Function at 0x140004ab0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rbx, rcx
mov dword [rbp + 0x210], 0x105
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004b20
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call fcn.140005830
nop
mov rax, qword [rbp - 0x80]
test rax, rax
jne 0x140004b5c
lea r8d, [rax + 7]
lea rdx, str.Default
lea rcx, [rsp + 0x70]
call fcn.140005830
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x30], r15
mov r12, r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], r12b
mov edi, r15d
mov dword [rbp + 0x208], r15d
mov rsi, qword [rsp + 0x70]
test rax, rax
je 0x140004e6f
mov r13, r15
movzx ebx, byte [rbp + 0x208]
nop dword [rax]
cmp rax, r13
jbe 0x140004fe2
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rax, rsi
movzx r8d, word [rax + r13*2]
lea r9, [rbp - 0x5b]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140004bc0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov r14d, 0xf
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x50], dl
lea rax, [rbp - 0x5b]
cmp r9, rax
je 0x140004c2f
lea r8, [rbp - 0x5b]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.1400056d0
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
lea r9, [rsp + 0x50]
mov rsi, qword [rsp + 0x50]
cmp r14, 0x10
cmovae r9, rsi
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, r12
cmp r15, rax
ja 0x140004c89
lea rax, [r12 + r15]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x30]
cmp rcx, 0x10
cmovae rdi, qword [rsp + 0x30]
lea rcx, [rdi + r12]
mov r8, r15
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r15 + rdi]
mov byte [rax + r12], 0
mov edi, dword [rbp + 0x208]
jmp 0x140004ca9
mov qword [rsp + 0x20], r15
movzx r8d, bl
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.1400029a0
mov r14, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
cmp r14, 0x10
jb 0x140004ce0
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140004cd8
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004e3e
mov rcx, rsi
call fcn.14008f0d4
inc edi
mov dword [rbp + 0x208], edi
inc r13
movsxd rax, edi
mov r12, qword [rsp + 0x40]
xor r15d, r15d
cmp rax, qword [rbp - 0x80]
jae 0x140004d0a
mov rax, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x70]
jmp 0x140004ba0
cmp r12, 0xf
jbe 0x140004e63
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x68], 0xf
mov edi, 0xe
cmp r12, rdi
cmovb rdi, r12
lea r14, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r14, qword [rsp + 0x30]
cmp rdi, 0xf
ja 0x140004d64
mov qword [rsp + 0x60], rdi
mov r8, rdi
mov rdx, r14
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rdi + 0x50], 0
jmp 0x140004e0a
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x140004fee
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140004dac
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.14008f098
test rax, rax
je 0x140004e3e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004de9
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004dd7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004fe8
jmp 0x140004d8d
test rcx, rcx
je 0x140004de6
call fcn.14008f098
mov rsi, rax
jmp 0x140004de9
mov rsi, r15
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
mov qword [rsp + 0x50], rsi
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140004e4a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008f0d4
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x40], xmm1
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rbp + 0x200]
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x58], 0xf
mov qword [rbp - 0x60], 5
mov eax, dword [str.RSCFG]
mov dword [rbp - 0x70], eax
movzx eax, byte [0x1400d23d4]
mov byte [rbp - 0x6c], al
mov byte [rbp - 0x6b], 0
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r8, qword [rsp + 0x30]
mov r9, r12
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.140006090
mov qword [rbx], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140004f1f
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004f1a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008f0d4
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140004f6f
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004f6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008f0d4
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rax, qword [rbp - 0x78]
cmp rax, 8
jb 0x140004fc4
lea rdx, [rax*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140004fbc
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004fbc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14008f0d4
mov rax, rbx
mov rbx, qword [rsp + 0x318]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400055e0
nop
call fcn.1400054e0
int3
call fcn.1400055a0
int3