Function at 0x180002c80
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1800cf380]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0xa8]
call fcn.1800038e0
mov rcx, rax
call fcn.18000f100
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0xa0]
call fcn.180004040
mov rcx, rax
call fcn.18000f4f0
mov qword [rsp + 0x128], rax
lea rcx, [rsp + 0x98]
call fcn.180004680
mov rcx, rax
call fcn.18000f4f0
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x90]
call fcn.180004c30
mov rcx, rax
call fcn.18000f100
mov qword [rsp + 0x138], rax
lea rcx, [rsp + 0x88]
call fcn.1800051f0
mov rcx, rax
call fcn.18000f100
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x34], 0x17ec0d37
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
sub eax, 0x8b83931c
je 0x180003792
jmp 0x180002d4a
mov eax, dword [rsp + 0x30]
sub eax, 0xa04e488c
je 0x18000348e
jmp 0x180002d5e
mov eax, dword [rsp + 0x30]
sub eax, 0xa1501019
je 0x18000356d
jmp 0x180002d72
mov eax, dword [rsp + 0x30]
sub eax, 0xa6c911aa
je 0x18000340c
jmp 0x180002d86
mov eax, dword [rsp + 0x30]
sub eax, 0xab076583
je 0x1800035ef
jmp 0x180002d9a
mov eax, dword [rsp + 0x30]
sub eax, 0xabf4d365
je 0x180003855
jmp 0x180002dae
mov eax, dword [rsp + 0x30]
sub eax, 0xabf6dc4b
je 0x18000381c
jmp 0x180002dc2
mov eax, dword [rsp + 0x30]
sub eax, 0xac5d6be9
je 0x180003735
jmp 0x180002dd6
mov eax, dword [rsp + 0x30]
sub eax, 0xad74c3d2
je 0x180003215
jmp 0x180002dea
mov eax, dword [rsp + 0x30]
sub eax, 0xb3b532b1
je 0x180003142
jmp 0x180002dfe
mov eax, dword [rsp + 0x30]
sub eax, 0xbbe71e92
je 0x180003716
jmp 0x180002e12
mov eax, dword [rsp + 0x30]
sub eax, 0xc01a0d18
je 0x1800038b0
jmp 0x180002e26
mov eax, dword [rsp + 0x30]
sub eax, 0xe23c1193
je 0x180003723
jmp 0x180002e3a
mov eax, dword [rsp + 0x30]
sub eax, 0xe341375c
je 0x1800030b5
jmp 0x180002e4e
mov eax, dword [rsp + 0x30]
sub eax, 0xe79f394a
je 0x1800033ff
jmp 0x180002e62
mov eax, dword [rsp + 0x30]
sub eax, 0xf244e834
je 0x1800032b2
jmp 0x180002e76
mov eax, dword [rsp + 0x30]
sub eax, 0x788c4eb
je 0x180003510
jmp 0x180002e8a
mov eax, dword [rsp + 0x30]
sub eax, 0x95bc2bc
je 0x180003884
jmp 0x180002e9e
mov eax, dword [rsp + 0x30]
sub eax, 0x17ec0d37
je 0x180003033
jmp 0x180002eb2
mov eax, dword [rsp + 0x30]
sub eax, 0x1c58e573
je 0x1800032c9
jmp 0x180002ec6
mov eax, dword [rsp + 0x30]
sub eax, 0x20f862b9
je 0x1800035fc
jmp 0x180002eda
mov eax, dword [rsp + 0x30]
sub eax, 0x2308f277
je 0x1800031c5
jmp 0x180002eee
mov eax, dword [rsp + 0x30]
sub eax, 0x27b11b31
je 0x1800038a3
jmp 0x180002f02
mov eax, dword [rsp + 0x30]
sub eax, 0x2a2cb2b9
je 0x180003896
jmp 0x180002f16
mov eax, dword [rsp + 0x30]
sub eax, 0x2f6621f0
je 0x1800038cb
jmp 0x180002f2a
mov eax, dword [rsp + 0x30]
sub eax, 0x32d4b2fa
je 0x180003197
jmp 0x180002f3e
mov eax, dword [rsp + 0x30]
sub eax, 0x33958ba8
je 0x180003742
jmp 0x180002f52
mov eax, dword [rsp + 0x30]
sub eax, 0x339a7506
je 0x180003679
jmp 0x180002f66
mov eax, dword [rsp + 0x30]
sub eax, 0x340edcf4
je 0x18000314f
jmp 0x180002f7a
mov eax, dword [rsp + 0x30]
sub eax, 0x34753b30
je 0x180003709
jmp 0x180002f8e
mov eax, dword [rsp + 0x30]
sub eax, 0x39894479
je 0x18000386d
jmp 0x180002fa2
mov eax, dword [rsp + 0x30]
sub eax, 0x41aca0dd
je 0x18000351d
jmp 0x180002fb6
mov eax, dword [rsp + 0x30]
sub eax, 0x4dab1643
je 0x1800031ae
jmp 0x180002fca
mov eax, dword [rsp + 0x30]
sub eax, 0x5b92bd09
je 0x180003829
jmp 0x180002fde
mov eax, dword [rsp + 0x30]
sub eax, 0x69302cc1
je 0x1800032f6
jmp 0x180002ff2
mov eax, dword [rsp + 0x30]
sub eax, 0x77fe58cd
je 0x18000327b
jmp 0x180003006
mov eax, dword [rsp + 0x30]
sub eax, 0x781a8e5c
je 0x180003298
jmp 0x18000301a
mov eax, dword [rsp + 0x30]
sub eax, 0x7b895436
je 0x180003378
jmp 0x18000302e
jmp 0x1800038d3
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
mov edx, ecx
sub edx, 0x6c49a2e3
sub edx, 1
add edx, 0x6c49a2e3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xabf4d365
mov ecx, 0xe341375c
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov dword [rsp + 0x84], 0x64
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
mov edx, ecx
add edx, 0x4f502f74
sub edx, 1
sub edx, 0x4f502f74
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xabf4d365
mov ecx, 0xb3b532b1
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov dword [rsp + 0x34], 0x340edcf4
jmp 0x1800038d3
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x84]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x34], 0x32d4b2fa
jmp 0x1800038d3
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x34], 0x4dab1643
jmp 0x1800038d3
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x34], 0x2308f277
jmp 0x1800038d3
mov eax, dword [0x1800d2c84]
mov ecx, dword [0x1800d2c80]
mov edx, eax
sub edx, 0x4bb1554f
sub edx, 1
add edx, 0x4bb1554f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x39894479
mov ecx, 0xad74c3d2
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
cmp rax, rcx
setne al
and al, 1
mov byte [rsp + 0x77], al
mov eax, dword [0x1800d2c84]
mov ecx, dword [0x1800d2c80]
mov edx, eax
sub edx, 0x5d907a27
sub edx, 1
add edx, 0x5d907a27
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x39894479
mov ecx, 0x77fe58cd
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov dl, byte [rsp + 0x77]
mov eax, 0xe23c1193
mov ecx, 0x781a8e5c
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0xf244e834
jmp 0x1800038d3
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x34], 0x1c58e573
jmp 0x1800038d3
lea rcx, [rsp + 0xb0]
mov rdx, qword [rsp + 0x78]
call fcn.18009e890
mov edx, eax
mov eax, 0x41aca0dd
mov ecx, 0x69302cc1
cmp edx, 0
cmove eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
mov edx, ecx
add edx, 0x5d31fb57
sub edx, 1
sub edx, 0x5d31fb57
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x95bc2bc
mov ecx, 0x7b895436
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov byte [rsp + 0x5f], 1
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
mov edx, ecx
sub edx, 0x58ad2067
sub edx, 1
add edx, 0x58ad2067
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x95bc2bc
mov ecx, 0xe79f394a
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov dword [rsp + 0x34], 0xa6c911aa
jmp 0x1800038d3
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
mov edx, ecx
add edx, 0xf193b398
sub edx, 1
sub edx, 0xf193b398
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a2cb2b9
mov ecx, 0xa04e488c
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
mov edx, ecx
add edx, 0xc524b45e
sub edx, 1
sub edx, 0xc524b45e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a2cb2b9
mov ecx, 0x788c4eb
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov dword [rsp + 0x34], 0x33958ba8
jmp 0x1800038d3
mov eax, dword [0x1800d2c84]
mov ecx, dword [0x1800d2c80]
mov edx, eax
add edx, 0x52080bb0
sub edx, 1
sub edx, 0x52080bb0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x27b11b31
mov ecx, 0xa1501019
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
mov edx, ecx
sub edx, 0x7a98efe2
sub edx, 1
add edx, 0x7a98efe2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x27b11b31
mov ecx, 0xab076583
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov dword [rsp + 0x34], 0x20f862b9
jmp 0x1800038d3
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc01a0d18
mov ecx, 0x339a7506
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov rax, qword [rsp + 0x48]
add rax, 8
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
mov edx, ecx
add edx, 0x91843a68
sub edx, 1
sub edx, 0x91843a68
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc01a0d18
mov ecx, 0x34753b30
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov dword [rsp + 0x34], 0xbbe71e92
jmp 0x1800038d3
mov dword [rsp + 0x34], 0x32d4b2fa
jmp 0x1800038d3
mov byte [rsp + 0x5f], 0
mov dword [rsp + 0x34], 0xac5d6be9
jmp 0x1800038d3
mov dword [rsp + 0x34], 0x33958ba8
jmp 0x1800038d3
mov eax, dword [0x1800d2c84]
mov ecx, dword [0x1800d2c80]
mov edx, eax
sub edx, 0xcbf87cdb
sub edx, 1
add edx, 0xcbf87cdb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2f6621f0
mov ecx, 0x8b83931c
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov al, byte [rsp + 0x5f]
and al, 1
mov byte [rsp + 0x83], al
mov ecx, dword [0x1800d2c84]
mov eax, dword [0x1800d2c80]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2f6621f0
mov ecx, 0xabf6dc4b
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x1800038d3
mov dword [rsp + 0x34], 0x5b92bd09
jmp 0x1800038d3
mov al, byte [rsp + 0x83]
and al, 1
movzx eax, al
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800951a0
mov eax, dword [rsp + 0x2c]
add rsp, 0x158
ret
mov dword [rsp + 0x84], 0x64
mov dword [rsp + 0x34], 0xe341375c
jmp 0x1800038d3
mov rax, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x34], 0xad74c3d2
jmp 0x1800038d3
mov byte [rsp + 0x5f], 1
mov dword [rsp + 0x34], 0x7b895436
jmp 0x1800038d3
mov dword [rsp + 0x34], 0xa04e488c
jmp 0x1800038d3
mov dword [rsp + 0x34], 0xa1501019
jmp 0x1800038d3
mov rax, qword [rsp + 0x48]
add rax, 8
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x34], 0x339a7506
jmp 0x1800038d3
mov dword [rsp + 0x34], 0x8b83931c
jmp 0x180002d32