Function at 0x18002d388
Capabilities:
Get session user name

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x2d0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x180097090]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
mov rbx, rdx
xor r12d, r12d
mov esi, r12d
mov dword [rsp + 0x50], r12d
lea rbp, [0x18009d770]
mov edi, 0x80
cmp word [0x18009d770], r12w
jne 0x18002d4d7
mov word [r11 - 0x1b8], r12w
xor edx, edx
lea r8d, [rdi + 0x7e]
lea rcx, [r11 - 0x1b6]
call fcn.1800575a0
mov dword [rsp + 0x50], edi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp eax, r12d
je 0x18002d4d7
lea rdx, str.system
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, r12d
jne 0x18002d4c3
lea r9, str.agentUser
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xe0]
call fcn.1800297ac
cmp qword [rsp + 0xf8], r12
jne 0x18002d483
mov r8d, edi
lea rdx, [rsp + 0x130]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x18002d4a9
lea rdx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
cmovae rdx, qword [rsp + 0xe8]
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp qword [rsp + 0x100], 8
jb 0x18002d4d7
mov rcx, qword [rsp + 0xe8]
call fcn.1800538dc
jmp 0x18002d4d7
mov r8d, edi
lea rdx, [rsp + 0x130]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp byte [0x18009d870], r12b
jne 0x18002d526
lea rcx, [rsp + 0x88]
call fcn.180045398
cmp qword [rax + 0x20], 0x10
jb 0x18002d4fa
mov rdx, qword [rax + 8]
jmp 0x18002d4fe
lea rdx, [rax + 8]
mov r8d, edi
lea rcx, [0x18009d870]
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp qword [rsp + 0xa8], 0x10
jb 0x18002d526
mov rcx, qword [rsp + 0x90]
call fcn.1800538dc
cmp word [0x18009d770], r12w
je 0x18002db5a
cmp byte [0x18009d870], r12b
je 0x18002db5a
mov ebp, 7
cmp byte [rbx + 8], bpl
jne 0x18002db56
lea r13d, [rbp + 8]
mov qword [rsp + 0x100], r13
mov qword [rsp + 0xf8], r12
mov byte [rsp + 0xe8], r12b
lea r8d, [rbp + 1]
lea rdx, str.i_action
lea rcx, [rsp + 0xe0]
call fcn.18000d0c0
nop
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xa0], r12
mov byte [rsp + 0x90], r12b
xor r8d, r8d
lea rdx, [0x18007a6af]
lea rcx, [rsp + 0x88]
call fcn.18000d0c0
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xe0]
mov rdx, rbx
lea rcx, [rsp + 0x108]
call fcn.180001930
nop
cmp qword [rsp + 0x100], 0x10
jb 0x18002d5ed
mov rcx, qword [rsp + 0xe8]
call fcn.1800538dc
mov qword [rsp + 0x100], r13
mov qword [rsp + 0xf8], r12
mov byte [rsp + 0xe8], r12b
lea rcx, [rsp + 0x110]
cmp qword [rsp + 0x128], 0x10
cmovae rcx, qword [rsp + 0x110]
mov r8, rbp
mov rdi, qword [rsp + 0x120]
cmp rdi, rbp
cmovb r8, rdi
lea rdx, str.replace
call fcn.18005cf50
movsxd rcx, eax
mov eax, r12d
cmp rdi, rbp
setne al
or rdx, 0xffffffffffffffff
cmp rdi, rbp
cmovb eax, edx
cmp rcx, r12
cmovne eax, ecx
cmp eax, r12d
je 0x18002d6bb
lea rcx, [rsp + 0x110]
cmp qword [rsp + 0x128], 0x10
cmovae rcx, qword [rsp + 0x110]
lea ebp, [rdx + 7]
mov r8, rbp
cmp rdi, rbp
cmovb r8, rdi
lea rdx, str.delete
call fcn.18005cf50
movsxd rcx, eax
mov eax, r12d
cmp rdi, rbp
setne al
cmp rdi, rbp
mov rbp, 0xffffffffffffffff
cmovb eax, ebp
cmp rcx, r12
cmovne eax, ecx
cmp eax, r12d
jne 0x18002d742
jmp 0x18002d6bf
or rbp, 0xffffffffffffffff
lea rdx, str.i_key_columns
mov rcx, rbx
call fcn.18003618c
cmp byte [rax + 8], 4
jne 0x18002d700
lea rdx, str.i_key_columns
mov rcx, rbx
call fcn.18003618c
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.180034fb4
mov esi, 1
cmp qword [rax + 0x18], r12
je 0x18002d700
mov dil, r12b
jmp 0x18002d703
mov dil, 1
test sil, 1
je 0x18002d71e
cmp qword [rsp + 0x80], 0x10
jb 0x18002d71e
mov rcx, qword [rsp + 0x68]
call fcn.1800538dc
cmp dil, r12b
je 0x18002d742
cmp qword [rsp + 0x128], 0x10
jb 0x18002d73b
mov rcx, qword [rsp + 0x110]
call fcn.1800538dc
xor eax, eax
jmp 0x18002db5c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rdx, str.t_print_log
lea rcx, [rsp + 0x60]
call fcn.180034b78
mov rdi, rax
lea rdx, str.i_dt
mov rcx, rbx
call fcn.18003618c
mov rcx, rax
mov rdx, rdi
call fcn.180034eac
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], rcx
lea rdx, [0x18009d870]
lea rcx, [rsp + 0x60]
call fcn.180034b78
mov rdi, rax
lea rdx, str.client_unique
mov rcx, rbx
call fcn.18003618c
mov rcx, rax
mov rdx, rdi
call fcn.180034eac
lea rsi, str.user_name
mov rdx, rsi
mov rcx, rbx
call fcn.18003618c
cmp byte [rax + 8], r12b
jne 0x18002da4c
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x148], r12
mov byte [rsp + 0x138], r12b
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x170], r12
mov byte [rsp + 0x160], r12b
mov dword [rsp + 0x180], r12d
mov qword [rsp + 0x1a8], r13
mov qword [rsp + 0x1a0], r12
mov byte [rsp + 0x190], r12b
mov qword [rsp + 0x1d0], r13
mov qword [rsp + 0x1c8], r12
mov byte [rsp + 0x1b8], r12b
mov qword [rsp + 0x1f8], r13
mov qword [rsp + 0x1f0], r12
mov byte [rsp + 0x1e0], r12b
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x218], r12
mov byte [rsp + 0x208], r12b
mov qword [rsp + 0x248], r13
mov qword [rsp + 0x240], r12
mov byte [rsp + 0x230], r12b
mov qword [rsp + 0x270], r13
mov qword [rsp + 0x268], r12
mov byte [rsp + 0x258], r12b
mov qword [rsp + 0x298], r13
mov qword [rsp + 0x290], r12
mov byte [rsp + 0x280], r12b
lea rcx, [rsp + 0x130]
call fcn.18004626c
cmp eax, r12d
je 0x18002d96d
cmp qword [rsp + 0x148], r12
je 0x18002d96d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x60]
call fcn.180034c20
mov rdi, rax
mov rdx, rsi
mov rcx, rbx
call fcn.18003618c
mov rcx, rax
mov rdx, rdi
call fcn.180034eac
lea rdx, [rsp + 0x2a0]
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x2a8], 1
btr dword [rsp + 0x2a8], 8
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2b8], r12
mov qword [rsp + 0x2c0], r12
mov qword [rsp + 0x2a0], 1
lea rdx, str.i_user_data
mov rcx, rbx
call fcn.18003618c
mov rcx, rax
lea rdx, [rsp + 0x2a0]
call fcn.180034eac
jmp 0x18002da3f
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x2c0], 7
mov qword [rsp + 0x2b8], r12
mov word [rsp + 0x2a8], r12w
xor eax, eax
mov rcx, rbp
lea rdi, [0x18009d770]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x18009d770]
lea rcx, [rsp + 0x2a0]
call fcn.18000d5e0
nop
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x60]
call fcn.180001500
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.180034c20
mov rdi, rax
mov rdx, rsi
mov rcx, rbx
call fcn.18003618c
mov rcx, rax
mov rdx, rdi
call fcn.180034eac
nop
cmp qword [rsp + 0x80], 0x10
jb 0x18002da14
mov rcx, qword [rsp + 0x68]
call fcn.1800538dc
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x68], r12b
cmp qword [rsp + 0x2c0], 8
jb 0x18002da3f
mov rcx, qword [rsp + 0x2a8]
call fcn.1800538dc
nop
lea rcx, [rsp + 0x130]
call fcn.18002db8c
lea rdx, str.data_time
mov rcx, rbx
call fcn.18003618c
cmp byte [rax + 8], r12b
jne 0x18002db37
mov byte [rsp + 0x2a0], r12b
xor eax, eax
mov qword [rsp + 0x2a1], rax
mov qword [rsp + 0x2a9], rax
mov qword [rsp + 0x2b1], rax
mov dword [rsp + 0x2b9], eax
mov word [rsp + 0x2bd], ax
mov byte [rsp + 0x2bf], al
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x5c]
movzx eax, word [rsp + 0x5a]
movzx ecx, word [rsp + 0x58]
movzx edi, word [rsp + 0x56]
movzx r8d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r8d
lea r8, str._04d__02d__02d__02d:_02d:_02d
mov edx, 0x20
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x50], rcx
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb8]
call fcn.180034b78
mov rdi, rax
lea rdx, str.data_time
mov rcx, rbx
call fcn.18003618c
mov rcx, rax
mov rdx, rdi
call fcn.180034eac
nop
cmp qword [rsp + 0x128], 0x10
jb 0x18002db4f
mov rcx, qword [rsp + 0x110]
call fcn.1800538dc
mov eax, 1
jmp 0x18002db5c
xor eax, eax
jmp 0x18002db5c
xor eax, eax
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.180052d60
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret