Function at 0x18000c0c0
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x228]
sub rsp, 0x310
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18008b218]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rsi, rcx
movdqa xmm0, xmmword [0x1800653e0]
movdqu xmmword [rsp + 0x60], xmm0
xor r14d, r14d
mov word [rsp + 0x50], r14w
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.18003c880
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x1800653e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.180004000
nop
lea rcx, [rbp - 0x30]
call fcn.1800082a0
nop
cmp byte [rsi + 0xd0], r14b
jne 0x18000c2c6
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.180007470
test al, al
je 0x18000c2c6
xor r8d, r8d
lea edx, [r14 + 0x1a]
lea rcx, [rsp + 0x70]
call fcn.180007ed0
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x18000c1f3
lea rcx, [rsp + 0x50]
call fcn.180003d10
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000c234
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c22f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c70b
call fcn.18001e5a4
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x70]
call fcn.180007ed0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000c27d
lea rcx, [rsp + 0x30]
call fcn.180003d10
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000c468
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c463
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c705
jmp 0x18000c463
lea rcx, [rsp + 0x70]
call fcn.180008470
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x70]
call fcn.180003e80
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea r9, str.AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x50]
call fcn.1800066d0
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x18000c347
lea rcx, [rsp + 0x50]
call fcn.180003d10
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000c387
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c382
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c711
call fcn.18001e5a4
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x50]
call fcn.1800066d0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000c3e6
lea rcx, [rsp + 0x30]
call fcn.180003d10
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000c427
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c421
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c717
call fcn.18001e5a4
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000c468
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c463
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c71d
call fcn.18001e5a4
lea rbx, [rsi + 0x50]
lea rax, [rsp + 0x50]
cmp rbx, rax
je 0x18000c494
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180004000
lea rdi, [rsi + 0x70]
lea rax, [rsp + 0x30]
cmp rdi, rax
je 0x18000c4c0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.180004000
mov rcx, rbx
call fcn.1800073f0
test eax, eax
jne 0x18000c4df
lea r8d, [rax + 1]
lea rdx, [0x1800653b8]
mov rcx, rbx
call fcn.180003e80
mov rcx, rdi
call fcn.1800073f0
test eax, eax
jne 0x18000c4fe
lea r8d, [rax + 1]
lea rdx, [0x1800653b8]
mov rcx, rdi
call fcn.180003e80
lea r9, [rsi + 0xb0]
cmp qword [r9 + 0x18], 8
jb 0x18000c50f
mov r9, qword [r9]
cmp qword [rbx + 0x18], 8
jb 0x18000c519
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str._s_s_
lea rcx, [rbp - 0x50]
call fcn.180006ec0
mov rdi, rax
lea rbx, [rsi + 0x30]
cmp rbx, rax
je 0x18000c55e
mov rcx, rbx
call fcn.180003d10
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000c59e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c599
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c723
call fcn.18001e5a4
cmp qword [rbx + 0x18], 8
jb 0x18000c5a8
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.180007b40
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18000c5f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c5ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c729
call fcn.18001e5a4
movdqa xmm0, xmmword [0x1800653e0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000c643
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c63e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c72f
call fcn.18001e5a4
movdqa xmm0, xmmword [0x1800653e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000c698
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c692
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c735
call fcn.18001e5a4
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000c6d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c6d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c6ff
call fcn.18001e5a4
mov al, 1
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.18001e6b0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1800400b4
nop
call fcn.1800400b4
nop
call fcn.1800400b4
nop
call fcn.1800400b4
int3
call fcn.1800400b4
nop
call fcn.1800400b4
int3
call fcn.1800400b4
nop
call fcn.1800400b4
nop
call fcn.1800400b4
nop
call fcn.1800400b4
int3