Function at 0x18000c810
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x228]
sub rsp, 0x310
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800961e8]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rsi, rcx
movdqa xmm0, xmmword [0x18006e3e0]
movdqu xmmword [rsp + 0x60], xmm0
xor r14d, r14d
mov word [rsp + 0x50], r14w
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.180040cd0
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x18006e3e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.180004370
nop
lea rcx, [rbp - 0x30]
call fcn.180007fd0
nop
cmp byte [rsi + 0xd0], r14b
jne 0x18000ca16
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.180007250
test al, al
je 0x18000ca16
xor r8d, r8d
lea edx, [r14 + 0x1a]
lea rcx, [rsp + 0x70]
call fcn.180007ef0
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x18000c943
lea rcx, [rsp + 0x50]
call fcn.1800040f0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000c984
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c97f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce5b
call fcn.1800229f4
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x70]
call fcn.180007ef0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000c9cd
lea rcx, [rsp + 0x30]
call fcn.1800040f0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000cbb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cbb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce55
jmp 0x18000cbb3
lea rcx, [rsp + 0x70]
call fcn.180008190
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x70]
call fcn.1800041f0
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea r9, str.AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x50]
call fcn.180006160
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x18000ca97
lea rcx, [rsp + 0x50]
call fcn.1800040f0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000cad7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cad2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce61
call fcn.1800229f4
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x50]
call fcn.180006160
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000cb36
lea rcx, [rsp + 0x30]
call fcn.1800040f0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000cb77
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cb71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce67
call fcn.1800229f4
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000cbb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cbb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce6d
call fcn.1800229f4
lea rbx, [rsi + 0x50]
lea rax, [rsp + 0x50]
cmp rbx, rax
je 0x18000cbe4
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180004370
lea rdi, [rsi + 0x70]
lea rax, [rsp + 0x30]
cmp rdi, rax
je 0x18000cc10
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.180004370
mov rcx, rbx
call fcn.180006eb0
test eax, eax
jne 0x18000cc2f
lea r8d, [rax + 1]
lea rdx, [0x18006e34c]
mov rcx, rbx
call fcn.1800041f0
mov rcx, rdi
call fcn.180006eb0
test eax, eax
jne 0x18000cc4e
lea r8d, [rax + 1]
lea rdx, [0x18006e34c]
mov rcx, rdi
call fcn.1800041f0
lea r9, [rsi + 0xb0]
cmp qword [r9 + 0x18], 8
jb 0x18000cc5f
mov r9, qword [r9]
cmp qword [rbx + 0x18], 8
jb 0x18000cc69
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str._s_s_
lea rcx, [rbp - 0x50]
call fcn.180006c00
mov rdi, rax
lea rbx, [rsi + 0x30]
cmp rbx, rax
je 0x18000ccae
mov rcx, rbx
call fcn.1800040f0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000ccee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cce9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce73
call fcn.1800229f4
cmp qword [rbx + 0x18], 8
jb 0x18000ccf8
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.180007b60
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18000cd41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cd3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce79
call fcn.1800229f4
movdqa xmm0, xmmword [0x18006e3e0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000cd93
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cd8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce7f
call fcn.1800229f4
movdqa xmm0, xmmword [0x18006e3e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000cde8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cde2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce85
call fcn.1800229f4
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000ce26
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ce21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ce4f
call fcn.1800229f4
mov al, 1
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.180022b10
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1800445c4
nop
call fcn.1800445c4
nop
call fcn.1800445c4
nop
call fcn.1800445c4
int3
call fcn.1800445c4
nop
call fcn.1800445c4
int3
call fcn.1800445c4
nop
call fcn.1800445c4
nop
call fcn.1800445c4
nop
call fcn.1800445c4
int3