Function at 0x140004ac8
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x320
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r15, qword [0x14002bac0]
lea rcx, [0x14002bbf0]
call qword [sym.imp.Cmmlib.dll_public:_bool___cdecl_Cmm::CStringT_wchar_t_::empty_void_const___ptr64]
xor ebx, ebx
test al, al
jne 0x140004f56
call qword [sym.imp.Cmmlib.dll_public:_static_class_Cmm::CommandLine____ptr64___cdecl_Cmm::CommandLine::ForCurrentProcess_void_]
mov r14, rax
test rax, rax
je 0x140004fc7
lea r13d, [rbx + 0xf]
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x58], 0xb
movsd xmm0, qword [str.runaszvideo]
movsd qword [rbp - 0x68], xmm0
movzx ecx, word [0x14001ab10]
mov word [rbp - 0x60], cx
mov cl, byte [0x14001ab12]
mov byte [rbp - 0x5e], cl
mov byte [rbp - 0x5d], bl
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Cmm::CommandLine::GetSwitchValueASCII_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140004bb4
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004baf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004baf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400152b8
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], r13
mov byte [rbp - 0x68], bl
lea rcx, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x10
cmovae rcx, rdi
cmp qword [rsp + 0x38], 4
jne 0x140004bf8
mov r8d, 4
lea rdx, str.TRUE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004f23
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], 7
mov eax, dword [str.multipt]
mov dword [rsp + 0x48], eax
movzx eax, word [0x14001ab24]
mov word [rsp + 0x4c], ax
mov al, byte [0x14001ab26]
mov byte [rsp + 0x4e], al
mov byte [rsp + 0x4f], bl
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Cmm::CommandLine::GetSwitchValueASCII_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
mov rdi, rax
lea rax, [rsp + 0x28]
cmp rax, rdi
je 0x140004cb1
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004c88
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ce4
call fcn.1400152b8
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x28], bl
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x38], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], r13
mov byte [rdi], bl
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140004cf0
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ceb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ceb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400152b8
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], r13
mov byte [rsp + 0x70], bl
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140004d3c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400152b8
lea rcx, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x10
cmovae rcx, rdi
cmp qword [rsp + 0x38], 4
jne 0x140004d75
mov r8d, 4
lea rdx, str.TRUE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004f23
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], 7
mov eax, dword [str.runasps]
mov dword [rsp + 0x48], eax
movzx eax, word [0x14001ab2c]
mov word [rsp + 0x4c], ax
mov al, byte [0x14001ab2e]
mov byte [rsp + 0x4e], al
mov byte [rsp + 0x4f], bl
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Cmm::CommandLine::GetSwitchValueASCII_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
mov rdi, rax
lea rax, [rsp + 0x28]
cmp rax, rdi
je 0x140004e2e
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004e05
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004e63
call fcn.1400152b8
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x28], bl
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x38], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], r13
mov byte [rdi], bl
mov rdx, qword [rbp - 0x78]
mov r14d, 0x1000
cmp rdx, 0x10
jb 0x140004e6f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x140004e6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400152b8
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], r13
mov byte [rsp + 0x70], bl
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140004eb7
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, r14
jb 0x140004eb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004eb2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400152b8
lea rcx, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x10
cmovae rcx, rdi
cmp qword [rsp + 0x38], 4
jne 0x140004eec
mov r8d, 4
lea rdx, str.TRUE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004f23
call fcn.140003294
test eax, eax
je 0x140004f10
call fcn.1400040f0
test eax, eax
jne 0x140004f10
call fcn.140004648
test eax, eax
jne 0x140004f10
call fcn.14000475c
test eax, eax
je 0x140004f19
call fcn.1400044e4
test eax, eax
je 0x140004f8b
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp rsi, 0x10
jb 0x140004f56
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140004f4e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004fbb
mov rcx, rdi
call fcn.1400152b8
mov eax, 1
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140014fd0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004fc7
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, r14
jb 0x140004fc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004fc2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400152b8
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CFileName::constructor_void____ptr64]
nop
xor edx, edx
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CFileName::GetModuleFileNameW_struct_HINSTANCE______ptr64____ptr64]
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CFileName::GetName_void_const___ptr64]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [0x14002bbf0]
lea rcx, [rbp - 0x20]
call qword [sym.imp.Cmmlib.dll_public:_bool___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t__const____ptr64_const___ptr64]
test al, al
je 0x140005172
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_void____ptr64]
nop
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0xff
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140005056
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call qword [reloc.Cmmlib.dll___4__CStringT__W_Cmm__QEAAAEAV01_PEB_W_Z]
lea rdx, str.Global_
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
lea rdi, [0x14001ab40]
test eax, eax
jne 0x14000509d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, [0x14002bbf0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
call fcn.1400040f0
test eax, eax
je 0x1400050d8
mov rdx, rdi
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.uploadCrashDump
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
call fcn.14000475c
test eax, eax
je 0x140005101
mov rdx, rdi
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.uploadFeedback
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
call fcn.14000746c
test al, al
je 0x14000512a
mov rdx, rdi
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, [0x14001ab88]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64_void_const___ptr64]
mov r9, rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r15], rax
test rax, rax
je 0x140005193
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140005193
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov ebx, 1
lea rcx, [rbp - 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CFileName::destructor_void____ptr64]
mov eax, ebx
jmp 0x140004f5b
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
jmp 0x140005177