmp 0x140163200
lea rdi, [rsi + 8]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
call fcn.140100528
mov rbx, rax
mov qword [rsp + 0x38], rax
add rbp, 0x11
or rbp, rdi
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov r8, rsi
add r8, rsi
mov rcx, rbx
mov rdx, r13
call fcn.140103960
jmp 0x140163182
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r14
call fcn.1400d5aa0
jmp 0x140163243
mov rax, qword [rsp + 0x20]
mov word [rax], 0
mov qword [rsp + 0x28], 0
jmp 0x140163358
lea rcx, [rsp + 0x38]
call fcn.140154d80
int3