Function at 0x18000ad00
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x310
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800a21e8]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r14, rcx
movdqa xmm0, xmmword [0x1800783e0]
movdqu xmmword [rbp - 0x80], xmm0
xor r15d, r15d
mov word [rsp + 0x70], r15w
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.180048640
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x1800783e0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x50]
call fcn.1800041c0
nop
lea rcx, [rbp - 0x30]
call fcn.1800082d0
nop
cmp byte [r14 + 0xd0], r15b
jne 0x18000af0b
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call fcn.180007680
test al, al
je 0x18000af0b
xor r8d, r8d
lea edx, [r15 + 0x1a]
lea rcx, [rsp + 0x30]
call fcn.1800081f0
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x18000ae36
lea rcx, [rsp + 0x70]
call fcn.180003f60
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000ae78
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ae73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4d1
call fcn.18002a370
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x30]
call fcn.1800081f0
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x18000aec1
lea rcx, [rsp + 0x50]
call fcn.180003f60
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000b0af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b0aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4cb
jmp 0x18000b0aa
lea rcx, [rsp + 0x30]
call fcn.180008490
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x30]
call fcn.180004040
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
lea r9, str.AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x70]
call fcn.180006ae0
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x18000af8c
lea rcx, [rsp + 0x70]
call fcn.180003f60
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4d7
call fcn.18002a370
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x70]
call fcn.180006ae0
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x18000b02c
lea rcx, [rsp + 0x50]
call fcn.180003f60
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000b06d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b067
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4dd
call fcn.18002a370
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000b0af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b0aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4e3
call fcn.18002a370
lea rbx, [r14 + 0x70]
lea rax, [rsp + 0x70]
cmp rbx, rax
je 0x18000b0d9
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
mov rcx, rbx
call fcn.1800041c0
lea rdi, [r14 + 0x90]
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x18000b108
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1800041c0
mov rcx, rbx
call fcn.180007600
test eax, eax
jne 0x18000b127
lea r8d, [rax + 1]
lea rdx, [0x18007836c]
mov rcx, rbx
call fcn.180004040
mov rcx, rdi
call fcn.180007600
test eax, eax
jne 0x18000b146
lea r8d, [rax + 1]
lea rdx, [0x18007836c]
mov rcx, rdi
call fcn.180004040
lea rdx, str.SOFT_NAME_EN
lea rcx, [rbp - 0x70]
call fcn.18000fb70
nop
cmp qword [rax + 0x18], 8
jb 0x18000b161
mov rax, qword [rax]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000b16e
mov r8, qword [rbx]
mov r9, rax
lea rdx, str._s_s_
lea rcx, [rsp + 0x30]
call fcn.180007120
mov rsi, rax
lea rdi, [r14 + 0x30]
cmp rdi, rax
je 0x18000b1b4
mov rcx, rdi
call fcn.180003f60
movups xmm0, xmmword [rsi]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 7
mov word [rsi], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000b1f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b1f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4e9
call fcn.18002a370
movdqa xmm0, xmmword [0x1800783e0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000b24a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b245
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4ef
call fcn.18002a370
cmp qword [rdi + 0x18], 8
jb 0x18000b254
mov rdi, qword [rdi]
mov rcx, rdi
call fcn.180007e60
lea rdx, str.APPDATA_RETAIN_FOLDER
lea rcx, [rbp - 0x70]
call fcn.18000fb70
nop
cmp qword [rax + 0x18], 8
jb 0x18000b277
mov rax, qword [rax]
cmp qword [rbx + 0x18], 8
jb 0x18000b281
mov rbx, qword [rbx]
mov r9, rax
mov r8, rbx
lea rdx, str._s_s_
lea rcx, [rsp + 0x30]
call fcn.180007120
mov rdi, rax
lea rbx, [r14 + 0x50]
cmp rbx, rax
je 0x18000b2ca
mov rcx, rbx
call fcn.180003f60
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000b30c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b307
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4f5
call fcn.18002a370
movdqa xmm0, xmmword [0x1800783e0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000b360
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b35b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4fb
call fcn.18002a370
cmp qword [rbx + 0x18], 8
jb 0x18000b36a
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.180007e60
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18000b3b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b3ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b501
call fcn.18002a370
movdqa xmm0, xmmword [0x1800783e0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000b405
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b400
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b507
call fcn.18002a370
movdqa xmm0, xmmword [0x1800783e0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000b45a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b454
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b50d
call fcn.18002a370
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000b497
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b492
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b4c5
call fcn.18002a370
mov al, 1
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.18002a480
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
int3
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
int3