Function at 0x140207fc0
Capabilities:
Get session user name

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3c8
movaps xmmword [rsp + 0x3b0], xmm7
movaps xmmword [rsp + 0x3a0], xmm6
mov ebp, edx
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x398], rax
mov rdi, qword [rcx + 0x638]
test rdi, rdi
jne 0x14020808a
mov ecx, 0x2a8
call fcn.1401a9d88
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x1402a0c90]
movups xmmword [rax + 0x30], xmm0
lea rcx, [rax + 0x40]
lea rbx, [rax + 0x1e8]
mov r8d, 0x1a4
xor edx, edx
call fcn.1401e5d50
mov r8d, 0xc0
mov rcx, rbx
xor edx, edx
call fcn.1401e5d50
mov rcx, rdi
call fcn.1401fa2c0
mov rbx, qword [rsi + 0x638]
mov qword [rsi + 0x638], rdi
test rbx, rbx
je 0x14020808a
mov rcx, rbx
call fcn.1400955c0
mov rcx, rbx
call fcn.1401a9dc4
mov rdi, qword [rsi + 0x638]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x130]
mov qword [rbx + 0x10], rax
movaps xmm6, xmmword [0x140299a90]
movaps xmmword [rbx], xmm6
xor eax, eax
lea r13, [rsp + 0x190]
mov qword [r13 + 0x10], rax
xorps xmm0, xmm0
movaps xmmword [r13], xmm0
lea r14, [rsp + 0xe0]
mov qword [r14 + 0x10], rax
movaps xmmword [r14], xmm0
lea r15, [rsi + 0x210]
lea r12, [rsp + 0x170]
mov rcx, r12
call fcn.14009bc10
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov rdx, r12
mov r8, r15
mov r9, r14
call fcn.140099f10
cmp byte [r12 + 0x17], 0
jns 0x140208112
mov rcx, qword [rsp + 0x170]
call fcn.1401a9dc4
cmp byte [rsp + 0xf7], 0
jns 0x140208129
mov rcx, qword [rsp + 0xe0]
call fcn.1401a9dc4
cmp byte [rsp + 0x1a7], 0
jns 0x140208140
mov rcx, qword [rsp + 0x190]
call fcn.1401a9dc4
xor r15d, r15d
lea rbx, [rsp + 0x110]
mov qword [rbx + 0x10], r15
xorps xmm7, xmm7
movaps xmmword [rbx], xmm7
lea rcx, [rsp + 0x130]
mov rdx, rbx
call fcn.1401fb5f0
lea r14, [rsp + 0xf0]
movaps xmmword [r14], xmm6
movaps xmmword [r14 - 0x10], xmm6
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14 + 0x10], rax
mov qword [r14], r15
mov dword [r14 - 8], 0xaaaaaa00
mov rcx, r14
xor edx, edx
call fcn.1401f1ee0
movups xmmword [r14 + 8], xmm7
lea rdx, [rsp + 0xe0]
mov rcx, rbx
call fcn.1401fb7b0
test al, al
jne 0x1402082a3
lea r9, [rsp + 0x170]
movaps xmmword [r9], xmm7
xor eax, eax
mov qword [r9 + 0x10], rax
lea r8, [rsp + 0x150]
mov qword [r8 + 0x10], rax
movaps xmmword [r8], xmm7
mov qword [rsp + 0x1a0], rax
movaps xmmword [rsp + 0x190], xmm7
mov qword [rsp + 0x20], r13
mov ecx, 3
mov edx, 0x7a
call fcn.140098460
cmp byte [rsp + 0x1a7], 0
jns 0x140208213
mov rcx, qword [rsp + 0x190]
call fcn.1401a9dc4
cmp byte [rsp + 0x167], 0
jns 0x14020822a
mov rcx, qword [rsp + 0x150]
call fcn.1401a9dc4
lea rcx, [rsp + 0xe0]
call fcn.1401efc20
cmp byte [rsp + 0x127], 0
jns 0x14020824e
mov rcx, qword [rsp + 0x110]
call fcn.1401a9dc4
cmp byte [rsp + 0x147], 0
jns 0x140208265
mov rcx, qword [rsp + 0x130]
call fcn.1401a9dc4
mov rcx, qword [rsp + 0x398]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x14020827f
call fcn.1401ac870
int3
movaps xmm6, xmmword [rsp + 0x3a0]
movaps xmm7, xmmword [rsp + 0x3b0]
add rsp, 0x3c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsi + 0x330]
movsx r8, byte [rsi + 0x347]
mov rdx, rbx
test r8, r8
jns 0x1402082c8
mov rdx, qword [rsi + 0x330]
mov r8, qword [rsi + 0x338]
add r8, rdx
lea rcx, [rsp + 0xe0]
call fcn.1401f1840
mov r14b, 1
test rax, rax
je 0x140208311
lea rcx, [rsp + 0xe0]
mov rdx, rbx
call fcn.1401f1960
cmp byte [rax + 8], 5
jne 0x140208311
lea rcx, [rsp + 0xe0]
mov rdx, rbx
call fcn.1401f1960
mov rcx, rax
call fcn.1401f0ef0
mov r14d, eax
lea r13, [rsi + 0x348]
movsx r8, byte [rsi + 0x35f]
mov rdx, r13
test r8, r8
jns 0x140208336
mov rdx, qword [rsi + 0x348]
mov r8, qword [rsi + 0x350]
lea r15, [rsi + 0x390]
add r8, rdx
lea rcx, [rsp + 0xe0]
call fcn.1401f1840
mov r12b, 1
test rax, rax
je 0x1402083de
lea rcx, [rsp + 0xe0]
mov rdx, r13
call fcn.1401f1960
movsx r8, byte [rsi + 0x3a7]
mov rdx, r15
test r8, r8
jns 0x140208387
mov rdx, qword [rsi + 0x390]
mov r8, qword [rsi + 0x398]
add r8, rdx
mov rcx, rax
call fcn.1401f1840
test rax, rax
je 0x1402083de
lea rcx, [rsp + 0xe0]
mov rdx, r13
call fcn.1401f1960
mov rcx, rax
mov rdx, r15
call fcn.1401f1960
cmp byte [rax + 8], 5
jne 0x1402083de
lea rcx, [rsp + 0xe0]
mov rdx, r13
call fcn.1401f1960
mov rcx, rax
mov rdx, r15
call fcn.1401f1960
mov rcx, rax
call fcn.1401f0ef0
mov r12d, eax
mov qword [rsp + 0x38], r15
lea rdx, [rsi + 0x360]
movsx r8, byte [rsi + 0x377]
mov qword [rsp + 0x30], rdx
test r8, r8
jns 0x14020840a
mov rdx, qword [rsi + 0x360]
mov r8, qword [rsi + 0x368]
add r8, rdx
lea rcx, [rsp + 0xe0]
call fcn.1401f1840
mov r15b, 1
test rax, rax
mov byte [rsp + 0x2f], bpl
je 0x14020845c
lea rcx, [rsp + 0xe0]
mov rdx, qword [rsp + 0x30]
call fcn.1401f1960
cmp byte [rax + 8], 5
jne 0x14020845c
lea rcx, [rsp + 0xe0]
mov rdx, qword [rsp + 0x30]
call fcn.1401f1960
mov rcx, rax
call fcn.1401f0ef0
mov r15d, eax
lea rbp, [rsi + 0x378]
movsx r8, byte [rsi + 0x38f]
mov rdx, rbp
test r8, r8
jns 0x140208481
mov rdx, qword [rsi + 0x378]
mov r8, qword [rsi + 0x380]
add r8, rdx
lea rcx, [rsp + 0xe0]
call fcn.1401f1840
test rax, rax
je 0x1402084b0
lea rcx, [rsp + 0xe0]
mov rdx, rbp
call fcn.1401f1960
cmp byte [rax + 8], 5
je 0x140208da8
cmp byte [rsp + 0x2f], 0
jne 0x140208688
mov edx, dword [rdi + 0x1d8]
test edx, edx
je 0x140208688
lea rax, [rsp + 0x191]
mov byte [rax + 0x16], 1
lea rcx, [0x14029ee79]
lea r8, [rsp + 0x190]
cmp r8, rcx
seta r8b
cmp rax, rcx
setbe al
or al, r8b
je 0x140208c60
lea rbx, [rsp + 0x1a8]
mov word [rbx - 0x18], 0x30
mov rcx, rbx
call fcn.1401a6e10
mov ecx, 0x30
call fcn.1401a9d88
mov qword [rsp + 0xc0], rax
lea r14, [rax + 0x30]
mov qword [rsp + 0xd0], r14
test rax, rax
lea r15, [rsp + 0x170]
je 0x140208c60
mov rdi, rax
mov rsi, rax
cmp byte [rsp + 0x1a7], 0
js 0x140208568
mov rax, qword [rsp + 0x1a0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x190]
movups xmmword [rsi], xmm0
jmp 0x140208580
mov rdx, qword [rsp + 0x190]
mov r8, qword [rsp + 0x198]
mov rcx, rsi
call fcn.140118510
lea rcx, [rdi + 0x18]
cmp byte [rsp + 0x1bf], 0
js 0x14020859e
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
jmp 0x1402085b3
mov rdx, qword [rsp + 0x1a8]
mov r8, qword [rsp + 0x1b0]
call fcn.140118510
lea r9, [rsp + 0xc0]
mov qword [r9 + 8], r14
xor eax, eax
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x170], xmm0
lea rbx, [rsp + 0x150]
mov qword [rbx + 0x10], rax
movaps xmmword [rbx], xmm0
mov qword [rsp + 0x20], r15
mov ecx, 3
mov edx, Ordinal_167
mov r8, rbx
call fcn.140098460
cmp byte [rbx + 0x17], 0
jns 0x14020860d
mov rcx, qword [rsp + 0x150]
call fcn.1401a9dc4
cmp byte [rsp + 0x187], 0
jns 0x140208624
mov rcx, qword [rsp + 0x170]
call fcn.1401a9dc4
add rdi, 0x18
je 0x140208c60
cmp byte [rsi + 0x2f], 0
js 0x140208674
cmp byte [rsi + 0x17], 0
js 0x14020867e
mov rcx, rsi
call fcn.1401a9dc4
cmp byte [rsp + 0x1bf], 0
jns 0x140208659
mov rcx, qword [rsp + 0x1a8]
call fcn.1401a9dc4
cmp byte [rsp + 0x1a7], 0
jns 0x14020822a
mov rcx, qword [rsp + 0x190]
jmp 0x140208225
mov rcx, qword [rdi]
call fcn.1401a9dc4
jmp 0x140208634
mov rcx, qword [rsi]
call fcn.1401a9dc4
jmp 0x14020863a
lea rdx, [rsi + 0x1f8]
mov rcx, rsi
call fcn.1400a0e90
lea r14, [rsp + 0x1a0]
mov qword [r14], 0
mov eax, 0xfffffe00
and eax, dword [r14 - 8]
or eax, 5
mov dword [r14 - 8], eax
mov rcx, r14
xor edx, edx
call fcn.1401f1ee0
xorps xmm0, xmm0
movups xmmword [r14 + 8], xmm0
mov byte [r14 - 0x10], 0
movsx r8, byte [rsi + 0x347]
test r8, r8
jns 0x1402086e8
mov rbx, qword [rsi + 0x330]
mov r8, qword [rsi + 0x338]
add r8, rbx
lea r14, [rsp + 0xe0]
mov rcx, r14
mov rdx, rbx
call fcn.1401f1540
lea rbx, [rsp + 0x190]
mov rcx, rbx
mov rdx, rax
call fcn.1401f03a0
mov rcx, rbx
call fcn.1401efc20
movsx r8, byte [rsi + 0x35f]
mov rdx, r13
test r8, r8
jns 0x140208737
mov rdx, qword [rsi + 0x348]
mov r8, qword [rsi + 0x350]
add r8, rdx
mov rcx, r14
call fcn.1401f1840
lea rbx, [rsp + 0x1a0]
test rax, rax
je 0x1402087a4
mov qword [rbx], 0
mov eax, 0xfffffe00
and eax, dword [rbx - 8]
or eax, 5
mov dword [rbx - 8], eax
mov rcx, rbx
xor edx, edx
call fcn.1401f1ee0
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
mov byte [rbx - 0x10], 0
movsx r8, byte [rsi + 0x35f]
test r8, r8
jns 0x140208794
mov r13, qword [rsi + 0x348]
mov r8, qword [rsi + 0x350]
add r8, r13
lea rcx, [rsp + 0xe0]
jmp 0x14020885d
xor r12d, r12d
mov qword [rbx], r12
mov r15d, 0xfffffe00
and dword [rbx - 8], r15d
mov rcx, rbx
xor edx, edx
call fcn.1401f1ee0
xorps xmm6, xmm6
movups xmmword [rbx + 8], xmm6
movsx r8, byte [rsi + 0x35f]
mov rdx, r13
test r8, r8
jns 0x1402087e3
mov rdx, qword [rsi + 0x348]
mov r8, qword [rsi + 0x350]
add r8, rdx
lea rbx, [rsp + 0xe0]
mov rcx, rbx
call fcn.1401f1540
lea r14, [rsp + 0x190]
mov rcx, r14
mov rdx, rax
call fcn.1401f03a0
mov rcx, r14
call fcn.1401efc20
lea r14, [rsp + 0x1a0]
mov qword [r14], r12
and r15d, dword [r14 - 8]
or r15d, 5
mov dword [r14 - 8], r15d
mov rcx, r14
xor edx, edx
call fcn.1401f1ee0
movups xmmword [r14 + 8], xmm6
mov byte [r14 - 0x10], 0
movsx r8, byte [rsi + 0x35f]
test r8, r8
jns 0x140208857
mov r13, qword [rsi + 0x348]
mov r8, qword [rsi + 0x350]
add r8, r13
mov rcx, rbx
mov rdx, r13
call fcn.1401f1540
movsx r8, byte [rsi + 0x3a7]
test r8, r8
jns 0x140208885
mov rcx, qword [rsi + 0x390]
mov qword [rsp + 0x38], rcx
mov r8, qword [rsi + 0x398]
mov rdx, qword [rsp + 0x38]
add r8, rdx
mov rcx, rax
call fcn.1401f1540
lea rbx, [rsp + 0x190]
mov rcx, rbx
mov rdx, rax
call fcn.1401f03a0
mov rcx, rbx
call fcn.1401efc20
lea rbx, [rsp + 0x1a0]
xor r15d, r15d
mov qword [rbx], r15
mov r13d, 0xfffffe00
mov eax, dword [rbx - 8]
and eax, r13d
or eax, 5
mov dword [rbx - 8], eax
mov rcx, rbx
xor edx, edx
call fcn.1401f1ee0
xorps xmm6, xmm6
movups xmmword [rbx + 8], xmm6
mov byte [rbx - 0x10], r15b
movsx r8, byte [rsi + 0x377]
test r8, r8
jns 0x140208905
mov rax, qword [rsi + 0x360]
mov qword [rsp + 0x30], rax
mov r8, qword [rsi + 0x368]
mov rdx, qword [rsp + 0x30]
add r8, rdx
lea rbx, [rsp + 0xe0]
mov rcx, rbx
call fcn.1401f1540
lea r14, [rsp + 0x190]
mov rcx, r14
mov rdx, rax
call fcn.1401f03a0
mov rcx, r14
call fcn.1401efc20
lea r14, [rsp + 0x1a0]
mov qword [r14], r15
and r13d, dword [r14 - 8]
or r13d, 5
mov dword [r14 - 8], r13d
mov rcx, r14
xor edx, edx
call fcn.1401f1ee0
movups xmmword [r14 + 8], xmm6
mov byte [r14 - 0x10], r15b
movsx r8, byte [rsi + 0x38f]
test r8, r8
jns 0x14020897d
mov rbp, qword [rsi + 0x378]
mov r8, qword [rsi + 0x380]
add r8, rbp
mov rcx, rbx
mov rdx, rbp
call fcn.1401f1540
lea r14, [rsp + 0x190]
mov rcx, r14
mov rdx, rax
call fcn.1401f03a0
mov rcx, r14
call fcn.1401efc20
lea r14, [rsp + 0x190]
mov rcx, r14
mov rdx, rbx
call fcn.1401fbb70
lea rcx, [rsp + 0x130]
mov rdx, r14
call fcn.1401fb930
cmp byte [r14 + 0x17], r15b
jns 0x1402089dc
mov rcx, qword [rsp + 0x190]
call fcn.1401a9dc4
lea rcx, [0x14029ee6e]
lea rax, [0x14029ee79]
cmp byte [rsp + 0x2f], 0
cmovne rax, rcx
lea rcx, [rsp + 0x191]
mov byte [rcx + 0x16], 1
cmp rax, r14
setb dl
cmp rax, rcx
setae cl
or cl, dl
je 0x140208c60
mov al, byte [rax]
lea r15, [rsp + 0x1a8]
mov byte [r15 - 0x18], al
mov byte [r15 - 0x17], 0
mov edx, dword [rdi + 0x1d8]
mov rcx, r15
call fcn.1401a6e10
mov ecx, 0x30
call fcn.1401a9d88
mov qword [rsp + 0xc0], rax
lea r12, [rax + 0x30]
mov qword [rsp + 0xd0], r12
test rax, rax
je 0x140208c60
mov r14, rax
mov rbx, rax
cmp byte [rsp + 0x1a7], 0
js 0x140208a84
mov rax, qword [rsp + 0x1a0]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0x190]
movups xmmword [rbx], xmm0
jmp 0x140208a9c
mov rdx, qword [rsp + 0x190]
mov r8, qword [rsp + 0x198]
mov rcx, rbx
call fcn.140118510
lea rcx, [r14 + 0x18]
cmp byte [rsp + 0x1bf], 0
jns 0x140208adb
mov rdx, qword [rsp + 0x1a8]
mov r8, qword [rsp + 0x1b0]
call fcn.140118510
jmp 0x140208aea
mov rcx, qword [r14]
call fcn.1401a9dc4
jmp 0x140208b79
mov rcx, qword [rbx]
call fcn.1401a9dc4
jmp 0x140208b83
mov rax, qword [r15 + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [r15]
movups xmmword [rcx], xmm0
lea r9, [rsp + 0xc0]
mov qword [r9 + 8], r12
xor eax, eax
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x170], xmm0
lea r15, [rsp + 0x150]
mov qword [r15 + 0x10], rax
movaps xmmword [r15], xmm0
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
mov ecx, 3
mov edx, pe_nt_image_headers64
mov r8, r15
call fcn.140098460
cmp byte [r15 + 0x17], 0
jns 0x140208b4e
mov rcx, qword [rsp + 0x150]
call fcn.1401a9dc4
cmp byte [rsp + 0x187], 0
jns 0x140208b65
mov rcx, qword [rsp + 0x170]
call fcn.1401a9dc4
add r14, 0x18
je 0x140208c60
cmp byte [rbx + 0x2f], 0
js 0x140208ac1
cmp byte [rbx + 0x17], 0
js 0x140208ace
mov rcx, rbx
call fcn.1401a9dc4
cmp byte [rsp + 0x1bf], 0
jns 0x140208ba2
mov rcx, qword [rsp + 0x1a8]
call fcn.1401a9dc4
cmp byte [rsp + 0x1a7], 0
jns 0x140208bb9
mov rcx, qword [rsp + 0x190]
call fcn.1401a9dc4
mov dword [rdi + 0x1d8], 1
mov rdi, qword [rsi + 0x638]
test rdi, rdi
jne 0x140208c53
mov ecx, 0x2a8
call fcn.1401a9d88
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x1402a0c90]
movups xmmword [rax + 0x30], xmm0
lea rcx, [rax + 0x40]
lea rbx, [rax + 0x1e8]
mov r8d, 0x1a4
xor edx, edx
call fcn.1401e5d50
mov r8d, 0xc0
mov rcx, rbx
xor edx, edx
call fcn.1401e5d50
mov rcx, rdi
call fcn.1401fa2c0
mov rbx, qword [rsi + 0x638]
mov qword [rsi + 0x638], rdi
test rbx, rbx
je 0x140208c53
mov rcx, rbx
call fcn.1400955c0
mov rcx, rbx
call fcn.1401a9dc4
mov rdi, qword [rsi + 0x638]
mov rcx, rdi
call fcn.1401f4a90
jmp 0x14020822a
ud2
lea rcx, [0x14029ee6e]
lea rax, [0x14029ee79]
cmp byte [rsp + 0x2f], 0
cmovne rax, rcx
lea rcx, [rsp + 0x191]
mov byte [rcx + 0x16], 1
cmp rax, r13
setb dl
cmp rax, rcx
setae cl
or cl, dl
je 0x140208c60
mov al, byte [rax]
lea rbx, [rsp + 0x1a8]
mov byte [rbx - 0x18], al
mov byte [rbx - 0x17], 0
mov edx, dword [rdi + 0x1d8]
mov rcx, rbx
call fcn.1401a6e10
mov ecx, 0x30
call fcn.1401a9d88
mov qword [rsp + 0xc0], rax
lea r14, [rax + 0x30]
mov qword [rsp + 0xd0], r14
test rax, rax
lea r15, [rsp + 0x170]
je 0x140208c60
mov rdi, rax
mov rsi, rax
cmp byte [rsp + 0x1a7], 0
js 0x140208d08
mov rax, qword [rsp + 0x1a0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x190]
movups xmmword [rsi], xmm0
jmp 0x140208d20
mov rdx, qword [rsp + 0x190]
mov r8, qword [rsp + 0x198]
mov rcx, rsi
call fcn.140118510
lea rcx, [rdi + 0x18]
cmp byte [rsp + 0x1bf], 0
js 0x140208d3e
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
jmp 0x140208d53
mov rdx, qword [rsp + 0x1a8]
mov r8, qword [rsp + 0x1b0]
call fcn.140118510
lea r9, [rsp + 0xc0]
mov qword [r9 + 8], r14
xor eax, eax
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x170], xmm0
lea rbx, [rsp + 0x150]
mov qword [rbx + 0x10], rax
movaps xmmword [rbx], xmm0
mov qword [rsp + 0x20], r15
mov ecx, 3
mov edx, 0x79
jmp 0x1402085f2
lea rcx, [rsp + 0x150]
mov byte [rcx + 0x17], r14b
jmp 0x140208e9c
lea rcx, [rsp + 0xe0]
mov rdx, rbp
call fcn.1401f1960
mov rcx, rax
call fcn.1401f0ef0
or r14b, r12b
or r14b, r15b
jne 0x1402084b0
test al, al
jne 0x1402084b0
cmp dword [rdi + 0x1d8], 1
lea r13, [rsp + 0x190]
jne 0x140208c62
movabs r15, 0x7ffffffffffffff7
mov r8d, 0x208
mov rcx, r13
mov dl, 0xaa
call fcn.1401e5d50
lea rdx, [rsp + 0x170]
mov dword [rdx], 0x104
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
lea rbx, [0x14029ebca]
cmovne rbx, r13
mov rcx, rbx
call fcn.1401aa1e8
cmp rax, r15
ja 0x1402095ee
mov r14, rax
cmp rax, 0xa
jbe 0x140208d97
mov rax, r14
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r15d, Ordinal_14
cmovne r15, rcx
test r15, r15
js 0x1402095e9
lea rcx, [r15 + r15]
call fcn.1401a9d88
mov rcx, rax
mov qword [rsp + 0x150], rax
movabs rax, 0x7ffffffffffffff7
add rax, r15
add rax, 9
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x158], r14
lea r15, [rcx + r14*2]
cmp rbx, rcx
setb al
cmp rbx, r15
setae dl
or dl, al
je 0x140208c60
test r14, r14
je 0x140208ec7
add r14, r14
mov rdx, rbx
mov r8, r14
call fcn.1401e56b0
mov word [r15], 0
lea r15, [rsp + 0x170]
lea rdx, [rsp + 0x150]
mov rcx, r15
call fcn.14009b970
movsx r12, byte [0x1402ec997]
mov rbx, r12
test r12, r12
jns 0x140208efc
mov rbx, qword [0x1402ec988]
lea r13, [rbx + 1]
movaps xmmword [rsp + 0x60], xmm6
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movabs rax, 0x7ffffffffffffff7
cmp r13, rax
ja 0x1402095fb
cmp r13, 0x16
ja 0x140208f76
xorps xmm0, xmm0
lea rax, [rsp + 0x60]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov byte [rax + 0x17], r13b
lea rcx, [rax + 1]
lea r13, [0x14029ee53]
cmp rax, r13
seta dl
cmp rcx, r13
setbe r8b
or r8b, dl
je 0x140208c60
mov byte [rax], 0x5c
test r12b, r12b
js 0x140208fb9
lea rdx, [0x1402ec980]
jmp 0x140208fc0
mov rax, r13
or rax, 7
lea rcx, [rax + 1]
cmp rax, 0x17
mov r14d, Ordinal_26
cmovne r14, rcx
mov rcx, r14
call fcn.1401a9d88
movabs rcx, 0x7ffffffffffffff7
add rcx, 9
or rcx, r14
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r13
jmp 0x140208f44
mov rdx, qword [0x1402ec980]
test rbx, rbx
js 0x140208c60
lea r14, [rcx + rbx]
cmp rdx, rcx
setb al
cmp rdx, r14
setae r8b
or r8b, al
je 0x140208c60
test rbx, rbx
je 0x140208ff0
mov r8, rbx
call fcn.1401e56b0
mov byte [r14], 0
lea rdx, str.__al
lea rcx, [rsp + 0x60]
mov r8d, 1
call fcn.140174f40
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
xor ebx, ebx
mov qword [rax + 0x10], rbx
xorps xmm7, xmm7
movups xmmword [rax], xmm7
movsx r8, byte [0x1402ec9af]
test r8, r8
jns 0x14020904b
mov r8, qword [0x1402ec9a0]
mov rdx, qword [0x1402ec998]
jmp 0x140209052
lea rdx, [0x1402ec998]
lea rcx, [rsp + 0x80]
call fcn.140174f40
movups xmm0, xmmword [rax]
lea rcx, [rsp + 0xa0]
movaps xmmword [rcx], xmm0
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
mov qword [rax + 0x10], rbx
movups xmmword [rax], xmm7
lea rdx, [0x14029ed23]
mov r8d, 1
call fcn.140174f40
movups xmm0, xmmword [rax]
lea rcx, [rsp + 0xc0]
movaps xmmword [rcx], xmm0
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
mov qword [rax + 0x10], rbx
movups xmmword [rax], xmm7
movsx r8, byte [rsp + 0x187]
test r8, r8
cmovs r8, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x170]
cmovns rdx, r15
call fcn.140174f40
movups xmm0, xmmword [rax]
lea r14, [rsp + 0x190]
movaps xmmword [r14], xmm0
mov rcx, qword [rax + 0x10]
mov qword [r14 + 0x10], rcx
mov qword [rax + 0x10], rbx
movups xmmword [rax], xmm7
lea rdx, [0x1402ec9b0]
mov rcx, r14
call fcn.1400a3b10
mov byte [rsp + 0x30], al
cmp byte [r14 + 0x17], 0
jns 0x140209116
mov rcx, qword [rsp + 0x190]
call fcn.1401a9dc4
cmp byte [rsp + 0xd7], 0
jns 0x14020912d
mov rcx, qword [rsp + 0xc0]
call fcn.1401a9dc4
cmp byte [rsp + 0xb7], 0
jns 0x140209144
mov rcx, qword [rsp + 0xa0]
call fcn.1401a9dc4
cmp byte [rsp + 0x97], 0
jns 0x14020915b
mov rcx, qword [rsp + 0x80]
call fcn.1401a9dc4
cmp byte [rsp + 0x77], 0
jns 0x14020916c
mov rcx, qword [rsp + 0x60]
call fcn.1401a9dc4
cmp byte [rsp + 0x187], 0
jns 0x140209183
mov rcx, qword [rsp + 0x170]
call fcn.1401a9dc4
mov rbx, r13
cmp byte [rsp + 0x167], 0
jns 0x14020919d
mov rcx, qword [rsp + 0x150]
call fcn.1401a9dc4
movsx r13, byte [rsi + 0x20f]
mov r12, r13
test r13, r13
jns 0x1402091b4
mov r12, qword [rsi + 0x200]
lea rbp, [r12 + 1]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmmword [rsp + 0x40], xmm6
movabs rax, 0x7ffffffffffffff7
cmp rbp, rax
ja 0x140209605
cmp rbp, 0x16
ja 0x1402092c5
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov byte [rax + 0x17], bpl
lea rcx, [rax + 1]
cmp rax, rbx
seta dl
cmp rcx, rbx
setbe r8b
or r8b, dl
je 0x140208c60
lea r14, [rsi + 0x1f8]
mov byte [rax], 0x5c
mov rdx, r14
test r13b, r13b
jns 0x140209230
mov rdx, qword [r14]
test r12, r12
js 0x140208c60
lea r13, [rcx + r12]
cmp rdx, rcx
setb al
cmp rdx, r13
setae r8b
or r8b, al
je 0x140208c60
test r12, r12
je 0x140209260
mov r8, r12
call fcn.1401e56b0
mov byte [r13], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], 0
movsx rax, byte [rsp + 0x57]
mov r12, rax
test rax, rax
jns 0x14020928f
mov r12, qword [rsp + 0x48]
test r12, r12
lea r13, [rsp + 0x190]
je 0x1402093b3
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x180], rcx
movaps xmmword [rsp + 0x170], xmm6
test al, al
js 0x140209315
lea r13, [rsp + 0x40]
jmp 0x14020931a
mov rax, rbp
or rax, 7
lea rcx, [rax + 1]
cmp rax, 0x17
mov r14d, Ordinal_26
cmovne r14, rcx
mov rcx, r14
call fcn.1401a9d88
movabs rcx, 0x7ffffffffffffff7
add rcx, 9
or rcx, r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbp
jmp 0x140209201
mov byte [rsp + 0x187], r12b
jmp 0x14020938d
mov r13, qword [rsp + 0x40]
movabs rax, 0x7ffffffffffffff7
cmp r12, rax
ja 0x14020960f
cmp r12, 0xa
jbe 0x14020930b
mov rax, r12
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov ebp, Ordinal_14
cmovne rbp, rcx
test rbp, rbp
js 0x1402095e9
lea rcx, [rbp*2]
call fcn.1401a9d88
mov r15, rax
mov qword [rsp + 0x170], rax
movabs rax, 0x7ffffffffffffff7
add rax, rbp
add rax, 9
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x178], r12
xor eax, eax
movsx ecx, byte [r13 + rax]
mov word [r15 + rax*2], cx
inc rax
cmp r12, rax
jne 0x14020938f
mov word [r15 + rax*2], 0
lea r13, [rsp + 0x190]
jmp 0x1402093c7
movaps xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], 0
lea r15, [rsp + 0x170]
lea r12, [rsp + 0x190]
mov rcx, r15
mov rdx, r12
call fcn.1400a04e0
mov ebp, eax
cmp byte [rsp + 0x57], 0
jns 0x1402093f5
mov rcx, qword [rsp + 0x40]
call fcn.1401a9dc4
xor bpl, 1
or byte [rsp + 0x30], bpl
jne 0x140208c62
mov dword [rdi + 0x1d8], 2
mov rbx, qword [rsi + 0x638]
test rbx, rbx
mov bpl, byte [rsp + 0x2f]
jne 0x1402094a3
mov ecx, 0x2a8
call fcn.1401a9d88
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x1402a0c90]
movups xmmword [rax + 0x30], xmm0
lea rcx, [rax + 0x40]
lea r13, [rax + 0x1e8]
mov r8d, 0x1a4
xor edx, edx
call fcn.1401e5d50
mov r8d, 0xc0
mov rcx, r13
xor edx, edx
call fcn.1401e5d50
mov rcx, rbx
call fcn.1401fa2c0
mov r13, qword [rsi + 0x638]
mov qword [rsi + 0x638], rbx
test r13, r13
je 0x1402094a3
mov rcx, r13
call fcn.1400955c0
mov rcx, r13
call fcn.1401a9dc4
mov rbx, qword [rsi + 0x638]
mov rcx, rbx
call fcn.1401f4a90
mov rcx, rsi
mov rdx, r14
call fcn.1400a0e90
lea rcx, [0x14029ee6e]
lea rax, [0x14029ee79]
test bpl, bpl
cmovne rax, rcx
lea rcx, [rsp + 0x191]
mov byte [rcx + 0x16], 1
cmp rax, r12
setb dl
cmp rax, rcx
setae cl
or cl, dl
je 0x140208c60
mov al, byte [rax]
lea rbx, [rsp + 0x1a8]
mov byte [rbx - 0x18], al
mov byte [rbx - 0x17], 0
mov edx, dword [rdi + 0x1d8]
mov rcx, rbx
call fcn.1401a6e10
mov ecx, 0x30
call fcn.1401a9d88
mov qword [rsp + 0xc0], rax
lea r14, [rax + 0x30]
mov qword [rsp + 0xd0], r14
test rax, rax
je 0x140208c60
mov rdi, rax
mov rsi, rax
cmp byte [rsp + 0x1a7], 0
jns 0x14020955b
mov rdx, qword [rsp + 0x190]
mov r8, qword [rsp + 0x198]
mov rcx, rsi
call fcn.140118510
jmp 0x140209572
mov rax, qword [rsp + 0x1a0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x190]
movups xmmword [rsi], xmm0
lea rcx, [rdi + 0x18]
cmp byte [rsp + 0x1bf], 0
js 0x140209590
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
jmp 0x1402095a5
mov rdx, qword [rsp + 0x1a8]
mov r8, qword [rsp + 0x1b0]
call fcn.140118510
lea r9, [rsp + 0xc0]
mov qword [r9 + 8], r14
xor eax, eax
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x170], xmm0
lea rbx, [rsp + 0x150]
mov qword [rbx + 0x10], rax
movaps xmmword [rbx], xmm0
mov qword [rsp + 0x20], r15
mov ecx, 3
mov edx, 0xa2
jmp 0x1402085f2
call fcn.1401e9820
lea rcx, [rsp + 0x150]
call fcn.1401e97e0
lea rcx, [rsp + 0x60]
call fcn.1401e97e0
lea rcx, [rsp + 0x40]
call fcn.1401e97e0
lea rcx, [rsp + 0x170]
call fcn.1401e97e0
int3