Function at 0x18000b940
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x268]
sub rsp, 0x340
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800960d0]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r15, rcx
movdqa xmm0, xmmword [0x180070700]
movdqu xmmword [rbp - 0x70], xmm0
xor r12d, r12d
mov word [rbp - 0x80], r12w
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x20]
call fcn.1800423b0
mov dword [rsp + 0x30], 0x104
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x30]
movdqa xmm0, xmmword [0x180070700]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.1800058b0
nop
lea rcx, [rbp - 0x40]
call fcn.180007ba0
nop
cmp byte [r15 + 0xd0], r12b
jne 0x18000bb47
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
call fcn.180006df0
test al, al
je 0x18000bb47
xor r8d, r8d
lea edx, [r12 + 0x1a]
lea rcx, [rsp + 0x40]
call fcn.180007a30
mov rbx, rax
lea rax, [rbp - 0x80]
cmp rax, rbx
je 0x18000ba72
lea rcx, [rbp - 0x80]
call fcn.1800056f0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000bab4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000baaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0ab
call fcn.180022960
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x40]
call fcn.180007a30
mov rbx, rax
lea rax, [rsp + 0x60]
cmp rax, rbx
je 0x18000bafd
lea rcx, [rsp + 0x60]
call fcn.1800056f0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000bd3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bd3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0b1
jmp 0x18000bd3a
lea rcx, [rsp + 0x40]
call fcn.180007c70
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x42
jb 0x18000bb9d
lea rdi, [rcx + 0x42]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov r8d, 0x84
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
call fcn.180041580
mov word [rbx + rdi*2], r12w
jmp 0x18000bbc0
xor eax, eax
mov qword [rsp + 0x20], 0x42
lea r9, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
movzx r8d, al
lea edx, [rax + 0x42]
lea rcx, [rsp + 0x40]
call fcn.180006240
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea r9, str.AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x20]
call fcn.180005760
mov rbx, rax
lea rax, [rbp - 0x80]
cmp rax, rbx
je 0x18000bc1c
lea rcx, [rbp - 0x80]
call fcn.1800056f0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18000bc5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bc57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0b7
call fcn.180022960
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x20]
call fcn.180005760
mov rbx, rax
lea rax, [rsp + 0x60]
cmp rax, rbx
je 0x18000bcbc
lea rcx, [rsp + 0x60]
call fcn.1800056f0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18000bcfd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bcf7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0bd
call fcn.180022960
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000bd3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bd3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0c3
call fcn.180022960
lea rbx, [r15 + 0x50]
lea rax, [rbp - 0x80]
cmp rbx, rax
je 0x18000bd66
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, rbx
call fcn.1800058b0
lea rdi, [r15 + 0x70]
lea rax, [rsp + 0x60]
cmp rdi, rax
je 0x18000bd92
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
mov rcx, rdi
call fcn.1800058b0
mov rcx, rbx
call fcn.180006a90
test eax, eax
jne 0x18000be04
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18000bde3
lea r14, [rcx + 1]
mov qword [rbx + 0x10], r14
mov rsi, rbx
cmp rdx, 8
jb 0x18000bdc6
mov rsi, qword [rbx]
lea rcx, [rsi + rcx*2]
mov r8d, 2
lea rdx, [0x18007068c]
call fcn.180041580
mov word [rsi + r14*2], r12w
jmp 0x18000be04
xor eax, eax
mov qword [rsp + 0x20], 1
lea r9, [0x18007068c]
movzx r8d, al
lea edx, [rax + 1]
mov rcx, rbx
call fcn.180006240
mov rcx, rdi
call fcn.180006a90
test eax, eax
jne 0x18000be73
mov rcx, qword [rdi + 0x10]
mov r9, qword [rdi + 0x18]
mov rax, r9
sub rax, rcx
cmp rax, 1
jb 0x18000be52
lea rsi, [rcx + 1]
mov qword [rdi + 0x10], rsi
cmp r9, 8
jb 0x18000be35
mov rdi, qword [rdi]
lea rcx, [rdi + rcx*2]
mov r8d, 2
lea rdx, [0x18007068c]
call fcn.180041580
mov word [rdi + rsi*2], r12w
jmp 0x18000be73
xor eax, eax
mov qword [rsp + 0x20], 1
lea r9, [0x18007068c]
movzx r8d, al
lea edx, [rax + 1]
mov rcx, rdi
call fcn.180006240
lea r9, [r15 + 0xb0]
cmp qword [r9 + 0x18], 8
jb 0x18000be84
mov r9, qword [r9]
cmp qword [rbx + 0x18], 8
jb 0x18000be8e
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str._s_s_
lea rcx, [rbp - 0x20]
call fcn.180006810
mov rdi, rax
lea rbx, [r15 + 0x30]
cmp rbx, rax
je 0x18000bed3
mov rcx, rbx
call fcn.1800056f0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18000bf13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bf0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0c9
call fcn.180022960
mov qword [rbp + 0x18], r12
cmp qword [rbx + 0x18], 8
jb 0x18000bf21
mov rbx, qword [rbx]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.180007830
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x18000bf48
mov rax, qword [rcx]
lea rdx, [rbp - 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18000bf88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bf83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0cf
call fcn.180022960
movdqa xmm0, xmmword [0x180070700]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r12w
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18000bfda
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bfd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0d5
call fcn.180022960
movdqa xmm0, xmmword [0x180070700]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000c02e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c029
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0db
call fcn.180022960
movdqa xmm0, xmmword [0x180070700]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000c07e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c079
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c0e1
call fcn.180022960
mov al, 1
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.180023170
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1800452ec
nop
call fcn.1800452ec
nop
call fcn.1800452ec
int3
call fcn.1800452ec
nop
call fcn.1800452ec
int3
call fcn.1800452ec
nop
call fcn.1800452ec
nop
call fcn.1800452ec
nop
call fcn.1800452ec
nop
call fcn.1800452ec
int3