Function at 0x180002db0
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x188
mov rax, qword [0x1800c3380]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0xd8]
call fcn.1800039b0
mov rcx, rax
call fcn.18000de90
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x150], rcx
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xd0]
call fcn.180003ce0
mov rcx, rax
call fcn.18000df20
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x158], rcx
add rax, 8
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xc8]
call fcn.180004110
mov rcx, rax
call fcn.18000df20
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x160], rcx
add rax, 8
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0xc0]
call fcn.1800048d0
mov rcx, rax
call fcn.18000de90
mov rcx, rax
mov rax, qword [rsp + 0x80]
mov qword [rax], rcx
mov dword [rsp + 0x54], 0x2e09a454
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x34], eax
sub eax, 0x8abc854f
je 0x180003626
jmp 0x180002ea6
mov eax, dword [rsp + 0x34]
sub eax, 0x90f862e1
je 0x180003416
jmp 0x180002eba
mov eax, dword [rsp + 0x34]
sub eax, 0x9d91f00f
je 0x180003532
jmp 0x180002ece
mov eax, dword [rsp + 0x34]
sub eax, 0xc8b0ab7e
je 0x180003460
jmp 0x180002ee2
mov eax, dword [rsp + 0x34]
sub eax, 0xc9d65abe
je 0x18000392f
jmp 0x180002ef6
mov eax, dword [rsp + 0x34]
sub eax, 0xd5314fce
je 0x180003994
jmp 0x180002f0a
mov eax, dword [rsp + 0x34]
sub eax, 0xe0424138
je 0x180003640
jmp 0x180002f1e
mov eax, dword [rsp + 0x34]
sub eax, 0xe081c35b
je 0x18000353f
jmp 0x180002f32
mov eax, dword [rsp + 0x34]
sub eax, 0xef9b4568
je 0x18000376a
jmp 0x180002f46
mov eax, dword [rsp + 0x34]
sub eax, 0xf113b442
je 0x180003430
jmp 0x180002f5a
mov eax, dword [rsp + 0x34]
sub eax, 0xf1507f41
je 0x180003956
jmp 0x180002f6e
mov eax, dword [rsp + 0x34]
sub eax, 0xf335b66b
je 0x180003409
jmp 0x180002f82
mov eax, dword [rsp + 0x34]
sub eax, 0xf5853368
je 0x18000365e
jmp 0x180002f96
mov eax, dword [rsp + 0x34]
sub eax, 0xf6d9181b
je 0x1800038b3
jmp 0x180002faa
mov eax, dword [rsp + 0x34]
sub eax, 0xf922c698
je 0x180003849
jmp 0x180002fbe
mov eax, dword [rsp + 0x34]
sub eax, 0x13905d3
je 0x180003619
jmp 0x180002fd2
mov eax, dword [rsp + 0x34]
sub eax, 0xae5a0eb
je 0x180003297
jmp 0x180002fe6
mov eax, dword [rsp + 0x34]
sub eax, 0x13be2f95
je 0x180003301
jmp 0x180002ffa
mov eax, dword [rsp + 0x34]
sub eax, 0x1b9f1a96
je 0x18000337a
jmp 0x18000300e
mov eax, dword [rsp + 0x34]
sub eax, 0x290b1b99
je 0x180003987
jmp 0x180003022
mov eax, dword [rsp + 0x34]
sub eax, 0x2bc080eb
je 0x180003975
jmp 0x180003036
mov eax, dword [rsp + 0x34]
sub eax, 0x2e09a454
je 0x18000318f
jmp 0x18000304a
mov eax, dword [rsp + 0x34]
sub eax, 0x3020b514
je 0x18000320f
jmp 0x18000305e
mov eax, dword [rsp + 0x34]
sub eax, 0x3a572d07
je 0x18000393c
jmp 0x180003072
mov eax, dword [rsp + 0x34]
sub eax, 0x4477398b
je 0x18000354c
jmp 0x180003086
mov eax, dword [rsp + 0x34]
sub eax, 0x4ea211a8
je 0x18000359c
jmp 0x18000309a
mov eax, dword [rsp + 0x34]
sub eax, 0x59495edc
je 0x1800036db
jmp 0x1800030ae
mov eax, dword [rsp + 0x34]
sub eax, 0x63be4d53
je 0x1800032f4
jmp 0x1800030c2
mov eax, dword [rsp + 0x34]
sub eax, 0x66ebde81
je 0x18000332a
jmp 0x1800030d6
mov eax, dword [rsp + 0x34]
sub eax, 0x6bbd0f6b
je 0x18000375d
jmp 0x1800030ea
mov eax, dword [rsp + 0x34]
sub eax, 0x6d3c34de
je 0x18000383c
jmp 0x1800030fe
mov eax, dword [rsp + 0x34]
sub eax, 0x7058adbb
je 0x1800037ba
jmp 0x180003112
mov eax, dword [rsp + 0x34]
sub eax, 0x71461c1e
je 0x1800034dd
jmp 0x180003126
mov eax, dword [rsp + 0x34]
sub eax, 0x71992a8c
je 0x180003903
jmp 0x18000313a
mov eax, dword [rsp + 0x34]
sub eax, 0x7409b2c6
je 0x18000322d
jmp 0x18000314e
mov eax, dword [rsp + 0x34]
sub eax, 0x751fb327
je 0x180003968
jmp 0x180003162
mov eax, dword [rsp + 0x34]
sub eax, 0x768f77dd
je 0x180003863
jmp 0x180003176
mov eax, dword [rsp + 0x34]
sub eax, 0x792a9391
je 0x180003247
jmp 0x18000318a
jmp 0x18000399c
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xb8]
call fcn.180004ef0
mov rcx, rax
call fcn.18000de90
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rax + 8], rcx
mov dword [rsp + 0xb4], 0x64
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0xb4]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rax, [rsp + 0x150]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x54], 0x3020b514
jmp 0x18000399c
mov rax, qword [rsp + 0x88]
add rax, 0x28
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x54], 0x7409b2c6
jmp 0x18000399c
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x54], 0x792a9391
jmp 0x18000399c
mov eax, dword [0x1800c6bbc]
mov ecx, dword [0x1800c6bb8]
mov edx, eax
add edx, 0xeb9662bd
sub edx, 1
sub edx, 0xeb9662bd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9d65abe
mov ecx, 0xae5a0eb
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x98], rax
mov eax, dword [0x1800c6bbc]
mov ecx, dword [0x1800c6bb8]
mov edx, eax
sub edx, 0x230e97b8
sub edx, 1
add edx, 0x230e97b8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc9d65abe
mov ecx, 0x63be4d53
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov dword [rsp + 0x54], 0x13be2f95
jmp 0x18000399c
mov rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
mov eax, 0xf5853368
mov ecx, 0x66ebde81
cmp rdx, r8
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov eax, dword [0x1800c6bbc]
mov ecx, dword [0x1800c6bb8]
mov edx, eax
add edx, 0x84eece10
sub edx, 1
sub edx, 0x84eece10
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a572d07
mov ecx, 0x1b9f1a96
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x1800c6bbc]
mov eax, dword [0x1800c6bb8]
mov edx, ecx
sub edx, 0x823dbad7
sub edx, 1
add edx, 0x823dbad7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3a572d07
mov ecx, 0xf335b66b
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov dword [rsp + 0x54], 0x90f862e1
jmp 0x18000399c
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x54], 0xf113b442
jmp 0x18000399c
lea rcx, [rsp + 0xe0]
mov rdx, qword [rsp + 0xa0]
call fcn.1800928d0
mov edx, eax
mov eax, 0x4477398b
mov ecx, 0xc8b0ab7e
cmp edx, 0
cmove eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov ecx, dword [0x1800c6bbc]
mov eax, dword [0x1800c6bb8]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf1507f41
mov ecx, 0x71461c1e
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov byte [rsp + 0x7f], 1
mov eax, dword [0x1800c6bbc]
mov ecx, dword [0x1800c6bb8]
mov edx, eax
sub edx, 0xd3745421
sub edx, 1
add edx, 0xd3745421
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf1507f41
mov ecx, 0x9d91f00f
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov dword [rsp + 0x54], 0xe081c35b
jmp 0x18000399c
mov dword [rsp + 0x54], 0xf922c698
jmp 0x18000399c
mov eax, dword [0x1800c6bbc]
mov ecx, dword [0x1800c6bb8]
mov edx, eax
add edx, 0x2cf1e101
sub edx, 1
sub edx, 0x2cf1e101
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x751fb327
mov ecx, 0x4ea211a8
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov ecx, dword [0x1800c6bbc]
mov eax, dword [0x1800c6bb8]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x751fb327
mov ecx, 0x13905d3
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov dword [rsp + 0x54], 0x8abc854f
jmp 0x18000399c
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x54], 0xe0424138
jmp 0x18000399c
mov rax, qword [rsp + 0xa8]
add rax, 8
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x54], 0x7409b2c6
jmp 0x18000399c
mov ecx, dword [0x1800c6bbc]
mov eax, dword [0x1800c6bb8]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2bc080eb
mov ecx, 0x59495edc
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov byte [rsp + 0x7f], 0
mov ecx, dword [0x1800c6bbc]
mov eax, dword [0x1800c6bb8]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2bc080eb
mov ecx, 0x6bbd0f6b
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov dword [rsp + 0x54], 0xef9b4568
jmp 0x18000399c
mov eax, dword [0x1800c6bbc]
mov ecx, dword [0x1800c6bb8]
mov edx, eax
sub edx, 0xa919b639
sub edx, 1
add edx, 0xa919b639
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x290b1b99
mov ecx, 0x7058adbb
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov ecx, dword [0x1800c6bbc]
mov eax, dword [0x1800c6bb8]
mov edx, ecx
add edx, 0x58602eef
sub edx, 1
sub edx, 0x58602eef
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x290b1b99
mov ecx, 0x6d3c34de
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov dword [rsp + 0x54], 0xf922c698
jmp 0x18000399c
mov al, byte [rsp + 0x7f]
and al, 1
mov byte [rsp + 0xb3], al
mov dword [rsp + 0x54], 0x768f77dd
jmp 0x18000399c
mov eax, dword [0x1800c6bbc]
mov ecx, dword [0x1800c6bb8]
mov edx, eax
sub edx, 0x10d7f58b
sub edx, 1
add edx, 0x10d7f58b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd5314fce
mov ecx, 0xf6d9181b
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov eax, dword [0x1800c6bbc]
mov ecx, dword [0x1800c6bb8]
mov edx, eax
sub edx, 0xf72afee3
sub edx, 1
add edx, 0xf72afee3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd5314fce
mov ecx, 0x71992a8c
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x54], eax
jmp 0x18000399c
mov al, byte [rsp + 0xb3]
and al, 1
movzx eax, al
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1800891e0
mov eax, dword [rsp + 0x24]
add rsp, 0x188
ret
mov dword [rsp + 0x54], 0xae5a0eb
jmp 0x18000399c
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x54], 0x1b9f1a96
jmp 0x18000399c
mov byte [rsp + 0x7f], 1
mov dword [rsp + 0x54], 0x71461c1e
jmp 0x18000399c
mov dword [rsp + 0x54], 0x4ea211a8
jmp 0x18000399c
mov byte [rsp + 0x7f], 0
mov dword [rsp + 0x54], 0x59495edc
jmp 0x18000399c
mov dword [rsp + 0x54], 0x7058adbb
jmp 0x18000399c
mov dword [rsp + 0x54], 0xf6d9181b
jmp 0x180002e8e