Function at 0x14000e840
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x140017010]
xor rax, rsp
mov qword [rbp + 0x450], rax
mov r14, rcx
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x1fe
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0xff
lea rcx, [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
dec dword [rsp + 0x30]
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x1fc
call sub.VCRUNTIME140.dll_memset
movzx eax, word [rbp + 0x250]
lea rcx, [rsp + 0x50]
mov word [rsp + 0x50], ax
lea rdx, [rbp + 0x252]
test ax, ax
je 0x14000e8e5
movzx eax, word [rdx]
lea rdx, [rdx + 2]
add rcx, 2
mov word [rcx], ax
test ax, ax
jne 0x14000e8d2
xor edi, edi
movabs rax, 0x70bc32e8ca9f2753
mov qword [rsp + 0x40], rax
movabs rax, 0x70c63291cafe2717
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x50]
mov word [rcx], di
movabs rcx, 0xf06eb4d26fa0c70
mov qword [rsp + 0x28], rcx
vmovdqu xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
vpxor xmm1, xmm0, xmmword [rsp + 0x40]
vmovdqu xmmword [rsp + 0x20], xmm1
cmp word [rsp + 0x50], di
je 0x14000e949
nop word [rax + rax]
add rax, 2
cmp word [rax], di
jne 0x14000e940
lea rcx, [rsp + 0x50]
sub rax, rcx
lea rcx, [rsp + 0x50]
sar rax, 1
cdqe
lea rcx, [rcx + rax*2]
test rcx, rcx
je 0x14000e996
mov rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x22]
mov word [rcx], ax
test ax, ax
je 0x14000e993
nop word [rax + rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
add rcx, 2
mov word [rcx], ax
test ax, ax
jne 0x14000e980
mov word [rcx], di
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], di
jne 0x14000e9a2
movsxd rsi, ebx
lea rax, [rsi + rsi]
cmp rax, 0x1fe
jae 0x14000ebaa
xor edx, edx
mov word [rsp + rax + 0x50], di
mov r8d, 0xff
lea rcx, [rbp + 0x150]
call sub.VCRUNTIME140.dll_memset
mov edx, edi
test ebx, ebx
jle 0x14000eb38
cmp ebx, 8
jb 0x14000eb38
vmovaps xmmword [rsp + 0x590], xmm6
mov ecx, ebx
vmovaps xmmword [rsp + 0x580], xmm7
vmovaps xmmword [rsp + 0x570], xmm8
vmovaps xmmword [rsp + 0x560], xmm9
and ecx, 0x80000007
jge 0x14000ea1f
dec ecx
or ecx, 0xfffffff8
inc ecx
vmovdqu xmm0, xmmword [0x140013df0]
vmovdqu xmm6, xmmword [0x140013e00]
vmovdqu xmm8, xmmword [str._n_n_n_n]
mov eax, ebx
sub eax, ecx
movsxd r8, eax
mov eax, 2
vmovd xmm7, eax
mov eax, 0x1f
vmovdqu xmmword [rsp + 0x40], xmm0
mov ecx, dword [rsp + 0x40]
vmovd xmm9, eax
nop word [rax + rax]
vmovq xmm0, qword [rsp + rdi*2 + 0x50]
vpmovzxwd xmm5, xmm0
vpunpckldq xmm1, xmm5, xmm5
vpmuldq xmm3, xmm1, xmm6
vpunpckhdq xmm0, xmm5, xmm5
vpmuldq xmm2, xmm0, xmm6
vshufps xmm1, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm1, xmm7
vpsrld xmm0, xmm4, xmm9
vpaddd xmm1, xmm0, xmm4
vpmulld xmm2, xmm1, xmm8
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140013dd0]
vmovd xmm1, ecx
vpaddb xmm0, xmm4, xmm1
vmovd dword [rbp + rdi + 0x150], xmm0
vmovq xmm0, qword [rsp + rdi*2 + 0x58]
vpmovzxwd xmm5, xmm0
vpunpckldq xmm1, xmm5, xmm5
vpmuldq xmm3, xmm1, xmm6
vpunpckhdq xmm0, xmm5, xmm5
vpmuldq xmm2, xmm0, xmm6
vshufps xmm1, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm1, xmm7
vpsrld xmm0, xmm4, xmm9
vpaddd xmm1, xmm0, xmm4
vpmulld xmm2, xmm1, xmm8
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140013dd0]
vmovd xmm1, ecx
vpaddb xmm0, xmm4, xmm1
vmovd dword [rbp + rdi + 0x154], xmm0
add rdi, 8
add edx, 8
cmp rdi, r8
jl 0x14000ea60
vmovaps xmm9, xmmword [rsp + 0x560]
vmovaps xmm8, xmmword [rsp + 0x570]
vmovaps xmm7, xmmword [rsp + 0x580]
vmovaps xmm6, xmmword [rsp + 0x590]
movsxd r8, edx
cmp r8, rsi
jge 0x14000eb6d
movzx r9d, word [rsp + r8*2 + 0x50]
mov eax, 0xcccccccd
mul r9d
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub r9d, eax
add r9b, 0x30
mov byte [rbp + r8 + 0x150], r9b
inc r8
cmp r8, rsi
jl 0x14000eb40
lea eax, [rbx + 1]
mov rcx, r14
movsxd r8, eax
lea rdx, [rbp + 0x150]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.140010840
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140010c7c
int3