Function at 0x7ff76910acc0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x7ff769193080]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov r12, rcx
mov qword [rbp + 0xa8], rdx
xor r13d, r13d
cmp byte [0x7ff7691bb7c8], r13b
jne 0x7ff76910ad38
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
lea r8d, [r13 + 0x52]
lea rdx, [0x7ff7691634d0]
lea rcx, [rsp + 0x78]
call fcn.7ff7690ba770
lea rcx, [rsp + 0x78]
call fcn.7ff7691088c0
mov dword [rbp + 0xb0], 0x64
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x100]
call qword [sym.imp.advapi32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
lea rax, [rbp + 0x100]
mov rcx, 0xffffffffffffffff
mov rbx, rcx
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff76910ad80
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x7ff76910b511
mov eax, 0x16
cmp rbx, 0x10
jae 0x7ff76910adee
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], 0xf
mov r8, rbx
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xb8]
call sub.VCRUNTIME140.dll_memcpy_1
mov byte [rbp + rbx + 0xb8], 0
mov rdi, qword [rbp + 0xd0]
mov rbx, qword [rbp + 0xc8]
mov r15, qword [rbp + 0xb8]
jmp 0x7ff76910ae4c
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x7ff76910adff
mov rdi, r14
jmp 0x7ff76910ae06
cmp rdi, rax
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, rcx
lea rcx, [rbp + 0xb8]
call fcn.7ff7690bbcc0
mov r15, rax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], rdi
mov r8, rbx
lea rdx, [rbp + 0x100]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy_1
mov byte [r15 + rbx], 0
mov dword [rsp + 0x58], 0x130b145c
mov dword [rsp + 0x5c], 0xe5e90d1b
mov word [rsp + 0x60], 0xbf
mov byte [rsp + 0x62], 1
mov dword [rsp + 0x20], 0x101d155c
mov dword [rsp + 0x24], 0x100421b
mov dword [rsp + 0x68], 0xe19085c
mov dword [rsp + 0x6c], 0xefef160d
mov dword [rsp + 0x70], 0xb9e7eb
mov byte [rsp + 0x74], 1
mov dword [rsp + 0x48], 0xe19165c
mov dword [rsp + 0x4c], 0xe4e71e0d
mov word [rsp + 0x50], 0xbf
mov byte [rsp + 0x52], 1
mov dword [rsp + 0x28], 0x81f0b5c
mov dword [rsp + 0x2c], 0xbcf21a0d
mov word [rsp + 0x30], 0x100
mov dword [rsp + 0x38], 0x180c020e
mov dword [rsp + 0x3c], 0xe6ef1343
mov word [rsp + 0x40], 0x100
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x78]
call fcn.7ff769107300
nop
lea rdx, [rbp + 0xb8]
cmp rdi, 0x10
cmovae rdx, r15
mov r8, rbx
mov rcx, rax
call fcn.7ff7690b6a60
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x58]
call fcn.7ff769107500
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x7ff76910af4b
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.7ff7690b6a60
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x38]
call fcn.7ff769107700
nop
lea rdx, [r12 + 0x238]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff76910af9e
mov rdx, qword [rdx]
mov rcx, rax
call fcn.7ff7690b6a60
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 8]
call fcn.7ff769107220
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x7ff76910afe6
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.7ff7690b6a60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x28]
call fcn.7ff769107500
nop
lea rdx, [r12 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff76910b039
mov rdx, qword [rdx]
mov rcx, rax
call fcn.7ff7690b6a60
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x7ff76910b0a3
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b09e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b09e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
movdqa xmm0, xmmword [0x7ff76917dcd0]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x7ff76910b0f4
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b0ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b0ee
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x7ff76910b132
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b12d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b12d
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
movdqa xmm0, xmmword [0x7ff76917dcd0]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x7ff76910b182
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b17c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b17c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x7ff76910b1c0
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b1bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b1bb
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
movdqa xmm0, xmmword [0x7ff76917dcd0]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x7ff76910b210
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b20a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b20a
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x7ff76910b24e
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b249
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b249
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
movdqa xmm0, xmmword [0x7ff76917dcd0]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x7ff76910b29e
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b298
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b298
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x7ff76910b2df
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b2da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b2da
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
movdqa xmm0, xmmword [0x7ff76917dcd0]
movdqu xmmword [rbp + 0x88], xmm0
mov byte [rbp + 0x78], 0
lea rax, [rbp - 0x48]
mov qword [rbp + 0x98], rax
lea rdx, [r12 + 0x80]
lea rcx, [rbp - 0x48]
call fcn.7ff7690be670
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
lea r15, [rbp + 0xd8]
mov rdi, qword [rbp + 0xd8]
mov r13, qword [rbp + 0xf0]
cmp r13, 0x10
cmovae r15, rdi
mov rbx, qword [rbp + 0xe8]
cmp rbx, r14
ja 0x7ff76910b50b
mov qword [rbp - 0x70], 0xf
cmp rbx, 0x10
jae 0x7ff76910b36c
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x78], xmm0
jmp 0x7ff76910b3c1
mov rax, rbx
or rax, 0xf
cmp rax, r14
ja 0x7ff76910b388
mov r14, rax
cmp rax, 0x16
mov eax, 0x16
cmovb r14, rax
mov rdx, r14
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x78]
call fcn.7ff7690bbcc0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r14
lea r8, [rbx + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy_1
nop
mov r8, r12
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.7ff76910c3b0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x7ff76910b411
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b40b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b40b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
nop
cmp r13, 0x10
jb 0x7ff76910b44c
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x7ff76910b443
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b443
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.7ff76915d7b0
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x7ff76910b491
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff76910b48b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff76910b48b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff76915d7b0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x7ff76910b4c7
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x7ff76910b4c2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff76910b504
mov rcx, r8
call fcn.7ff76915d7b0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.7ff76915d150
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff7690a1d80
nop
call fcn.7ff7690a1d80
int3