Function at 0x140063c48
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1400b02e8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, r8
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
mov dword [rbp - 0x39], r15d
lea rcx, [rbp - 0x31]
call fcn.14003ea88
mov eax, dword [rbp - 0x39]
test eax, eax
jne 0x140063ca1
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
nop dword [rax + rax]
mov dword [rbp - 0x39], eax
test eax, eax
jne 0x140063d05
lea edx, [rax + 0x5c]
lea rcx, str.admin_appman_appv_shareduseruserinfo.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140063cc5
inc rax
jmp 0x140063ccc
lea rax, str.admin_appman_appv_shareduseruserinfo.cpp
mov rdx, rax
lea rcx, [0x1400b1690]
call fcn.140013934
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
or rdi, rbx
movabs rax, 0x162500000000
or rdi, rax
jmp 0x140064048
mov edx, 0x100
mov dword [rbp - 0x59], edx
lea rcx, [rbp - 0x51]
call fcn.14001c8dc
nop
lea r8, [rbp - 0x59]
mov rdx, qword [rbp - 0x51]
mov esi, SafeArrayGetDim
mov ecx, esi
call qword [sym.imp.Secur32.dll_GetUserNameExW]
nop dword [rax + rax]
test al, al
jne 0x140063e26
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xea
je 0x140063d9e
lea edx, [rsi + 0x50]
lea rcx, str.admin_appman_appv_shareduseruserinfo.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140063d6f
inc rax
jmp 0x140063d76
lea rax, str.admin_appman_appv_shareduseruserinfo.cpp
mov rdx, rax
lea rcx, [0x1400b1690]
call fcn.140013934
shl rax, 0x34
mov rdi, rbx
or rdi, rax
movabs rax, 0x172500000000
jmp 0x140063e1e
mov edx, dword [rbp - 0x59]
lea rcx, [rbp - 0x51]
call fcn.140036368
lea r8, [rbp - 0x59]
mov rdx, qword [rbp - 0x51]
mov ecx, esi
call qword [sym.imp.Secur32.dll_GetUserNameExW]
nop dword [rax + rax]
test al, al
jne 0x140063e26
mov edx, 0x5c
lea rcx, str.admin_appman_appv_shareduseruserinfo.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140063de6
inc rax
jmp 0x140063ded
lea rax, str.admin_appman_appv_shareduseruserinfo.cpp
mov rdx, rax
lea rcx, [0x1400b1690]
call fcn.140013934
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
or rdi, rbx
movabs rax, 0x182500000000
or rdi, rax
jmp 0x140064021
mov qword [rbp - 0x11], r15
mov r12d, 7
mov qword [rbp - 9], r12
mov word [rbp - 0x21], r15w
mov rdx, qword [rbp - 0x51]
lea rcx, [rbp - 0x21]
call fcn.140003b34
nop
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae r8, qword [rbp - 0x21]
lea edx, [r12 + 0x55]
mov r9, qword [rbp - 0x11]
test r9, r9
je 0x140063fb2
mov rax, r9
mov rcx, r8
mov rbx, r15
cmp word [r8], dx
je 0x140063e88
cmp rax, 1
je 0x140063e8b
dec rax
add rcx, 2
cmp word [rcx], dx
jne 0x140063e76
mov rbx, rcx
test rbx, rbx
je 0x140063fb2
sub rbx, r8
sar rbx, 1
cmp rbx, 0xffffffffffffffff
je 0x140063fb2
lea r8, [rbx + 1]
cmp r8, r9
je 0x140063fb2
test rbx, rbx
je 0x140063fb2
or r9, 0xffffffffffffffff
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x21]
call fcn.14003f1bc
mov rsi, rax
cmp r14, rax
je 0x140063f15
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x140063eed
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
call fcn.140003d24
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r12
mov word [r14], r15w
movups xmm0, xmmword [rsi]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [r14 + 0x10], xmm1
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov word [rsi], r15w
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x140063f30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
call fcn.140003d24
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x21]
call fcn.14003f1bc
mov rbx, rax
cmp rdi, rax
je 0x140063f8b
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140063f65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
call fcn.140003d24
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov word [rdi], r15w
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r12
mov word [rbx], r15w
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x140063fa6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
call fcn.140003d24
movabs rdi, 0x8000000000
jmp 0x140063ff9
lea rcx, str.admin_appman_appv_shareduseruserinfo.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140063fcf
inc rax
jmp 0x140063fd6
lea rax, str.admin_appman_appv_shareduseruserinfo.cpp
mov rdx, rax
lea rcx, [0x1400b1690]
call fcn.140013934
mov rdi, rax
shl rdi, 0x34
movabs rax, 0x19250000000d
or rdi, rax
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x140064014
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
call fcn.140003d24
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r12
mov word [rbp - 0x21], r15w
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140064048
mov rdx, qword [rbp - 0x41]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
call fcn.140003d24
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x41], r15
cmp dword [rbp - 0x39], r15d
je 0x14006407c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x14006407c
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
mov ecx, 0x29c
call qword [sym.imp.KERNEL32.dll_RaiseException]
lea rcx, [rbp - 0x31]
call fcn.14003eb20
mov rax, rdi
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140066420
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret