Function at 0x18000bb70
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x268]
sub rsp, 0x340
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800900b0]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r15, rcx
movdqa xmm0, xmmword [0x18006c680]
movdqu xmmword [rbp - 0x70], xmm0
xor r12d, r12d
mov word [rbp - 0x80], r12w
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x20]
call fcn.18003eed0
mov dword [rsp + 0x30], 0x104
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x30]
movdqa xmm0, xmmword [0x18006c680]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.180005be0
nop
lea rcx, [rbp - 0x40]
call fcn.180007d30
nop
cmp byte [r15 + 0xd0], r12b
jne 0x18000bd77
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
call fcn.180006fd0
test al, al
je 0x18000bd77
xor r8d, r8d
lea edx, [r12 + 0x1a]
lea rcx, [rsp + 0x40]
call fcn.180007c10
mov rbx, rax
lea rax, [rbp - 0x80]
cmp rax, rbx
je 0x18000bca2
lea rcx, [rbp - 0x80]
call fcn.180005b70
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000bce4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bcdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c2db
call fcn.18001f4e0
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x40]
call fcn.180007c10
mov rbx, rax
lea rax, [rsp + 0x60]
cmp rax, rbx
je 0x18000bd2d
lea rcx, [rsp + 0x60]
call fcn.180005b70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000bf6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bf6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c2e1
jmp 0x18000bf6a
lea rcx, [rsp + 0x40]
call fcn.180007e00
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x42
jb 0x18000bdcd
lea rdi, [rcx + 0x42]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov r8d, 0x84
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
call fcn.18003e0a0
mov word [rbx + rdi*2], r12w
jmp 0x18000bdf0
xor eax, eax
mov qword [rsp + 0x20], 0x42
lea r9, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
movzx r8d, al
lea edx, [rax + 0x42]
lea rcx, [rsp + 0x40]
call fcn.180005680
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea r9, str.AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x20]
call fcn.180005a20
mov rbx, rax
lea rax, [rbp - 0x80]
cmp rax, rbx
je 0x18000be4c
lea rcx, [rbp - 0x80]
call fcn.180005b70
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18000be8c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000be87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c2e7
call fcn.18001f4e0
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x20]
call fcn.180005a20
mov rbx, rax
lea rax, [rsp + 0x60]
cmp rax, rbx
je 0x18000beec
lea rcx, [rsp + 0x60]
call fcn.180005b70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18000bf2d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bf27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c2ed
call fcn.18001f4e0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000bf6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bf6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c2f3
call fcn.18001f4e0
lea rbx, [r15 + 0x50]
lea rax, [rbp - 0x80]
cmp rbx, rax
je 0x18000bf96
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, rbx
call fcn.180005be0
lea rdi, [r15 + 0x70]
lea rax, [rsp + 0x60]
cmp rdi, rax
je 0x18000bfc2
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
mov rcx, rdi
call fcn.180005be0
mov rcx, rbx
call fcn.180006c70
test eax, eax
jne 0x18000c034
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18000c013
lea r14, [rcx + 1]
mov qword [rbx + 0x10], r14
mov rsi, rbx
cmp rdx, 8
jb 0x18000bff6
mov rsi, qword [rbx]
lea rcx, [rsi + rcx*2]
mov r8d, 2
lea rdx, [0x18006c610]
call fcn.18003e0a0
mov word [rsi + r14*2], r12w
jmp 0x18000c034
xor eax, eax
mov qword [rsp + 0x20], 1
lea r9, [0x18006c610]
movzx r8d, al
lea edx, [rax + 1]
mov rcx, rbx
call fcn.180005680
mov rcx, rdi
call fcn.180006c70
test eax, eax
jne 0x18000c0a3
mov rcx, qword [rdi + 0x10]
mov r9, qword [rdi + 0x18]
mov rax, r9
sub rax, rcx
cmp rax, 1
jb 0x18000c082
lea rsi, [rcx + 1]
mov qword [rdi + 0x10], rsi
cmp r9, 8
jb 0x18000c065
mov rdi, qword [rdi]
lea rcx, [rdi + rcx*2]
mov r8d, 2
lea rdx, [0x18006c610]
call fcn.18003e0a0
mov word [rdi + rsi*2], r12w
jmp 0x18000c0a3
xor eax, eax
mov qword [rsp + 0x20], 1
lea r9, [0x18006c610]
movzx r8d, al
lea edx, [rax + 1]
mov rcx, rdi
call fcn.180005680
lea r9, [r15 + 0xb0]
cmp qword [r9 + 0x18], 8
jb 0x18000c0b4
mov r9, qword [r9]
cmp qword [rbx + 0x18], 8
jb 0x18000c0be
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str._s_s_
lea rcx, [rbp - 0x20]
call fcn.1800069f0
mov rdi, rax
lea rbx, [r15 + 0x30]
cmp rbx, rax
je 0x18000c103
mov rcx, rbx
call fcn.180005b70
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18000c143
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c13e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c2f9
call fcn.18001f4e0
mov qword [rbp + 0x18], r12
cmp qword [rbx + 0x18], 8
jb 0x18000c151
mov rbx, qword [rbx]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.180007a10
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x18000c178
mov rax, qword [rcx]
lea rdx, [rbp - 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18000c1b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c1b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c2ff
call fcn.18001f4e0
movdqa xmm0, xmmword [0x18006c680]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r12w
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18000c20a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c205
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c305
call fcn.18001f4e0
movdqa xmm0, xmmword [0x18006c680]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000c25e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c259
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c30b
call fcn.18001f4e0
movdqa xmm0, xmmword [0x18006c680]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000c2ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c2a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c311
call fcn.18001f4e0
mov al, 1
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.18001fcf0
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
int3
call fcn.180041e0c
nop
call fcn.180041e0c
int3
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
int3