Function at 0x140176ee0
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push r12
push r13
sub rsp, 0x258
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r12d, r12d
mov rsi, rcx
mov qword [rcx + 0x18], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x38], r12
mov dword [rcx + 0x28], r12d
mov qword [rcx + 0x50], r12
mov dword [rcx + 0x5c], r12d
test dword [0x14046a500], 0x2000
je 0x140176f31
mov dword [rcx + 0x17e8], r12d
cmp dword [0x140469638], r12d
mov r13d, 1
je 0x140176f4c
mov eax, r13d
cmp dword [rcx + 0x17e8], r12d
jne 0x140176f4f
mov eax, r12d
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0x290], rbp
mov dword [rcx + 0x1a00], eax
xor ecx, ecx
call fcn.14016f190
mov rdi, rax
test rax, rax
je 0x1401773d6
mov qword [rsi + 8], rax
mov r8d, r13d
mov qword [rax + 0x498], rsi
xor edx, edx
mov rcx, rax
mov dword [rsi + 0x20], r13d
mov dword [rsi], r13d
call fcn.14016edc0
mov rbx, rax
test rax, rax
je 0x14017738a
cmp dword [rax + 0x10], r12d
je 0x140176fdc
call fcn.140182a30
test eax, eax
jne 0x14017738f
lea rcx, str.E340:_Internal_error__if_you_can_reproduce_please_report_a_bug
call qword [case.0x1400407ae.0]
mov rcx, rax
call fcn.140182400
lea rcx, str.E298:_Didnt_get_block_nr_0_
call fcn.140182400
jmp 0x14017738f
mov qword [rsp + 0x298], r14
lea rdx, [0x1403d0dd8]
mov r14, qword [rax + 0x28]
mov r8d, 6
mov word [r14], 0x3062
lea rcx, [r14 + 6]
mov dword [r14 + 0x3f0], 0x30313233
mov dword [r14 + 0x3f4], 0x20212223
mov word [r14 + 0x3f8], 0x1213
mov byte [r14 + 0x3fa], 0x55
mov dword [r14 + 2], 0x204d4956
call fcn.140013650
mov eax, dword [rdi + 0x490]
mov byte [r14 + 0xc], al
shr eax, 8
mov byte [r14 + 0xd], al
shr eax, 8
mov byte [r14 + 0xe], al
shr eax, 8
mov byte [r14 + 0xf], al
cmp dword [rsi + 0x1a0c], r12d
jne 0x14017716e
mov eax, dword [rsi + 0xa8]
neg eax
mov qword [rsp + 0x250], r15
sbb cl, cl
and cl, 0x55
mov byte [r14 + 0x3ef], cl
mov rcx, rsi
call fcn.14018f730
inc al
mov rdx, rsi
mov rcx, r14
mov byte [r14 + 0x3ee], al
call fcn.140173830
mov rdx, qword [0x1404619a8]
test rdx, rdx
jne 0x140177113
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14017710d
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140321f80
mov rbp, rax
test rax, rax
je 0x14017710d
mov r8d, 0x27
lea rcx, [r14 + 0x1c]
mov rdx, rax
call fcn.140013650
cmp dword [0x14045b3f8], r12d
mov byte [r14 + 0x43], r12b
jne 0x1401770fb
mov rcx, rbp
call fcn.140005660
lea rcx, [r14 + 0x1c]
call fcn.14028ad70
mov qword [0x1404619a8], rax
jmp 0x140177126
mov byte [r14 + 0x1c], r12b
jmp 0x140177126
mov r8d, 0x27
lea rcx, [r14 + 0x1c]
call fcn.140013650
mov byte [r14 + 0x43], r12b
lea rcx, [r14 + 0x44]
mov byte [r14 + 0x43], r12b
mov edx, 0x28
call fcn.1401e0690
mov byte [r14 + 0x6b], r12b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov byte [r14 + 0x18], al
mov rdx, r14
shr eax, 8
mov rcx, rsi
mov byte [r14 + 0x19], al
shr eax, 8
mov byte [r14 + 0x1a], al
shr eax, 8
mov byte [r14 + 0x1b], al
call fcn.1401744e0
mov r15, qword [rsp + 0x250]
movsx ebp, byte [rbx + 0x34]
test bpl, 2
jne 0x1401771a2
call fcn.140182a30
test eax, eax
jne 0x1401771a2
lea rcx, str.E340:_Internal_error__if_you_can_reproduce_please_report_a_bug
call qword [case.0x1400407ae.0]
mov rcx, rax
call fcn.140182400
lea rcx, str.E293:_Block_was_not_locked
call fcn.140182400
and ebp, 0xfffffffd
or ebp, r13d
cmp dword [rdi + 0x494], 2
je 0x1401771b8
mov dword [rdi + 0x494], r13d
mov byte [rbx + 0x34], bpl
cmp dword [rsi + 0x1a08], r12d
jne 0x140177266
cmp dword [rsi + 0x1a0c], r12d
jne 0x140177266
mov r14d, dword [0x14045b41c]
cmp dword [rdi + 0x10], r12d
jge 0x1401771ec
mov dword [rdi + 0x494], r12d
jmp 0x140177266
mov rbx, qword [rdi + 0x30]
mov ebp, r13d
mov dword [0x14045b41c], r12d
test rbx, rbx
je 0x140177250
nop
mov eax, dword [rbx + 0x10]
test eax, eax
js 0x140177241
test byte [rbx + 0x34], r13b
je 0x140177241
cmp ebp, r13d
je 0x14017721a
cmp eax, dword [rdi + 0x48c]
jge 0x140177241
mov rdx, rbx
mov rcx, rdi
call fcn.14016dfc0
test eax, eax
jne 0x140177230
test ebp, ebp
je 0x140177250
mov ebp, r12d
xor ecx, ecx
call fcn.1402c5ec0
mov eax, dword [0x14045b41c]
test eax, eax
jne 0x14017724c
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x140177200
jmp 0x140177250
test ebp, ebp
jne 0x140177257
mov dword [rdi + 0x494], r12d
mov eax, dword [0x14045b41c]
or eax, r14d
mov dword [0x14045b41c], eax
mov rcx, rdi
call fcn.1401713f0
mov r14, qword [rsp + 0x298]
mov rbx, rax
test rax, rax
je 0x14017738a
cmp dword [rax + 0x10], r13d
je 0x1401772bb
call fcn.140182a30
test eax, eax
jne 0x14017738f
lea rcx, str.E340:_Internal_error__if_you_can_reproduce_please_report_a_bug
call qword [case.0x1400407ae.0]
mov rcx, rax
call fcn.140182400
lea rcx, str.E298:_Didnt_get_block_nr_1_
call fcn.140182400
jmp 0x14017738f
mov rax, qword [rax + 0x28]
mov word [rax + 2], r13w
mov dword [rax + 8], 2
mov dword [rax + 0x14], r13d
mov dword [rax + 0x10], r13d
mov dword [rax + 0xc], r13d
movsx ebp, byte [rbx + 0x34]
test bpl, 2
jne 0x14017730b
call fcn.140182a30
test eax, eax
jne 0x14017730b
lea rcx, str.E340:_Internal_error__if_you_can_reproduce_please_report_a_bug
call qword [case.0x1400407ae.0]
mov rcx, rax
call fcn.140182400
lea rcx, str.E293:_Block_was_not_locked
call fcn.140182400
and ebp, 0xfffffffd
or ebp, r13d
cmp dword [rdi + 0x494], 2
je 0x140177321
mov dword [rdi + 0x494], r13d
mov r8d, r13d
mov byte [rbx + 0x34], bpl
xor edx, edx
mov rcx, rdi
call fcn.140171440
mov rbx, rax
test rax, rax
je 0x14017738a
cmp dword [rax + 0x10], 2
je 0x14017736c
call fcn.140182a30
test eax, eax
jne 0x14017738f
lea rcx, str.E340:_Internal_error__if_you_can_reproduce_please_report_a_bug
call qword [case.0x1400407ae.0]
mov rcx, rax
call fcn.140182400
lea rcx, str.E298:_Didnt_get_block_nr_2_
call fcn.140182400
jmp 0x14017738f
mov rdx, qword [rax + 0x28]
mov eax, r13d
dec dword [rdx + 8]
mov ecx, dword [rdx + 8]
add dword [rdx + 4], 0xfffffffb
mov dword [rdx + 0x14], ecx
mov dword [rdx + 0x10], r13d
mov byte [rcx + rdx], r12b
jmp 0x1401773dc
test rbx, rbx
je 0x1401773cb
movzx ebp, byte [rbx + 0x34]
test bpl, 2
jne 0x1401773c3
call fcn.140182a30
test eax, eax
jne 0x1401773c3
lea rcx, str.E340:_Internal_error__if_you_can_reproduce_please_report_a_bug
call qword [case.0x1400407ae.0]
mov rcx, rax
call fcn.140182400
lea rcx, str.E293:_Block_was_not_locked
call fcn.140182400
and bpl, 0xfd
mov byte [rbx + 0x34], bpl
mov edx, r13d
mov rcx, rdi
call fcn.14016ef80
mov qword [rsi + 8], r12
xor eax, eax
mov rbp, qword [rsp + 0x290]
mov rbx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001200
add rsp, 0x258
pop r13
pop r12
pop rdi
pop rsi
ret