Function at 0x18009b800
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17c8]
mov eax, 0x18c8
call fcn.1800fd960
sub rsp, rax
mov rax, qword [0x180121650]
xor rax, rsp
mov qword [rbp + 0x17b0], rax
mov eax, dword [rbp + 0x1840]
lea r10, str.Unknown
mov r14, qword [rbp + 0x1838]
mov r13, rdx
mov rdx, qword [rbp + 0x1830]
mov edi, eax
mov r12d, dword [rsp + 0x58]
mov ebx, dword [rsp + 0x58]
mov qword [rbp - 0x60], r9
lea r9, [0x180000000]
mov qword [rbp - 0x78], rcx
mov r15, qword [rbp - 0x78]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
nop dword [rax]
add eax, 0xfffffff5
cmp edi, eax
jbe 0x18009ba85
lea eax, [rdi - 0x8a]
cmp eax, 0x38
ja case.0x18009b8ae.149
movzx eax, byte [r9 + rax + 0x9bf98]
mov ecx, dword [r9 + rax*4 + 0x9bf68]
add rcx, r9
jmp rcx
xor r8d, r8d
cmp dword [rbp - 0x70], r8d
jne 0x18009b8e2
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 7
mov edx, 0xdb
mov qword [rsp + 0x20], r10
mov rcx, r14
call fcn.18002dea0
mov rdx, qword [rsp + 0x60]
jmp 0x18009be72
lea r9, [rbp + 0xfb0]
mov edx, 0x6f
xor ecx, ecx
call fcn.1800f19c0
xor r8d, r8d
lea r9, [rsp + 0x50]
mov rsi, rax
mov edx, 0xdb
mov rcx, r14
test rax, rax
jne 0x18009b930
lea rax, str.Unknown
mov dword [rsp + 0x50], 7
mov qword [rsp + 0x20], rax
call fcn.18002dea0
mov rdx, qword [rsp + 0x60]
jmp 0x18009be72
mov dword [rsp + 0x50], 0xffffffff
mov qword [rsp + 0x20], rsi
call fcn.18002dea0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [rsp + 0x60]
jmp 0x18009be72
mov eax, dword [rbp + 0x1840]
xor edx, edx
mov qword [rsp + 0x60], rdx
dec edi
jmp 0x18009b880
mov rax, qword [r14 + 0x1e8]
lea rcx, [rsp + 0x50]
mov r9d, 0xf9
xor r8d, r8d
mov r12d, dword [rax + 0x14]
mov eax, dword [rdx]
xor edx, edx
mov dword [rsp + 0x50], eax
call fcn.18001ff00
mov rdx, qword [rsp + 0x60]
mov dword [rdx], eax
add qword [r14 + 0x1e8], 0x20
jmp 0x18009be6d
mov r9, r14
mov dword [rsp + 0x50], 2
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0xfe
call fcn.1800dee70
mov rdx, qword [rsp + 0x60]
jmp 0x18009be72
mov rax, qword [rdx]
dec edi
mov qword [r14], rax
mov eax, dword [rbp + 0x1840]
jmp 0x18009b880
or dword [r8], 2
mov rax, qword [r14 + 0x1e8]
cmp rax, qword [r14 + 0x1f0]
jae 0x18009ba12
test byte [rax + 0x10], 8
je 0x18009ba12
mov r15, rax
dec edi
mov eax, dword [rbp + 0x1840]
jmp 0x18009b880
lea r9, str.__global_short_disp_
mov r8d, r12d
mov edx, 1
mov rcx, r14
call fcn.18004dee0
mov ebx, eax
cmp eax, 0xfffffff6
je 0x18009bf37
mov rdi, qword [rbp - 0x80]
jmp 0x18009bcc3
lea rdx, [rbp - 0x6c]
lea rcx, [rbp + 0xfb0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rdx, qword [rsp + 0x60]
mov dword [rbp - 0x70], eax
jmp 0x18009be72
mov rax, qword [rdx]
dec edi
bswap rax
mov qword [rdx], rax
mov eax, dword [rbp + 0x1840]
jmp 0x18009b880
mov eax, dword [rbp + 0x1840]
dec edi
mov dword [rbp - 0x6c], 0x800
jmp 0x18009b880
mov eax, dword [rbp + 0x1840]
mov esi, eax
mov rdi, qword [rbp - 0x80]
imul eax, eax, 0x33e
cmp esi, eax
ja 0x18009bf3f
cmp esi, 0xf3c0
ja 0x18009bd23
je 0x18009bd06
cmp esi, 0x96
je 0x18009bc39
cmp esi, 0x3138
je 0x18009bbe8
cmp esi, 0x61da
je 0x18009bbd2
cmp esi, 0x927c
je 0x18009bb88
cmp esi, 0xc31e
jne 0x18009be54
cmp ebx, 0xfffffffd
jne 0x18009bb17
lea r9, str.Level_2_plane__i__i__i__i
mov qword [rsp + 0x20], r15
mov r8d, r12d
lea edx, [rbx + 4]
mov rcx, r14
call fcn.18004dee0
mov ebx, eax
cmp eax, 0xfffffff6
je 0x18009bf37
mov rcx, qword [r14]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x70
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], 0
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x58], 1
call fcn.18005c020
mov rax, qword [r14]
xor r9d, r9d
mov rdx, qword [rbp - 0x68]
mov r8d, 0xa7
mov qword [rsp + 0x28], 0
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180056240
jmp 0x18009be4a
mov rax, qword [r14]
lea rdx, [rdi + 0x18]
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r8d, 0xa7
call fcn.180056240
xor r9d, r9d
mov dword [rsp + 0x58], 4
mov r8, r14
lea rdx, [rsp + 0x58]
mov ecx, 0x121
call fcn.1800243d0
mov rbx, rax
jmp 0x18009be4a
mov rdx, qword [r14]
mov ecx, 0x56
call fcn.18005c810
mov qword [rbp - 0x68], rax
jmp 0x18009be4a
mov eax, dword [r8]
mov r9, r15
mov r8, qword [r14]
mov ecx, 0x2b
mov dword [rsp + 0x70], eax
mov eax, dword [rdx]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], r12d
call fcn.180055fd0
mov qword [rbp - 0x80], rax
cmp rax, 0
je 0x18009bf17
mov rdi, rax
jmp 0x18009be4a
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov edx, 0x118
mov rcx, r15
call fcn.180077860
test eax, eax
je 0x18009bc6b
lea r9, str.const_IDX_SETTINGS_HEADER_TABLE_SIZE__0_
jmp 0x18009bca3
add qword [r14 + 0x1e8], 0x20
mov rax, qword [r14 + 0x1e8]
cmp rax, qword [r14 + 0x1f0]
jae 0x18009bc9c
test dword [rax + 0x10], 0x400000
je 0x18009bc9c
add rax, 0x20
mov qword [r14 + 0x1e8], rax
jmp 0x18009be4a
lea r9, str.S_METHOD_MOVE_FileManager_Vim__2QBDB
mov r8d, r12d
mov qword [rsp + 0x20], r15
mov edx, 1
mov rcx, r14
call fcn.18004dee0
mov ebx, eax
cmp eax, 0xfffffff6
je 0x18009bf37
mov rax, qword [r14 + 0x1e8]
mov esi, 0x185a6
mov rcx, qword [r14 + 0x1f0]
cmp rax, rcx
jae 0x18009bcf9
nop dword [rax + rax]
test dword [rax + 0x10], 0x40000
jne 0x18009bcf9
add rax, 0x20
mov qword [r14 + 0x1e8], rax
cmp rax, rcx
jb 0x18009bce0
mov dword [rsp + 0x78], 0xffffffe8
jmp 0x18009be4a
cmp ebx, 0xfffffff6
je 0x18009bf37
imul eax, dword [rbp + 0x1840], 0x53
add esi, eax
mov eax, dword [rbp + 0x1840]
jmp 0x18009ba91
cmp esi, 0x12462
je 0x18009bd7b
cmp esi, 0x15504
je 0x18009bd5f
cmp esi, 0x185a6
je 0x18009bf3f
cmp esi, 0x1b648
je 0x18009bf3f
imul eax, dword [rbp + 0x1840], 0x53
add esi, eax
mov eax, dword [rbp + 0x1840]
jmp 0x18009ba91
imul eax, dword [rbp + 0x1840], 0x53
mov dword [rsp + 0x78], 0
add esi, eax
mov eax, dword [rbp + 0x1840]
jmp 0x18009ba91
mov r8, qword [rbp - 0x80]
mov r9d, 0x104
xor edx, edx
mov qword [rsp + 0x20], 0
mov rcx, r13
call fcn.1800f40d0
mov ebx, eax
test eax, eax
jne 0x18009bf20
mov rax, qword [r14 + 0x1e8]
mov rcx, qword [r14 + 0x1f0]
cmp rax, rcx
jae 0x18009be46
test dword [rax + 0x10], 0x20000
je 0x18009be46
add rax, 0x20
mov qword [r14 + 0x1e8], rax
cmp rax, rcx
jae 0x18009bde0
test byte [rax + 0x10], 8
jne 0x18009be68
mov edi, 0x8b
mov eax, edi
sub eax, 0x8b
je 0x18009bdfe
cmp eax, 1
jne 0x18009be3c
cmp ebx, 0xfffffff6
je 0x18009bf37
jmp 0x18009be3c
mov rdx, qword [r14 + 0x1e8]
lea rcx, [r13 + 0x48]
cmp rdx, qword [r14 + 0x1f0]
lea r9, str.VVC:_Stopping_VvcBandwidthDetection_on_session:__d___p___instance:__s.
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov r8d, dword [rdx + 0x14]
lea rax, [rdx - 0x20]
cmovb rax, rdx
mov edx, 1
mov qword [rsp + 0x20], rax
call fcn.18004dee0
mov ebx, eax
inc edi
cmp edi, 0x8d
jb 0x18009bde5
mov rdi, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
imul eax, dword [rbp + 0x1840], 0x53
add esi, eax
mov eax, dword [rbp + 0x1840]
jmp 0x18009ba91
mov rdx, qword [rsp + 0x60]
mov edi, StrCmpNICW
mov r8, qword [rsp + 0x68]
lea r10, str.Unknown
lea r9, [0x180000000]
mov eax, dword [rbp + 0x1840]
dec edi
jmp 0x18009b880
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
neg eax
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rsp + 0x78], ecx
jmp 0x18009bf3f
mov rax, qword [rbp - 0x60]
lea r9, [rsp + 0x70]
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x68], 0x1000
mov eax, dword [rax]
mov dword [rsp + 0x58], eax
mov rax, qword [rbp - 0x78]
mov eax, dword [rax]
mov dword [rsp + 0x70], eax
mov rax, qword [r13]
mov qword [rbp - 0x78], rax
mov rax, qword [rdx]
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r8
mov r8d, 0xa9
call fcn.18004a180
jmp 0x18009bf44
lea r9, str.override_of_virtual__n_is_ambiguous
jmp 0x18009bf27
lea r9, str.RMK_returned_error_while_finalizing
mov r8d, r12d
mov edx, 1
mov rcx, r14
call fcn.18004dee0
mov dword [rsp + 0x78], 0xfffffff6
mov rax, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x17b0]
xor rcx, rsp
call fcn.1800fd9d0
add rsp, 0x18c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret