Function at 0x1400aa1e0
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x20], 2
test rdx, rdx
jne 0x1400aa22b
lea eax, [rdx + 2]
jmp 0x1400aa55a
call fcn.1400a7590
nop
mov rsi, qword [r15 + 8]
test rsi, rsi
je 0x1400aa23f
xor r14d, r14d
jmp 0x1400aa279
mov ecx, 0x18
call fcn.1400dba80
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400aa273
mov r9d, reloc.WS2_32.dll_sendto
xor r8d, r8d
lea rdx, [0x140285c9d]
mov rcx, rax
call fcn.1400a6730
mov rsi, rax
xor r14d, r14d
jmp 0x1400aa279
xor r14d, r14d
mov esi, r14d
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rdi + 0x168]
call fcn.140141ad0
mov dword [rdi + 0x20], 1
mov dword [rdi + 0x168], r14d
mov dword [rdi + 0x16c], 0xff231ac2
mov dword [rdi + 0x170], 0x60000
xor ecx, ecx
call fcn.1401541c8
mov dword [rdi + 0x20c], eax
mov eax, dword [r15 + 0x10]
mov dword [rdi + 0x184], eax
mov ecx, dword [r15 + 0x10]
call fcn.1400a9aa0
mov dword [rdi + 0x188], eax
mov dword [rdi + 0x21c], r14d
mov dword [rdi + 0x220], r14d
mov dword [rdi + 0x244], 2
mov dword [rsp + 0x24], r14d
lea rdx, str._default_
lea rcx, [rdi + 0x18c]
mov r8, rdi
sub r8, rdx
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx + 0x18c], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400aa310
mov dword [rsp + 0x24], 0x80
lea rdx, [rsp + 0x24]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DISPLAY
call qword [sym.imp.GDI32.dll_CreateDCA]
mov rbx, rax
mov rcx, rax
cmp dword [r15 + 0x1c], 0
je 0x1400aa39e
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.1400fbb50
mov ecx, dword [rsp + 0x28]
mov dword [rdi + 0x214], ecx
mov ecx, dword [rsp + 0x2c]
mov dword [rdi + 0x218], ecx
mov ecx, 0x50
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rdi + 0x240], eax
test eax, eax
jne 0x1400aa3cd
jmp 0x1400aa3c3
mov edx, 0x76
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rdi + 0x214], eax
mov edx, 0x75
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rdi + 0x218], eax
mov dword [rdi + 0x240], 1
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [r15]
mov ecx, edx
sub ecx, 0x70
je 0x1400aa3f6
cmp ecx, 1
je 0x1400aa3ed
mov dword [rdi + 0x248], edx
jmp 0x1400aa42f
mov dword [rdi + 0x248], r14d
jmp 0x1400aa42f
xor edx, edx
mov rcx, rsi
call fcn.1400a9b00
test rax, rax
jne 0x1400aa424
mov rcx, rsi
call fcn.140030180
test rax, rax
je 0x1400aa41f
mov rcx, rsi
call fcn.140030180
cmp byte [rax], 0
je 0x1400aa424
mov eax, r14d
jmp 0x1400aa429
call fcn.1400a86b0
mov dword [rdi + 0x248], eax
xor edx, edx
mov rcx, rsi
call fcn.1400a9b00
test rax, rax
jne 0x1400aa466
mov rcx, rsi
call fcn.140030180
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.1400a8580
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.1400abb50
mov ecx, dword [rdi + 0x248]
test ecx, ecx
jne 0x1400aa47d
mov rdx, rsi
mov rcx, rdi
call fcn.1400aa870
jmp 0x1400aa4c1
mov ebx, 9
mov dword [rsp + 0x20], ebx
call fcn.1400a8520
mov qword [rdi + 0x368], rax
test rax, rax
je 0x1400aa4de
mov rcx, rsi
call fcn.14001d070
mov rbx, rax
xor edx, edx
mov rcx, rsi
call fcn.1400a9b00
mov rdx, rax
xor r9d, r9d
mov r8d, ebx
mov rcx, qword [rdi + 0x368]
call fcn.1400f4e30
mov r8d, dword [rdi + 0x248]
lea rdx, [rdi + 0x224]
mov rcx, rsi
call fcn.1400a8700
mov ebx, r14d
mov dword [rsp + 0x20], ebx
mov dword [rdi + 0x338], r14d
mov qword [rdi + 0x340], r14
mov qword [rdi + 0x348], r14
mov dword [rdi + 0x354], r14d
mov dword [rdi + 0x350], r14d
test ebx, ebx
jne 0x1400aa524
mov rcx, rdi
call fcn.1400a74c0
mov rcx, rdi
call fcn.1400ac200
mov ebx, 2
test eax, eax
cmovne ebx, r14d
mov dword [rsp + 0x20], ebx
test rsi, rsi
je 0x1400aa545
cmp rsi, qword [r15 + 8]
je 0x1400aa545
mov rcx, rsi
call fcn.1400a6930
mov edx, 0x18
mov rcx, rsi
call fcn.1401139ac
nop
jmp 0x1400aa550
mov rcx, rdi
call fcn.1400abb30
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret