Function at 0x1400225c0
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x98
movabs r9, 0x4f005201de7490
mov byte [rsp + 0x70], 5
movzx eax, byte [rsp + 0x70]
movzx r8d, al
movabs rax, 0x4f005201de7581
xor edx, edx
div r8
mov byte [rsp + 0x2f], dl
movzx eax, byte [rsp + 0x2f]
movzx eax, al
movabs rdx, 0x8f6e22925bbf1754
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2f]
movzx eax, al
lea rdx, [r9 + 0xf1]
lea r8, [rsp + 0x30]
cmp qword [rsp + rax + 0x30], rdx
jne 0x140022635
cmp r8, 0x4000
ja 0x14002262e
movabs eax, dword [0xf35eb2f2444b60f]
mov dh, 0x44
and al, 0x2f
movzx eax, byte [rsp + 0x2f]
jmp 0x14002266a
movzx eax, byte [rsp + 0x2f]
mov byte [rsp + 0x2d], al
inc byte [rsp + 0x2d]
movzx eax, byte [rsp + 0x2f]
movzx eax, al
cmp qword [rsp + rax + 0x30], r9
je 0x140022655
dec byte [rsp + 0x2d]
lea rax, [rsp + 0x2d]
cmp rax, 0x4000
ja 0x140022665
mov ebx, 0xb60f31f1
and al, 0x2d
movzx eax, byte [rsp + 0x2d]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
movabs r9, 0x5f004701e8b43a
movabs rdx, 0x70e0ddbfa492e8f1
add rdx, rax
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x2f], 7
movzx eax, byte [rsp + 0x2f]
movzx r10d, al
movabs rax, 0x5f004701e8b52b
xor edx, edx
div r10
mov byte [rsp + 0x2d], dl
movzx eax, byte [rsp + 0x2d]
movzx eax, al
movabs rdx, 0xf55f426be6f7bc24
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2d]
movzx eax, al
lea rdx, [r9 + 0xf1]
cmp qword [rsp + rax + 0x30], rdx
jne 0x1400226ed
cmp r8, 0x476a
ja 0x1400226e6
jmp 0x16446dcf9
movzx eax, byte [rsp + 0x2d]
jmp 0x140022722
movzx eax, byte [rsp + 0x2d]
mov byte [rsp + 0x2e], al
inc byte [rsp + 0x2e]
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], r9
je 0x14002270d
dec byte [rsp + 0x2e]
lea rax, [rsp + 0x2e]
cmp rax, 0x476a
ja 0x14002271d
mov ebx, 0xb60f31f1
and al, 0x2e
movzx eax, byte [rsp + 0x2e]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
movabs r9, 0x25005f01db8ee1
movabs rdx, 0xaffbddb1967442e
add rdx, rax
mov qword [rsp + 0x78], rdx
mov byte [rsp + 0x2f], 2
movzx eax, byte [rsp + 0x2f]
movzx r10d, al
movabs rax, 0x25005f01db8fd2
xor edx, edx
div r10
mov byte [rsp + 0x2d], dl
movzx eax, byte [rsp + 0x2d]
movzx eax, al
movabs rdx, 0xa41c20868608962
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2d]
movzx eax, al
lea rdx, [r9 + 0xf1]
cmp qword [rsp + rax + 0x30], rdx
jne 0x1400227a5
cmp r8, 0x35f1
ja 0x14002279e
jmp 0x16446ddb1
movzx eax, byte [rsp + 0x2d]
jmp 0x1400227da
movzx eax, byte [rsp + 0x2d]
mov byte [rsp + 0x2e], al
inc byte [rsp + 0x2e]
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], r9
je 0x1400227c5
dec byte [rsp + 0x2e]
lea rax, [rsp + 0x2e]
cmp rax, 0x35f1
ja 0x1400227d5
mov ebx, 0xb60f31f1
and al, 0x2e
movzx eax, byte [rsp + 0x2e]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
movabs rdx, 0xf5e33e5697ed76f3
add rdx, rax
mov qword [rsp + 0x80], rdx
mov byte [rsp + 0x2f], 5
movzx eax, byte [rsp + 0x2f]
movzx r9d, al
mov eax, 0x191da59
xor edx, edx
div r9d
mov byte [rsp + 0x2d], dl
movzx eax, byte [rsp + 0x2d]
movzx eax, al
movabs rdx, 0x77a231845e930
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], 0x191da59
jne 0x14002284e
cmp r8, 0x3dd8
ja 0x140022847
movabs eax, dword [0xf39eb2d2444b60f]
mov dh, 0x44
and al, 0x2d
movzx eax, byte [rsp + 0x2d]
jmp 0x140022887
movzx eax, byte [rsp + 0x2d]
mov byte [rsp + 0x2e], al
inc byte [rsp + 0x2e]
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], 0x191d968
je 0x140022872
dec byte [rsp + 0x2e]
lea rax, [rsp + 0x2e]
cmp rax, 0x3dd8
ja 0x140022882
mov ebx, 0xb60f31f1
and al, 0x2e
movzx eax, byte [rsp + 0x2e]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
add eax, 0xe7ba1728
mov dword [rsp + 0x88], eax
mov byte [rsp + 0x2f], 5
movzx eax, byte [rsp + 0x2f]
movzx r9d, al
mov eax, 0x18ae47d
xor edx, edx
div r9d
mov byte [rsp + 0x2d], dl
movzx eax, byte [rsp + 0x2d]
movzx eax, al
movabs rdx, 0xb6336e957a808
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], 0x18ae47d
jne 0x1400228f2
cmp r8, 0x4cdc
ja 0x1400228eb
movabs eax, dword [0xf39eb2d2444b60f]
mov dh, 0x44
and al, 0x2d
movzx eax, byte [rsp + 0x2d]
jmp 0x14002292b
movzx eax, byte [rsp + 0x2d]
mov byte [rsp + 0x2e], al
inc byte [rsp + 0x2e]
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], 0x18ae38c
je 0x140022916
dec byte [rsp + 0x2e]
lea rax, [rsp + 0x2e]
cmp rax, 0x4cdc
ja 0x140022926
mov ebx, 0xb60f31f1
and al, 0x2e
movzx eax, byte [rsp + 0x2e]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
add eax, 0x16a858fc
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x14002295d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x70]
mov edx, eax
call fcn.140022970
nop
add rsp, 0x98
ret