Function at 0x180004030
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r13
lea rbp, [rsp - 0x128]
sub rsp, 0x228
lea rdx, [rbp + 0x150]
mov dword [rbp + 0x150], 0x101
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x10]
movups xmmword [rsp + 0x40], xmm0
inc r8
cmp byte [rax + r8], 0
jne 0x180004081
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x40]
call fcn.180004450
mov r13, qword [rsp + 0x50]
movabs rax, 0x7ffffffffffffff9
movzx r8d, word [0x18012af90]
xorps xmm0, xmm0
mov edx, dword [str.User:]
mov dword [rbp + 0x148], edx
mov word [rbp + 0x140], r8w
cmp r13, rax
ja 0x18000431f
mov qword [rsp + 0x258], rbx
xorps xmm1, xmm1
mov qword [rsp + 0x220], rsi
mov ebx, 0xf
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x218], rdi
lea rdi, [rsp + 0x20]
mov qword [rsp + 0x210], r12
lea r12, [rsp + 0x40]
mov qword [rsp + 0x208], r14
mov r14, qword [rsp + 0x58]
cmp r14, 0xf
mov qword [rsp + 0x200], r15
lea r15, [r13 + 6]
cmova r12, rsi
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
cmp r15, rbx
jbe 0x1800041db
mov rax, r15
or rax, rbx
movabs rbx, 0x7fffffffffffffff
cmp rax, rbx
jbe 0x18000418c
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180109490
test rax, rax
je 0x1800042d5
mov edx, dword [rbp + 0x148]
lea rdi, [rax + 0x27]
movzx r8d, word [rbp + 0x140]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800041d6
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800041b7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004325
jmp 0x18000415f
test rcx, rcx
je 0x1800041d4
call fcn.180109490
mov edx, dword [rbp + 0x148]
mov rdi, rax
movzx r8d, word [rbp + 0x140]
jmp 0x1800041d6
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r15
lea rcx, [rdi + 6]
mov qword [rsp + 0x38], rbx
mov dword [rdi], edx
mov rdx, r12
mov word [rdi + 4], r8w
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
xorps xmm0, xmm0
mov byte [rdi + r15], 0
cmp qword [rsp + 0x38], 0xf
lea rax, [rsp + 0x20]
movups xmmword [rsp + 0x60], xmm0
cmova rax, qword [rsp + 0x20]
lea rbx, [0x18012af88]
xor ecx, ecx
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rbx
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x80], rbx
mov qword [rsp + 0x70], rax
call fcn.180006560
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180004297
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004292
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800042d5
call fcn.18010983c
movdqa xmm0, xmmword [0x180285140]
mov byte [rsp + 0x20], 0
movdqu xmmword [rsp + 0x30], xmm0
cmp r14, 0xf
jbe 0x1800042e4
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800042dc
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800042dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.18010983c
mov r14, qword [rsp + 0x208]
mov r12, qword [rsp + 0x210]
mov rdi, qword [rsp + 0x218]
mov rsi, qword [rsp + 0x220]
mov rbx, qword [rsp + 0x258]
mov r15, qword [rsp + 0x200]
add rsp, 0x228
pop r13
pop rbp
ret
call fcn.180003f60
int3
call fcn.180003ec0
int3