Function at 0x1400044f0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov r12, rcx
xor esi, esi
mov dword [rbp + 0x1d8], 0x105
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x70]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], si
jne 0x140004550
movabs r14, 0x7ffffffffffffffe
cmp rbx, r14
ja 0x1400048e2
mov qword [rsp + 0x38], 7
cmp rbx, 8
jae 0x14000459b
mov qword [rsp + 0x30], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x20], si
jmp 0x1400045ec
mov rax, rbx
or rax, 7
cmp rax, r14
ja 0x1400045b6
mov r14, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x20]
call fcn.140005040
mov rdi, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rbx], si
mov r9d, esi
mov rcx, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400046bd
mov r8, rsi
nop word [rax + rax]
cmp rcx, r8
jbe 0x1400048e8
lea rax, [rsp + 0x20]
cmp r10, 8
setae dl
cmovae rax, rbx
cmp word [rax + r8*2], 0x41
jb 0x140004644
lea rax, [rsp + 0x20]
test dl, dl
cmovne rax, rbx
cmp word [rax + r8*2], 0x5a
jbe 0x1400046ab
lea rax, [rsp + 0x20]
test dl, dl
cmovne rax, rbx
cmp word [rax + r8*2], 0x61
jb 0x14000466a
lea rax, [rsp + 0x20]
test dl, dl
cmovne rax, rbx
cmp word [rax + r8*2], 0x7a
jbe 0x1400046ab
lea rax, [rsp + 0x20]
test dl, dl
je 0x14000467a
movzx ecx, word [rbx + r8*2]
jmp 0x140004684
movzx ecx, word [rax + r8*2]
lea rbx, [rsp + 0x20]
mov eax, 0x51eb851f
mul ecx
shr edx, 3
imul eax, edx, 0x19
sub ecx, eax
add cx, 0x41
mov word [rbx + r8*2], cx
mov r10, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
inc r9d
inc r8
movsxd rax, r9d
cmp rax, rcx
jb 0x140004610
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], 5
mov edi, 0xf
mov qword [rsp + 0x78], rdi
mov eax, dword [str.RSCFG]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x1400df1bc]
mov byte [rsp + 0x64], al
mov byte [rsp + 0x65], 0
lea rax, [rsp + 0x20]
cmp r10, 8
jb 0x140004700
lea r15, [rbx + rcx*2]
jmp 0x140004709
lea r15, [rax + rcx*2]
lea rbx, [rsp + 0x20]
mov qword [rsp + 0x40], rsi
cmp rbx, r15
jne 0x140004727
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov byte [rsp + 0x40], 0
jmp 0x1400047dc
mov r14, rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rax, r15
sub rax, rbx
sar rax, 1
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x1400048dc
cmp rax, 0x10
jb 0x140004790
mov rdi, rax
or rdi, 0xf
cmp rdi, rcx
jbe 0x140004767
mov rdi, rcx
jmp 0x140004773
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x40]
call fcn.140004fe0
mov rsi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rdi
nop
lea rcx, [rsp + 0x40]
cmp rdi, 0x10
cmovae rcx, rsi
movzx eax, byte [rbx]
mov byte [r14 + rcx], al
mov r14, qword [rsp + 0x50]
inc r14
mov qword [rsp + 0x50], r14
add rbx, 2
cmp rbx, r15
je 0x1400047c6
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x40]
jmp 0x140004790
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
mov byte [r14 + rax], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x40]
movzx edx, byte [rbp + 0x1d8]
mov rcx, r12
call fcn.1400030a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140004837
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004831
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004831
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140093e7c
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140004878
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004872
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004872
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140093e7c
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400048bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400048b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140093e7c
mov rax, r12
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140004f80
nop
call fcn.140004f80
nop
call fcn.140004fc0
int3