Function at 0x140003e20
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d8]
sub rsp, 0x2d8
mov r14, rcx
xor edi, edi
mov dword [rbp + 0x230], 0x105
lea rdx, [rbp + 0x230]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
lea rax, [rbp - 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x140003e80
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x70]
call fcn.1400027d0
nop
mov rax, qword [rbp - 0x60]
test rax, rax
jne 0x140003eb9
lea r8d, [rax + 7]
lea rdx, [0x1400db0c8]
lea rcx, [rbp - 0x70]
call fcn.140004ab0
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x50], rdi
mov r13, rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r13b
mov dword [rbp + 0x228], edi
mov rsi, qword [rbp - 0x70]
test rax, rax
je 0x140004227
mov rcx, rdi
mov qword [rbp + 0x238], rcx
movabs r12, 0x7fffffffffffffff
movzx ebx, byte [rbp + 0x228]
mov r9d, 0x16
cmp rax, rcx
jbe 0x140004432
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rax, rsi
movzx r8d, word [rax + rcx*2]
lea r15, [rbp - 0x7b]
nop word [rax + rax]
dec r15
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r15], r8b
mov r8d, edx
test edx, edx
jne 0x140003f30
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rbp - 0x7b]
cmp r15, rax
jne 0x140003f8e
mov rsi, rdi
mov qword [rsp + 0x40], rdi
mov r14d, 0xf
mov qword [rsp + 0x48], r14
mov byte [rsp + 0x30], dl
jmp 0x140004023
lea rsi, [rbp - 0x7b]
sub rsi, r15
cmp rsi, r12
ja 0x14000443e
cmp rsi, 0x10
jae 0x140003fd3
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
mov r8, rsi
mov rdx, r15
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rsi + 0x30], 0
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
jmp 0x140004023
mov r14, rsi
or r14, 0xf
cmp r14, r12
jbe 0x140003fe4
mov r14, r12
jmp 0x140003fec
cmp r14, 0x16
cmovb r14, r9
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x30]
call fcn.140004870
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
mov r8, rsi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r13, qword [rsp + 0x60]
lea r9, [rsp + 0x30]
cmp r14, 0x10
cmovae r9, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, r13
cmp rsi, rax
ja 0x140004074
lea rax, [rsi + r13]
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x50]
cmp rcx, 0x10
cmovae rdi, qword [rsp + 0x50]
lea rcx, [rdi + r13]
mov r8, rsi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov byte [rax + r13], 0
jmp 0x14000408f
mov qword [rsp + 0x20], rsi
movzx r8d, bl
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140002c00
mov r14, qword [rsp + 0x48]
cmp r14, 0x10
jb 0x1400040c8
lea rdx, [r14 + 1]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041f2
call fcn.14008fc44
mov edx, dword [rbp + 0x228]
inc edx
mov dword [rbp + 0x228], edx
mov rcx, qword [rbp + 0x238]
inc rcx
mov qword [rbp + 0x238], rcx
movsxd rax, edx
mov r13, qword [rsp + 0x60]
cmp rax, qword [rbp - 0x60]
jae 0x140004104
mov rax, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x70]
xor edi, edi
jmp 0x140003f02
cmp r13, 0xf
jbe 0x14000421a
mov qword [rsp + 0x30], 0
mov edi, 0xe
cmp r13, rdi
cmovb rdi, r13
lea r14, [rsp + 0x50]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
cmp rsi, 0x10
cmovae r14, rbx
cmp rdi, r12
ja 0x140004438
cmp rdi, 0x10
jae 0x14000416e
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0xf
mov r8, rdi
mov rdx, r14
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x30], 0
jmp 0x1400041c7
mov rax, rdi
or rax, 0xf
cmp rax, r12
ja 0x14000418a
mov r12, rax
cmp rax, 0x16
mov eax, 0x16
cmovb r12, rax
lea rdx, [r12 + 1]
lea rcx, [rsp + 0x30]
call fcn.140004870
mov rbx, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r12
mov r8, rdi
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
cmp rsi, 0x10
jb 0x140004201
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400041f9
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14008fc44
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x60], xmm1
mov r13, qword [rsp + 0x60]
mov rsi, qword [rbp - 0x70]
mov r14, qword [rbp + 0x220]
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 5
mov qword [rbp - 0x78], 0xf
mov eax, dword [str.RSCFG]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x1400db0dc]
mov byte [rsp + 0x74], al
mov byte [rsp + 0x75], 0
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
cmp r13, 0xa
ja 0x1400042ef
lea rax, [r13 + 5]
mov qword [rbp - 0x80], rax
lea rax, [rbx + r13]
cmp rax, rcx
jbe 0x1400042a1
lea rax, [rsp + 0x75]
cmp rbx, rax
ja 0x1400042a1
lea rax, [rsp + 0x70]
cmp rax, rbx
jbe 0x1400042a4
lea rdi, [rsp + 0x70]
sub rdi, rbx
jmp 0x1400042a4
mov rdi, r13
lea rcx, [rsp + 0x70]
add rcx, r13
mov r8d, 6
lea rdx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov r8, r13
sub r8, rdi
lea rdx, [rdi + r13]
add rdx, rbx
lea rcx, [rsp + 0x70]
add rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
xor edi, edi
jmp 0x14000430c
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
xor r9d, r9d
movzx r8d, byte [rbp + 0x228]
mov rdx, r13
call fcn.140002d90
mov qword [r14], rdi
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r14 + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140004375
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004370
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004370
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008fc44
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400043c6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008fc44
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rax, qword [rbp - 0x58]
cmp rax, 8
jb 0x14000441b
lea rdx, [rax*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140004413
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004413
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14008fc44
mov rax, r14
add rsp, 0x2d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140004850
nop
call fcn.140004810
int3
call fcn.140004810
int3