Function at 0x7ff73825ee80
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x7ff7382e3088]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14, rdx
mov r12, rcx
mov qword [rbp + 0xa8], rdx
xor r13d, r13d
call fcn.7ff73825a590
mov dword [rbp + 0xb0], 0x64
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x100]
call qword [sym.imp.advapi32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
lea rax, [rbp + 0x100]
mov rcx, 0xffffffffffffffff
mov rbx, rcx
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff73825ef10
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x7ff73825f6a2
mov eax, 0x16
cmp rbx, 0x10
jae 0x7ff73825ef7e
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], 0xf
mov r8, rbx
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xb8]
call fcn.7ff7382b2ce4
mov byte [rbp + rbx + 0xb8], 0
mov rdi, qword [rbp + 0xd0]
mov rbx, qword [rbp + 0xc8]
mov r15, qword [rbp + 0xb8]
jmp 0x7ff73825efdc
mov rdi, rbx
or rdi, 0xf
cmp rdi, rsi
jbe 0x7ff73825ef8f
mov rdi, rsi
jmp 0x7ff73825ef96
cmp rdi, rax
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, rcx
lea rcx, [rbp + 0xb8]
call fcn.7ff73823e1a0
mov r15, rax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], rdi
mov r8, rbx
lea rdx, [rbp + 0x100]
mov rcx, rax
call fcn.7ff7382b2ce4
mov byte [r15 + rbx], 0
mov dword [rsp + 0x58], reloc.ucrtbase.dll_free
mov dword [rsp + 0x5c], reloc.ucrtbase.dll_free
mov word [rsp + 0x60], 0xee
mov byte [rsp + 0x62], 1
mov dword [rsp + 0x20], reloc.ucrtbase.dll_free
mov dword [rsp + 0x24], reloc.ucrtbase.dll_free
mov dword [rsp + 0x68], reloc.ucrtbase.dll_free
mov dword [rsp + 0x6c], reloc.ucrtbase.dll_free
mov dword [rsp + 0x70], reloc.ucrtbase.dll_free
mov byte [rsp + 0x74], 1
mov dword [rsp + 0x48], reloc.ucrtbase.dll_free
mov dword [rsp + 0x4c], reloc.ucrtbase.dll_free
mov word [rsp + 0x50], 0xee
mov byte [rsp + 0x52], 1
mov dword [rsp + 0x28], reloc.ucrtbase.dll_free
mov dword [rsp + 0x2c], reloc.ucrtbase.dll_free
mov word [rsp + 0x30], 0x100
mov dword [rsp + 0x38], reloc.ucrtbase.dll_free
mov dword [rsp + 0x3c], reloc.ucrtbase.dll_free
mov word [rsp + 0x40], 0x100
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x78]
call fcn.7ff738251bb0
nop
lea rdx, [rbp + 0xb8]
cmp rdi, 0x10
cmovae rdx, r15
mov r8, rbx
mov rcx, rax
call fcn.7ff73823d630
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x58]
call fcn.7ff738251db0
nop
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x7ff73825f0db
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
mov rcx, rax
call fcn.7ff73823d630
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x38]
call fcn.7ff738251e90
nop
lea rdx, [r12 + 0x238]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff73825f12e
mov rdx, qword [rdx]
mov rcx, rax
call fcn.7ff73823d630
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 8]
call fcn.7ff738251ad0
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x7ff73825f176
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.7ff73823d630
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x28]
call fcn.7ff738251db0
nop
lea rdx, [r12 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff73825f1c9
mov rdx, qword [rdx]
mov rcx, rax
call fcn.7ff73823d630
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x7ff73825f233
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f22e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f22e
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
movdqa xmm0, xmmword [0x7ff7382d2c70]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x7ff73825f284
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f27e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f27e
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x7ff73825f2c2
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f2bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f2bd
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
movdqa xmm0, xmmword [0x7ff7382d2c70]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x7ff73825f312
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f30c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f30c
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x7ff73825f350
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f34b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f34b
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
movdqa xmm0, xmmword [0x7ff7382d2c70]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x7ff73825f3a0
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f39a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f39a
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x7ff73825f3de
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f3d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f3d9
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
movdqa xmm0, xmmword [0x7ff7382d2c70]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x7ff73825f42e
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f428
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f428
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x7ff73825f46f
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f46a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f46a
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
movdqa xmm0, xmmword [0x7ff7382d2c70]
movdqu xmmword [rbp + 0x88], xmm0
mov byte [rbp + 0x78], 0
lea rax, [rbp - 0x48]
mov qword [rbp + 0x98], rax
lea rdx, [r12 + 0x80]
lea rcx, [rbp - 0x48]
call fcn.7ff73824f7b0
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
lea r15, [rbp + 0xd8]
mov rdi, qword [rbp + 0xd8]
mov r13, qword [rbp + 0xf0]
cmp r13, 0x10
cmovae r15, rdi
mov rbx, qword [rbp + 0xe8]
cmp rbx, rsi
ja 0x7ff73825f69c
mov qword [rbp - 0x70], 0xf
cmp rbx, 0x10
jae 0x7ff73825f4fc
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x78], xmm0
jmp 0x7ff73825f551
mov rax, rbx
or rax, 0xf
cmp rax, rsi
ja 0x7ff73825f518
mov rsi, rax
cmp rax, 0x16
mov eax, 0x16
cmovb rsi, rax
mov rdx, rsi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x78]
call fcn.7ff73823e1a0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
lea r8, [rbx + 1]
mov rdx, r15
mov rcx, rax
call fcn.7ff7382b2ce4
nop
mov r8, r12
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.7ff738260f80
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x7ff73825f5a1
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f59b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f59b
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
nop
cmp r13, 0x10
jb 0x7ff73825f5dc
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x7ff73825f5d3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f5d3
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
mov rcx, rdi
call fcn.7ff7382b1a4c
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x7ff73825f621
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff73825f61b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff73825f61b
jmp qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
call fcn.7ff7382b1a4c
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x7ff73825f657
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x7ff73825f652
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff73825f695
mov rcx, r8
call fcn.7ff7382b1a4c
mov qword [r14 + 0x10], 0
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.7ff7382b2290
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff73823ab20
nop
call fcn.7ff73823ab20
int3