Function at 0x180007d00
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x248]
sub rsp, 0x330
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800880c8]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rsi, rcx
movdqa xmm0, xmmword [0x180063b30]
movdqu xmmword [rsp + 0x60], xmm0
xor r14d, r14d
mov word [rsp + 0x50], r14w
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call fcn.180037b90
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x180063b30]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x70]
call fcn.180002d10
nop
lea rcx, [rbp - 0x50]
call fcn.180004fc0
nop
cmp byte [rsi + 0xd0], r14b
jne 0x180007f06
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.180004040
test al, al
je 0x180007f06
xor r8d, r8d
lea edx, [r14 + 0x1a]
lea rcx, [rsp + 0x70]
call fcn.180004c50
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x180007e33
lea rcx, [rsp + 0x50]
call fcn.180002ca0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180007e74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007e6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008335
call fcn.1800191d4
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x70]
call fcn.180004c50
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x180007ebd
lea rcx, [rsp + 0x30]
call fcn.180002ca0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1800080a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800080a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000832f
jmp 0x1800080a3
lea rcx, [rsp + 0x70]
call fcn.1800050a0
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x70]
call fcn.1800027f0
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea r9, str.AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x30]
call fcn.180002a10
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x180007f87
lea rcx, [rsp + 0x50]
call fcn.180002ca0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x180007fc7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007fc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000833b
call fcn.1800191d4
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x30]
call fcn.180002a10
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x180008026
lea rcx, [rsp + 0x30]
call fcn.180002ca0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x180008067
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008061
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008341
call fcn.1800191d4
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1800080a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800080a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008347
call fcn.1800191d4
lea rdi, [rsi + 0x50]
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x1800080d4
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.180002d10
lea rbx, [rsi + 0x70]
lea rax, [rsp + 0x30]
cmp rbx, rax
je 0x180008100
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180002d10
mov rcx, rdi
call fcn.180003fc0
test eax, eax
jne 0x18000811f
lea r8d, [rax + 1]
lea rdx, [0x180063ac0]
mov rcx, rdi
call fcn.1800027f0
mov rcx, rbx
call fcn.180003fc0
test eax, eax
jne 0x18000813e
lea r8d, [rax + 1]
lea rdx, [0x180063ac0]
mov rcx, rbx
call fcn.1800027f0
lea rbx, [rsi + 0x30]
cmp rbx, rdi
je 0x180008160
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x180008154
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call fcn.180002d10
lea rdx, [rsi + 0xb0]
cmp qword [rsi + 0xc8], 8
jb 0x180008178
mov rdx, qword [rsi + 0xb0]
mov r8, qword [rsi + 0xc0]
mov rcx, rbx
call fcn.1800027f0
mov rcx, rbx
call fcn.180003fc0
test eax, eax
jne 0x1800081a6
lea r8d, [rax + 1]
lea rdx, [0x180063ac0]
mov rcx, rbx
call fcn.1800027f0
mov qword [rbp + 8], r14
cmp qword [rbx + 0x18], 8
jb 0x1800081b4
mov rbx, qword [rbx]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.180004a30
nop
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1800081db
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000821b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000834d
call fcn.1800191d4
movdqa xmm0, xmmword [0x180063b30]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000826d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008268
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008353
call fcn.1800191d4
movdqa xmm0, xmmword [0x180063b30]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1800082c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800082bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008359
call fcn.1800191d4
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180008300
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800082fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008329
call fcn.1800191d4
mov al, 1
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.180019960
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.18003abf4
nop
call fcn.18003abf4
nop
call fcn.18003abf4
nop
call fcn.18003abf4
int3
call fcn.18003abf4
nop
call fcn.18003abf4
nop
call fcn.18003abf4
nop
call fcn.18003abf4
nop
call fcn.18003abf4
int3