Function at 0x48fdc0
Capabilities:
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov dword [rsp + 0x2c], 0
lea rdx, [rsp + 0x2c]
xor ecx, ecx
call sub.ADVAPI32.dll_GetUserNameW
mov r14d, dword [rsp + 0x2c]
test r14, r14
je 0x48fe40
lea rbx, [r14 + r14]
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x48fe1f
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x48fe31
mov rcx, rax
mov qword [0x004ac108], rax
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapAlloc
mov rdi, rax
test rax, rax
jne 0x48fe45
mov ecx, 2
mov rdx, rbx
call fcn.0040cdc0
ud2
mov edi, 2
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call sub.ADVAPI32.dll_GetUserNameW
test eax, eax
je 0x4903a0
mov eax, dword [rsp + 0x2c]
lea r8, [rax - 1]
test rax, rax
cmove r8, rax
lea rcx, [rsp + 0x78]
mov rdx, rdi
call fcn.0044a330
test r14, r14
je 0x48fe8c
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rdi
call fcn.0049062c
mov rbx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
cmp byte [rsp + 0x90], 0
je 0x48feca
mov qword [rsi], rbx
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], rdi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rdi, rdi
je 0x48feab
lea r12, [rbx + rdi]
mov rcx, rbx
jmp 0x48fef8
add rcx, 2
cmp rax, r12
cmovne rax, rcx
nop word cs:[rax + rax]
mov rcx, rax
cmp rax, r12
je 0x48feab
lea rax, [rcx + 1]
movzx edx, byte [rcx]
test dl, dl
jns 0x48fef0
cmp dl, 0xe0
jb 0x48fed8
cmp dl, 0xed
jne 0x48ff2a
cmp rax, r12
je 0x48feab
lea rax, [rcx + 2]
cmp rax, r12
je 0x48feab
cmp byte [rcx + 1], 0x9f
ja 0x48ff52
add rcx, 3
mov rax, rcx
jmp 0x48fef0
add rcx, 2
cmp rax, r12
cmove rcx, rax
xor eax, eax
cmp rcx, r12
setne al
add rax, rcx
cmp dl, 0xf0
jb 0x48fef0
xor ecx, ecx
cmp rax, r12
setne cl
add rax, rcx
jmp 0x48fef0
test rdi, rdi
je 0x490068
xor r9d, r9d
xor r14d, r14d
mov rcx, rbx
jmp 0x48ff8b
add rcx, 2
cmp rax, r12
cmovne rax, rcx
mov r8d, 2
nop word [rax + rax]
add r14, r8
mov rcx, rax
cmp rax, r12
je 0x490004
lea rax, [rcx + 1]
movzx edx, byte [rcx]
mov r8d, 1
test dl, dl
jns 0x48ff80
cmp dl, 0xe0
jb 0x48ff66
cmp dl, 0xed
jne 0x48ffcd
cmp rax, r12
je 0x490004
lea rax, [rcx + 2]
cmp rax, r12
je 0x490004
cmp byte [rcx + 1], 0x9f
ja 0x4900db
add rcx, 3
mov r8d, 3
mov rax, rcx
jmp 0x48ff80
add rcx, 2
cmp rax, r12
cmove rcx, rax
xor eax, eax
cmp rcx, r12
setne al
add rax, rcx
mov r8d, 3
cmp dl, 0xf0
jb 0x48ff80
xor ecx, ecx
cmp rax, r12
setne cl
add rax, rcx
mov r8d, 4
jmp 0x48ff80
mov rbp, rbx
test r9, r9
sete r15b
mov r14, r9
cmove r14, rbp
test rdi, rdi
mov qword [rsp + 0x48], r9
je 0x490080
js 0x49041e
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x490050
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x49040f
mov rcx, rax
mov qword [0x004ac108], rax
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x49040f
mov r12, rax
jmp 0x490086
mov r12d, 1
mov r15b, 1
xor eax, eax
mov qword [rsp + 0x48], rax
mov r14, rbx
mov rbp, rbx
jmp 0x490086
mov r12d, 1
mov rcx, r12
mov rdx, r14
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov qword [rsi], r12
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
test r15b, r15b
jne 0x4900bc
test rbp, rbp
je 0x4900bc
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, qword [rsp + 0x48]
call fcn.0049062c
test r13, r13
je 0x48feb6
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rbx
call fcn.0049062c
jmp 0x48feb6
test rdi, rdi
js 0x49041e
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x49010f
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x49040f
mov rcx, rax
mov qword [0x004ac108], rax
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x49040f
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
mov rbp, rdi
sub rbp, r14
jb 0x490425
mov rcx, rax
mov rdx, rbx
mov r8, r14
mov r15, rax
call sub.msvcrt.dll_memcpy
mov rcx, r15
mov qword [rsp + 0x40], r14
mov r15, r14
cmp rbp, 2
ja 0x490180
lea rcx, [rsp + 0x30]
mov r8d, 3
mov rdx, r14
call fcn.0044b980
mov rcx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x40]
mov byte [rcx + r15 + 2], 0xbd
mov word [rcx + r15], 0xbfef
add r15, 3
mov qword [rsp + 0x40], r15
add r14, 3
cmp r14, rdi
ja 0x490443
lea r10, str.library_std_src_sys_commonwtf8.rs
cmp r14, rdi
je 0x490350
lea r11, [rbx + r14]
mov rbp, r14
mov r9, r11
jmp 0x4901df
add r9, 2
cmp rax, r12
cmovne rax, r9
mov r8d, 2
add rbp, r8
mov r9, rax
cmp rax, r12
je 0x490353
lea rax, [r9 + 1]
movzx edx, byte [r9]
mov r8d, 1
test dl, dl
jns 0x4901d0
cmp dl, 0xe0
jb 0x4901bf
cmp dl, 0xed
jne 0x490227
cmp rax, r12
je 0x490353
lea rax, [r9 + 2]
cmp rax, r12
je 0x490353
cmp byte [r9 + 1], 0x9f
ja 0x49025e
add r9, 3
mov r8d, 3
mov rax, r9
jmp 0x4901d0
add r9, 2
cmp rax, r12
cmove r9, rax
xor eax, eax
cmp r9, r12
setne al
add rax, r9
mov r8d, 3
cmp dl, 0xf0
jb 0x4901d0
xor edx, edx
cmp rax, r12
setne dl
add rax, rdx
mov r8d, 4
jmp 0x4901d0
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x48], rcx
mov rax, rbp
sub rax, r14
mov qword [rsp + 0x50], rax
jb 0x49045f
cmp rbp, rdi
ja 0x49045a
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
sub rax, r15
cmp rax, qword [rsp + 0x50]
jae 0x4902c6
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, qword [rsp + 0x50]
call fcn.0044b980
mov r15, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + r15]
mov rdx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x50]
mov r8, r14
call sub.msvcrt.dll_memcpy
add r15, r14
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x68]
sub rax, r15
cmp rax, 2
ja 0x490319
mov r8d, 3
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.0044b980
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov byte [rcx + r15 + 2], 0xbd
mov word [rcx + r15], 0xbfef
add r15, 3
mov qword [rsp + 0x40], r15
add rbp, 3
mov r14, rbp
cmp rbp, rdi
lea r10, str.library_std_src_sys_commonwtf8.rs
jbe 0x4901aa
jmp 0x490446
mov r14, rdi
sub rdi, r14
mov rax, qword [rsp + 0x38]
sub rax, r15
cmp rax, rdi
jae 0x49037d
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, rdi
call fcn.0044b980
mov rcx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x40]
add r14, rbx
add rcx, r15
mov rdx, r14
mov r8, rdi
call sub.msvcrt.dll_memcpy
add rdi, r15
mov r9, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
jmp 0x490007
call fcn.0049068c
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x30], rax
lea rax, [0x004107c0]
mov qword [rsp + 0x38], rax
lea rax, [0x004a2d60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 2
mov qword [rsp + 0x98], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 1
lea rdx, str._home_codespace_.cargo_registry_src_index.crates.io_6f17d22bba15001f_whoami_0.9.0_src_windows.rsFailed_to_get_username:___report_at_https:__github.com_libcala_whoami_issues
lea rcx, [rsp + 0x78]
call fcn.0040dbf0
ud2
mov ecx, 1
mov rdx, rdi
call fcn.0040cdc0
ud2
call fcn.0040cd80
ud2
lea rax, str.library_std_src_sys_commonwtf8.rs
mov qword [rsp + 0x60], rax
mov rcx, r14
mov rdx, rdi
mov r8, qword [rsp + 0x60]
call fcn.0040e5b0
jmp 0x490471
mov rbp, r14
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, rbp
mov rdx, rdi
call fcn.0040dc30
jmp 0x490471
mov r14, rbp
jmp 0x490431
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, r14
mov rdx, rbp
call fcn.0040f290
ud2