Function at 0x140016b40
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x358]
sub rsp, 0x430
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14002c028]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov rsi, rcx
mov qword [rbp - 0x78], rcx
xor r12d, r12d
mov dword [rbp - 0x48], r12d
lea r15, str.NONE
cmp r15, rcx
je 0x140016beb
mov r9, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x140016ba6
mov r9, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov rax, qword [0x14002c380]
cmp rdi, rax
ja 0x140016be0
mov rbx, r15
cmp rax, 0x10
cmovae rbx, qword [str.NONE]
mov qword [0x14002c378], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140016beb
mov rdx, rdi
mov rcx, r15
call fcn.140001b30
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
mov r14, r12
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x50], rax
lea rdx, [0x140024f24]
lea rcx, [rbp - 0x70]
call fcn.1400019d0
mov rbx, rax
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.14000cf70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002020
mov rbx, r12
mov rdi, r12
lea rcx, [rbp - 0x38]
cmp rcx, rax
je 0x140016c6c
mov rdi, qword [rax]
mov r15, rdi
mov qword [rbp - 0x38], rdi
mov rbx, qword [rax + 8]
mov r13, rbx
mov qword [rbp - 0x30], rbx
mov r14, qword [rax + 0x10]
mov qword [rbp - 0x28], r14
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
jmp 0x140016c74
mov r13, qword [rbp - 0x30]
mov r15, qword [rbp - 0x38]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140016cc6
mov rdx, qword [rsp + 0x48]
call fcn.14000e520
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016cc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140016cc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
sub rbx, rdi
and rbx, 0xffffffffffffffe0
lea r9, [rbx - 0x20]
add r9, r15
cmp qword [r9 + 0x18], 0x10
jb 0x140016cde
mov r9, qword [r9]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140016ce5
mov rax, qword [0x14002c240]
cmp rbx, rax
ja 0x140016d29
lea rdi, [0x14002c228]
cmp rax, 0x10
cmovae rdi, qword [0x14002c228]
mov qword [0x14002c238], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x140016d38
mov rdx, rbx
lea rcx, [0x14002c228]
call fcn.140001b30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140024c18]
mov qword [rbp], rax
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp - 0x48], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 8], rax
xor edi, edi
mov qword [rbp + 0x70], rdi
mov dword [rbp + 0x78], 4
mov edx, ebx
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], dil
mov dword [rbp - 0x48], 5
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov ecx, dword [rbp + 0x78]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140016e31
mov rax, qword [rbp + 0x48]
mov rbx, qword [rax]
test rbx, rbx
je 0x140016e31
mov rax, qword [rbp + 0x28]
mov r9, qword [rax]
cmp rbx, qword [rbp + 0x70]
cmovb rbx, qword [rbp + 0x70]
sub rbx, r9
jmp 0x140016e56
test cl, 4
jne 0x140016e87
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140016e87
mov rax, qword [rbp + 0x20]
mov r9, qword [rax]
mov rax, qword [rbp + 0x58]
movsxd rbx, dword [rax]
sub rbx, r9
add rbx, rcx
mov rax, r9
test rax, rax
je 0x140016e87
lea rcx, [rbp - 0x70]
cmp rbx, 0xf
ja 0x140016e7e
mov qword [rbp - 0x60], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x70], 0
jmp 0x140016e87
mov rdx, rbx
call fcn.140001b30
nop
mov rdx, qword [0x14002c2a0]
cmp rdx, 0x10
jb 0x140016ec8
mov rcx, qword [0x14002c288]
inc rdx
cmp rdx, 0x1000
jb 0x140016ec3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001702b
mov rcx, r8
call fcn.14001f0bc
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [0x14002c288], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [0x14002c298], xmm1
mov dword [rbp - 0x40], 0x101
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r12, [0x14002c3a8]
test eax, eax
je 0x140017037
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x70]
call fcn.14000cb40
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000cc90
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400021f0
mov rbx, rax
cmp r12, rax
je 0x140016fb3
mov rdx, qword [0x14002c3c0]
cmp rdx, 0x10
jb 0x140016f76
mov rcx, qword [0x14002c3a8]
inc rdx
cmp rdx, 0x1000
jb 0x140016f71
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140016fe7
mov rcx, r8
call fcn.14001f0bc
mov qword [0x14002c3b8], rdi
mov qword [0x14002c3c0], 0xf
mov byte [0x14002c3a8], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x14002c3a8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14002c3b8], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140016ff4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016fee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140016fee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140017037
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017032
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017032
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
mov qword [rbp - 0x80], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x80]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140017091
mov dword [rbp - 0x48], 4
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x50]
lea edx, [r9 + 0x10]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [0x14002d0a8]
test eax, eax
cmovne ecx, dword [rbp - 0x50]
mov dword [0x14002d0a8], ecx
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400170a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call fcn.140005480
mov rbx, rax
lea rax, [0x14002d0b0]
cmp rax, rbx
je 0x140017151
mov rcx, qword [0x14002d0b0]
test rcx, rcx
je 0x140017126
mov rdx, qword [0x14002d0b8]
call fcn.14000e520
mov rcx, qword [0x14002d0b0]
mov rdx, qword [0x14002d0c0]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x14001710f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140017197
mov rcx, r8
call fcn.14001f0bc
mov qword [0x14002d0b0], rdi
xorps xmm0, xmm0
movdqu xmmword [0x14002d0b8], xmm0
mov rax, qword [rbx]
mov qword [0x14002d0b0], rax
mov rax, qword [rbx + 8]
mov qword [0x14002d0b8], rax
mov rax, qword [rbx + 0x10]
mov qword [0x14002d0c0], rax
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400171a3
mov rdx, qword [rsp + 0x48]
call fcn.14000e520
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001719e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001719e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
lea rcx, [rbp - 0x70]
call fcn.140005260
mov rbx, rax
lea rax, [0x14002c328]
cmp rax, rbx
je 0x140017233
mov rdx, qword [0x14002c340]
cmp rdx, 0x10
jb 0x1400171f8
mov rcx, qword [0x14002c328]
inc rdx
cmp rdx, 0x1000
jb 0x1400171f3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140017265
mov rcx, r8
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [0x14002c338], xmm0
mov byte [0x14002c328], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x14002c328], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14002c338], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140017271
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001726c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001726c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rdx, str.STATUS
lea rcx, [rsp + 0x60]
call fcn.1400019d0
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140006f80
nop
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
lea rbx, [0x14002c268]
cmp rbx, rcx
je 0x140017300
mov r9, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x1400172bc
mov r9, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov rax, qword [0x14002c280]
cmp rdi, rax
ja 0x1400172f3
cmp rax, 0x10
cmovae rbx, qword [0x14002c268]
mov qword [0x14002c278], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x1400172fe
mov rdx, rdi
mov rcx, rbx
call fcn.140001b30
xor edi, edi
lea rdx, [0x14002424c]
lea rcx, [rsp + 0x40]
call fcn.1400019d0
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400090b0
mov rbx, rax
lea rax, [0x14002c2c8]
cmp rax, rbx
je 0x1400173a4
mov rdx, qword [0x14002c2e0]
cmp rdx, 0x10
jb 0x140017369
mov rcx, qword [0x14002c2c8]
inc rdx
cmp rdx, 0x1000
jb 0x140017364
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400173d6
mov rcx, r8
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [0x14002c2d8], xmm0
mov byte [0x14002c2c8], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x14002c2c8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14002c2d8], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1400173e2
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400173dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400173dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
mov rcx, qword [0x14002c3b8]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rax, 9
jb 0x1400179c9
mov rax, r12
cmp qword [0x14002c3c0], 0x10
cmovae rax, qword [0x14002c3a8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp - 0x70]
call fcn.14000f020
nop
mov r8d, 0x16
lea rdx, str.AppDataLocalService
lea rcx, [rbp - 0x70]
call fcn.14000d5f0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x14002c1a0]
cmp rdx, 0x10
jb 0x1400174a3
mov rcx, qword [0x14002c188]
inc rdx
cmp rdx, 0x1000
jb 0x14001749e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400174ea
mov rcx, r8
call fcn.14001f0bc
movups xmmword [0x14002c188], xmm6
movups xmmword [0x14002c198], xmm7
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1400174f6
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400174f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400174f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14001f0bc
mov rcx, qword [0x14002c198]
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x1400179cf
lea r9, [0x14002c188]
cmp qword [0x14002c1a0], 0x10
cmovae r9, qword [0x14002c188]
mov qword [rsp + 0x30], 1
lea rax, [0x140024f24]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x70]
call fcn.14000f020
nop
lea rdx, [0x14002c1a8]
lea rcx, [rbp - 0x70]
call fcn.14000cdc0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x14002c300]
cmp rdx, 0x10
jb 0x1400175ab
mov rcx, qword [0x14002c2e8]
inc rdx
cmp rdx, 0x1000
jb 0x1400175a6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400175f2
mov rcx, r8
call fcn.14001f0bc
movups xmmword [0x14002c2e8], xmm6
movups xmmword [0x14002c2f8], xmm7
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1400175fe
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400175f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400175f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14001f0bc
mov rcx, qword [0x14002c3b8]
mov rax, rbx
sub rax, rcx
cmp rax, 9
jb 0x1400179d5
mov rax, r12
cmp qword [0x14002c3c0], 0x10
cmovae rax, qword [0x14002c3a8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x40]
call fcn.14000f020
nop
mov r8d, 0x3f
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_
lea rcx, [rsp + 0x40]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x14002c1a8]
lea rcx, [rbp - 0x70]
call fcn.14000cdc0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x14002c220]
cmp rdx, 0x10
jb 0x1400176f4
mov rcx, qword [0x14002c208]
inc rdx
cmp rdx, 0x1000
jb 0x1400176ef
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001773b
mov rcx, r8
call fcn.14001f0bc
movups xmmword [0x14002c208], xmm6
movups xmmword [0x14002c218], xmm7
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140017747
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017742
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017742
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140017798
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017793
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017793
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
mov rax, qword [0x14002c3b8]
sub rbx, rax
cmp rbx, 9
jb 0x1400179c3
cmp qword [0x14002c3c0], 0x10
cmovae r12, qword [0x14002c3a8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp - 0x70]
call fcn.14000f020
nop
mov r8d, 0x1c
lea rdx, str.AppDataLocalStoryStopReal
lea rcx, [rbp - 0x70]
call fcn.14000d5f0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x14002c360]
cmp rdx, 0x10
jb 0x140017849
mov rcx, qword [0x14002c348]
inc rdx
cmp rdx, 0x1000
jb 0x140017844
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140017890
mov rcx, r8
call fcn.14001f0bc
movups xmmword [0x14002c348], xmm6
movups xmmword [0x14002c358], xmm7
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14001789d
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017897
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017897
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14001f0bc
nop
lea rcx, [rbp - 0x20]
call fcn.14000d340
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0x88]
mov dword [rbp + rcx - 4], r8d
lea rcx, [rbp + 8]
call fcn.14000b950
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
test r15, r15
je 0x14001793b
mov rdx, r13
mov rcx, r15
call fcn.14000e520
sub r14, r15
and r14, 0xffffffffffffffe0
mov rax, r15
cmp r14, 0x1000
jb 0x14001792f
add r14, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001792f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, r15
call fcn.14001f0bc
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140017971
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14001796c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400179bc
mov rcx, r8
call fcn.14001f0bc
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov al, 1
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.14001f060
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001940
nop
call fcn.140001940
int3
call fcn.140001940
int3
call fcn.140001940
int3