Function at 0x7ff7784a25c0
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x98
movabs r9, 0x4f005201de7490
mov byte [rsp + 0x70], 5
movzx eax, byte [rsp + 0x70]
movzx r8d, al
movabs rax, 0x4f005201de7581
xor edx, edx
div r8
mov byte [rsp + 0x2f], dl
movzx eax, byte [rsp + 0x2f]
movzx eax, al
movabs rdx, 0x8f6e22925bbf1754
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2f]
movzx eax, al
lea rdx, [r9 + 0xf1]
lea r8, [rsp + 0x30]
cmp qword [rsp + rax + 0x30], rdx
jne 0x7ff7784a2635
cmp r8, 0x4000
ja 0x7ff7784a262e
movabs eax, dword [0xf35eb2f2444b60f]
mov dh, 0x44
and al, 0x2f
movzx eax, byte [rsp + 0x2f]
jmp 0x7ff7784a266a
movzx eax, byte [rsp + 0x2f]
mov byte [rsp + 0x2d], al
inc byte [rsp + 0x2d]
movzx eax, byte [rsp + 0x2f]
movzx eax, al
cmp qword [rsp + rax + 0x30], r9
je 0x7ff7784a2655
dec byte [rsp + 0x2d]
lea rax, [rsp + 0x2d]
cmp rax, 0x4000
ja 0x7ff7784a2665
mov ebx, 0xb60f31f1
and al, 0x2d
movzx eax, byte [rsp + 0x2d]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
movabs r9, 0x5f004701e8b43a
movabs rdx, 0x70e0ddbfa492e8f1
add rdx, rax
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x2f], 7
movzx eax, byte [rsp + 0x2f]
movzx r10d, al
movabs rax, 0x5f004701e8b52b
xor edx, edx
div r10
mov byte [rsp + 0x2d], dl
movzx eax, byte [rsp + 0x2d]
movzx eax, al
movabs rdx, 0xf55f426be6f7bc24
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2d]
movzx eax, al
lea rdx, [r9 + 0xf1]
cmp qword [rsp + rax + 0x30], rdx
jne 0x7ff7784a26ed
cmp r8, 0x476a
ja 0x7ff7784a26e6
jmp 0x7ff79c8edcf9
movzx eax, byte [rsp + 0x2d]
jmp 0x7ff7784a2722
movzx eax, byte [rsp + 0x2d]
mov byte [rsp + 0x2e], al
inc byte [rsp + 0x2e]
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], r9
je 0x7ff7784a270d
dec byte [rsp + 0x2e]
lea rax, [rsp + 0x2e]
cmp rax, 0x476a
ja 0x7ff7784a271d
mov ebx, 0xb60f31f1
and al, 0x2e
movzx eax, byte [rsp + 0x2e]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
movabs r9, 0x25005f01db8ee1
movabs rdx, 0xaffbddb1967442e
add rdx, rax
mov qword [rsp + 0x78], rdx
mov byte [rsp + 0x2f], 2
movzx eax, byte [rsp + 0x2f]
movzx r10d, al
movabs rax, 0x25005f01db8fd2
xor edx, edx
div r10
mov byte [rsp + 0x2d], dl
movzx eax, byte [rsp + 0x2d]
movzx eax, al
movabs rdx, 0xa41c20868608962
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2d]
movzx eax, al
lea rdx, [r9 + 0xf1]
cmp qword [rsp + rax + 0x30], rdx
jne 0x7ff7784a27a5
cmp r8, 0x35f1
ja 0x7ff7784a279e
jmp 0x7ff79c8eddb1
movzx eax, byte [rsp + 0x2d]
jmp 0x7ff7784a27da
movzx eax, byte [rsp + 0x2d]
mov byte [rsp + 0x2e], al
inc byte [rsp + 0x2e]
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], r9
je 0x7ff7784a27c5
dec byte [rsp + 0x2e]
lea rax, [rsp + 0x2e]
cmp rax, 0x35f1
ja 0x7ff7784a27d5
mov ebx, 0xb60f31f1
and al, 0x2e
movzx eax, byte [rsp + 0x2e]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
movabs rdx, 0xf5e33e5697ed76f3
add rdx, rax
mov qword [rsp + 0x80], rdx
mov byte [rsp + 0x2f], 5
movzx eax, byte [rsp + 0x2f]
movzx r9d, al
mov eax, 0x191da59
xor edx, edx
div r9d
mov byte [rsp + 0x2d], dl
movzx eax, byte [rsp + 0x2d]
movzx eax, al
movabs rdx, 0x77a231845e930
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], 0x191da59
jne 0x7ff7784a284e
cmp r8, 0x3dd8
ja 0x7ff7784a2847
movabs eax, dword [0xf39eb2d2444b60f]
mov dh, 0x44
and al, 0x2d
movzx eax, byte [rsp + 0x2d]
jmp 0x7ff7784a2887
movzx eax, byte [rsp + 0x2d]
mov byte [rsp + 0x2e], al
inc byte [rsp + 0x2e]
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], 0x191d968
je 0x7ff7784a2872
dec byte [rsp + 0x2e]
lea rax, [rsp + 0x2e]
cmp rax, 0x3dd8
ja 0x7ff7784a2882
mov ebx, 0xb60f31f1
and al, 0x2e
movzx eax, byte [rsp + 0x2e]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
add eax, 0xe7ba1728
mov dword [rsp + 0x88], eax
mov byte [rsp + 0x2f], 5
movzx eax, byte [rsp + 0x2f]
movzx r9d, al
mov eax, 0x18ae47d
xor edx, edx
div r9d
mov byte [rsp + 0x2d], dl
movzx eax, byte [rsp + 0x2d]
movzx eax, al
movabs rdx, 0xb6336e957a808
mov qword [rsp + rax*8 + 0x30], rdx
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], 0x18ae47d
jne 0x7ff7784a28f2
cmp r8, 0x4cdc
ja 0x7ff7784a28eb
movabs eax, dword [0xf39eb2d2444b60f]
mov dh, 0x44
and al, 0x2d
movzx eax, byte [rsp + 0x2d]
jmp 0x7ff7784a292b
movzx eax, byte [rsp + 0x2d]
mov byte [rsp + 0x2e], al
inc byte [rsp + 0x2e]
movzx eax, byte [rsp + 0x2d]
movzx eax, al
cmp qword [rsp + rax + 0x30], 0x18ae38c
je 0x7ff7784a2916
dec byte [rsp + 0x2e]
lea rax, [rsp + 0x2e]
cmp rax, 0x4cdc
ja 0x7ff7784a2926
mov ebx, 0xb60f31f1
and al, 0x2e
movzx eax, byte [rsp + 0x2e]
movzx eax, al
mov rax, qword [rsp + rax*8 + 0x30]
add eax, 0x16a858fc
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.advapi32.dll_GetUserNameW]
test eax, eax
jne 0x7ff7784a295d
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, [rsp + 0x70]
mov edx, eax
call fcn.7ff7784a2970
nop
add rsp, 0x98
ret