Function at 0x140001bf0
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x448]
sub rsp, 0x548
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [str.NhAU9JpB_Lrf9LoOmLSp]
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x480], rbx
mov qword [rbp + 0x488], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov edi, ebx
mov dword [rbp + 0x478], ebx
call fcn.14000deb0
movzx eax, byte [rbp + 0x40]
lea r11, [rbp + 0x40]
lea rcx, [rsp + 0x70]
test al, al
je 0x140001c66
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140001c50
mov word [rcx], bx
mov rcx, qword [rsi]
lea rdx, [rbp + 0x480]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [0x140018628]
lea r8, [0x140018648]
lea rdx, [rsp + 0x70]
call qword [rax + 0x40]
test eax, eax
jns 0x140001cab
cmp eax, 0x80070050
sete bl
mov eax, ebx
add rsp, 0x548
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [rsp + 0x38]
call fcn.14000bc60
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x140001e97
xor edx, edx
mov ecx, 0x202
mov dword [rbp + 0x478], 0x101
call fcn.14000e210
mov rdi, rax
test rax, rax
je 0x140001e97
lea rdx, [rbp + 0x478]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, qword [rbp + 0x480]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
test eax, eax
js 0x140001e97
mov rcx, qword [str.QLrfNRSyN1]
lea rdx, [rbp + 0x40]
call fcn.14000deb0
movzx eax, byte [rbp + 0x40]
lea r11, [rbp + 0x40]
lea rcx, [rsp + 0x70]
test al, al
je 0x140001d47
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140001d31
mov word [rcx], bx
mov rcx, qword [rbp + 0x480]
lea rdx, [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0xa0]
test eax, eax
js 0x140001e97
mov rcx, qword [rbp + 0x480]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x470]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x140001e97
mov qword [rsp + 0x540], r12
mov r12d, 0x30
lea rcx, [rsp + 0x40]
mov r8d, r12d
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x30]
mov word [rsp + 0x40], r12w
mov r12d, 1
mov dword [rsp + 0x44], 0x107e1
mov dword [rsp + 0x54], 0x5a0
mov word [rsp + 0x48], r12w
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x60], r12d
mov word [rsp + 0x64], r12w
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x18]
test eax, eax
js 0x140001e8f
mov rcx, qword [rbp + 0x480]
lea rdx, [0x1400196a4]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0xf0]
cmp eax, 0x80070005
jne 0x140001e26
mov rcx, qword [rbp + 0x480]
xor r8d, r8d
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
js 0x140001e8f
mov rcx, qword [rbp + 0x480]
lea r8, [rbp + 0x488]
lea rdx, [0x140018610]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140001e8f
mov rcx, qword [rbp + 0x488]
mov r8d, r12d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x30]
cmp eax, 0x80070005
jne 0x140001e89
mov rcx, qword [rbp + 0x480]
xor r8d, r8d
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0xf0]
mov rcx, qword [rbp + 0x488]
mov r8d, r12d
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x30]
test eax, eax
cmovns ebx, r12d
mov r12, qword [rsp + 0x540]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001ea7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x480]
test rcx, rcx
je 0x140001eb9
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x488]
test rcx, rcx
je 0x140001ecb
mov rax, qword [rcx]
call qword [rax + 0x10]
test rsi, rsi
je 0x140001ee5
mov rcx, qword [0x14001e780]
mov r8, rsi
mov edx, 8
call qword [0x14001e798]
test rdi, rdi
je 0x140001eff
mov rcx, qword [0x14001e780]
mov r8, rdi
mov edx, 8
call qword [0x14001e798]
mov eax, ebx
add rsp, 0x548
pop rdi
pop rsi
pop rbx
pop rbp
ret