Function at 0x1800ae070
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
mov rax, qword [0x180135928]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
imul eax, ecx, 0x41a
mov r14, r8
mov qword [rsp + 0x40], r9
mov r13, rdx
mov qword [rbp - 0x50], r8
mov esi, ecx
mov qword [rsp + 0x58], rdx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x48], eax
mov ebx, dword [rsp + 0x48]
mov dword [rsp + 0x30], ecx
cmp ecx, eax
ja 0x1800ae1c3
mov r12, qword [rsp + 0x58]
xor edx, edx
mov r15, qword [rsp + 0x58]
lea r8, [0x180000000]
cmp esi, 0x8b34
ja 0x1800ae314
je 0x1800ae2c7
mov eax, esi
sub eax, 1
je 0x1800ae2a7
sub eax, 0x96
je 0x1800ae17c
cmp eax, 0x55
jne 0x1800ae1ab
cmp dword [r9], 1
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x58], rax
jl 0x1800ae136
mov r8, qword [r14]
xor edx, edx
lea ecx, [rdx + 0x30]
call fcn.180054480
xor edx, edx
test eax, eax
jne 0x1800ae1a6
mov edi, 0x5f
nop dword [rax + rax]
cmp edi, 0x5f
je 0x1800ae151
cmp edi, 0x43e9
jne 0x1800ae167
mov eax, edx
jmp 0x1800ae1c5
mov dword [rsp + 0x30], edx
lea rcx, [rsp + 0x30]
mov edx, 0x11d
mov r8, r13
call fcn.1800d0f60
add edi, 0x438a
mov edx, 0
cmp edi, 0x8714
jbe 0x1800ae140
jmp 0x1800ae1a6
cmp dword [rsp + 0x64], 0
jne 0x1800ae1ef
mov dword [rsp + 0x30], 7
lea r9, str.Unknown
mov r8, r13
lea rdx, [rsp + 0x30]
mov ecx, 0xcd
call fcn.1800612d0
xor edx, edx
mov r9, qword [rsp + 0x40]
imul eax, dword [rsp + 0x68], 0x96
add esi, eax
mov dword [rsp + 0x30], esi
cmp esi, dword [rsp + 0x48]
jbe 0x1800ae0e0
mov eax, ebx
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.180106610
mov rbx, qword [rsp + 0x920]
add rsp, 0x8e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov esi, 0x32
cmp esi, 0x32
je 0x1800ae27e
cmp esi, 0x74
jne 0x1800ae28f
test r12, r12
jne 0x1800ae22c
lea r9, str.Unknown
mov dword [rsp + 0x38], 7
mov r8, r13
lea rdx, [rsp + 0x38]
lea ecx, [rsi + 0x59]
call fcn.1800612d0
jmp 0x1800ae28f
mov edi, 0x93
mov eax, edi
sub eax, 0x93
je 0x1800ae255
cmp eax, 1
jne 0x1800ae272
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800ae272
mov r9, r12
mov dword [rsp + 0x38], 0xffffffff
mov r8, r13
lea rdx, [rsp + 0x38]
mov ecx, 0xcd
call fcn.1800612d0
inc edi
cmp edi, 0x95
jb 0x1800ae231
jmp 0x1800ae28f
xor edx, edx
lea r8, [rbp - 0x30]
lea ecx, [rdx + 0x65]
call fcn.1800b41d0
mov r12, rax
add esi, 0x42
cmp esi, 0xb6
jb 0x1800ae1f4
mov esi, dword [rsp + 0x30]
jmp 0x1800ae1a4
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x800
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0x64], eax
jmp 0x1800ae1a4
mov rax, qword [r14]
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov edx, 0xe0
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.1800a3a80
cmp dword [rsp + 0x4c], 1
mov qword [rbp - 0x58], rax
jge 0x1800ae1a4
mov dword [rsp + 0x38], 0
lea r9, [0x18010e6c6]
mov r8, r13
lea rdx, [rsp + 0x38]
jmp 0x1800ae19a
cmp esi, 0x1157c
je 0x1800ae364
cmp esi, 0x19fc4
je 0x1800ae335
cmp esi, 0x22a0c
je 0x1800ae1c3
jmp 0x1800ae1ab
mov eax, dword [rsp + 0x4c]
lea r8, [rsp + 0x70]
mov rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x38]
mov r9, r13
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x20], 0x7b
call fcn.1800132a0
xor edx, edx
mov ebx, edx
jmp 0x1800ae1a6
cmp dword [r9], 2
jge 0x1800ae446
mov edi, 0xbf
cmp edi, 0x493
ja 0x1800ae3f4
je 0x1800ae3ef
cmp edi, 0xbf
je 0x1800ae3e1
cmp edi, 0x183
je 0x1800ae3cf
cmp edi, 0x247
je 0x1800ae3c5
cmp edi, 0x30b
je 0x1800ae3ba
cmp edi, 0x3cf
jne 0x1800ae42f
movzx eax, word [rbp - 0x42]
mov dword [rsp + 0x7c], eax
movzx eax, word [rbp - 0x48]
mov dword [rbp - 0x7c], eax
jmp 0x1800ae42f
movzx eax, word [rbp - 0x46]
dec eax
mov dword [rbp - 0x80], eax
jmp 0x1800ae42f
movzx eax, word [rbp - 0x3c]
mov dword [rsp + 0x70], eax
jmp 0x1800ae42f
movzx eax, word [rbp - 0x40]
mov dword [rsp + 0x78], eax
movzx eax, word [rbp - 0x3e]
mov dword [rsp + 0x74], eax
jmp 0x1800ae42f
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor edx, edx
jmp 0x1800ae42f
mov dword [rbp - 0x74], edx
jmp 0x1800ae42f
cmp edi, 0x557
je 0x1800ae428
cmp edi, 0x61b
je 0x1800ae423
cmp edi, 0x6df
je 0x1800ae41a
cmp edi, 0x7a3
jne 0x1800ae42f
mov qword [rbp - 0x68], rdx
jmp 0x1800ae42f
mov dword [rbp - 0x70], 0xffffffff
jmp 0x1800ae42f
mov dword [rbp - 0x60], edx
jmp 0x1800ae42f
movzx eax, word [rbp - 0x44]
mov dword [rbp - 0x78], eax
add edi, 0xc4
cmp edi, 0x867
jb 0x1800ae373
jmp 0x1800ae1a6
mov r13, qword [rbp - 0x50]
mov esi, 7
lea r14d, [rsi + 1]
cmp esi, 7
ja case.default.0x1800ae469
mov eax, esi
mov ecx, dword [r8 + rax*4 + 0xae590]
add rcx, r8
jmp rcx
mov eax, dword [r15]
mov dword [rsp + 0x70], eax
jmp case.default.0x1800ae469
mov qword [rbp - 0x68], rdx
jmp case.default.0x1800ae469
mov eax, dword [r15 + 8]
mov dword [rsp + 0x78], eax
mov eax, dword [r15 + 4]
mov dword [rsp + 0x74], eax
jmp case.default.0x1800ae469
mov eax, dword [r15 + 0x14]
add eax, 0x76c
mov dword [rbp - 0x7c], eax
mov eax, dword [r15 + 0x1c]
mov dword [rbp - 0x74], eax
jmp case.default.0x1800ae469
mov rcx, qword [r13 + 8]
mov r9d, 0xd6
xor r8d, r8d
xor edx, edx
call fcn.180045550
test eax, eax
je 0x1800ae52a
mov edi, 0x12b
nop word [rax + rax]
mov eax, edi
sub eax, 0x12b
je 0x1800ae505
sub eax, 1
je 0x1800ae4f5
cmp eax, 1
jne 0x1800ae51e
test r15, r15
jne 0x1800ae51e
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
jmp 0x1800ae51e
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
mov r15, rax
jmp 0x1800ae51e
mov rcx, qword [r13 + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xe0
call fcn.1800b62d0
mov qword [rsp + 0x50], rax
inc edi
cmp edi, 0x12e
jb 0x1800ae4d0
jmp 0x1800ae535
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
xor edx, edx
lea r8, [0x180000000]
mov r15, rax
jmp case.default.0x1800ae469
mov eax, dword [r15 + 0x18]
mov dword [rbp - 0x78], eax
jmp case.default.0x1800ae469
mov eax, dword [r15 + 0x20]
mov dword [rbp - 0x70], eax
mov dword [rbp - 0x60], edx
jmp case.default.0x1800ae469
mov eax, dword [r15 + 0x10]
mov dword [rbp - 0x80], eax
mov eax, dword [r15 + 0xc]
mov dword [rsp + 0x7c], eax
dec esi
sub r14, 1
jne 0x1800ae453
mov r13, qword [rsp + 0x58]
mov r14, qword [rbp - 0x50]
mov esi, dword [rsp + 0x30]
jmp 0x1800ae1a6