Function at 0x18002e130
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2de0]
mov eax, 0x2ee0
call fcn.18015c450
sub rsp, rax
mov rax, qword [0x180183c70]
xor rax, rsp
mov qword [rbp + 0x2dd0], rax
movzx ebx, byte [rsp + 0x30]
mov esi, r9d
mov qword [rsp + 0x58], rcx
mov r15d, r9d
mov rax, qword [rsp + 0x58]
mov r11, r8
imul r14d, r9d, 0x4d3
mov r10, rdx
mov dword [rsp + 0x38], r9d
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], rdx
cmp esi, r14d
ja 0x18002e61f
lea edx, [r9 + 0x33]
lea r12d, [r9 + 0x32]
mov ecx, 0x5f
cmp esi, 0xdd44
ja 0x18002e32e
je 0x18002e317
cmp esi, 0x4a82
ja 0x18002e287
je 0x18002e27b
mov eax, esi
sub eax, 0x114
je 0x18002e250
sub eax, 0xd
je 0x18002e239
sub eax, 9
je 0x18002e220
cmp eax, 0x45fe
jne 0x18002e60b
mov eax, dword [0x18017037a]
mov dword [rbp + 0x592], eax
movzx eax, word [0x18017037e]
mov word [rbp + 0x596], ax
jmp 0x18002e60b
mov dword [rbp + 0x5a0], 0x77
mov dword [rbp + 0x5a2], 0x73
jmp 0x18002e60b
mov dword [rbp + 0x570], 0x730077
mov word [rbp + 0x574], r12w
jmp 0x18002e60b
movsd xmm0, qword [0x18017026a]
movzx eax, word [0x180170272]
movsd qword [rbp + 0x588], xmm0
mov word [rbp + 0x590], ax
mov word [rbp + 0x592], r9w
jmp 0x18002e60b
mov word [rbp + 0x576], cx
jmp 0x18002e60b
cmp esi, 0x4cd4
je 0x18002e2db
cmp esi, 0x8d3c
je 0x18002e2ce
cmp esi, 0x93e3
je 0x18002e2c2
cmp esi, 0xd350
jne 0x18002e60b
mov dword [rbp + 0x598], 0x6c006c
mov word [rbp + 0x59c], r9w
jmp 0x18002e60b
mov word [rbp + 0x578], dx
jmp 0x18002e60b
mov word [rbp + 0x598], r9w
jmp 0x18002e60b
lea rcx, [rbp + 0x5a0]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18002e2f0
movsd xmm0, qword [str.2_32]
movzx eax, word [0x1801702e8]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
jmp 0x18002e60b
mov word [rbp + 0x57a], r12w
mov dword [rbp + 0x57c], 0x64002e
jmp 0x18002e60b
cmp esi, 0x1a58c
ja 0x18002e488
je 0x18002e420
cmp esi, 0x11964
je 0x18002e3fa
cmp esi, 0x126a5
je 0x18002e3eb
cmp esi, 0x15f78
je 0x18002e379
cmp esi, 0x17006
jne 0x18002e60b
mov word [rbp + 0x584], r9w
jmp 0x18002e60b
cmp dword [r10 + 0x18], 0x100
je 0x18002e60b
mov edi, 0x123
nop dword [rax]
mov eax, edi
sub eax, 0x123
je 0x18002e3cb
cmp eax, 1
jne 0x18002e3dc
movzx eax, bl
mov rcx, qword [rbp + 0x2dd0]
xor rcx, rsp
call fcn.18015c4c0
mov rbx, qword [rsp + 0x2f38]
add rsp, 0x2ee0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.err_param_default_argument_nonfunc
mov ecx, 0x10008
call fcn.180025af0
inc edi
cmp edi, 0x125
jb 0x18002e390
jmp 0x18002e5f9
mov dword [rbp + 0x580], 0x6c006c
jmp 0x18002e60b
mov r9d, 0x110
lea rdx, str.EnumDisplayDevicesW
xor r8d, r8d
lea rcx, [rbp + 0x588]
call fcn.18002fce0
mov qword [rsp + 0x78], rax
jmp 0x18002e5f9
mov rax, qword [r10]
lea rcx, [rbp + 0x5c0]
mov edx, 4
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18002e430
jmp 0x18002e606
cmp esi, 0x1b967
je 0x18002e5db
cmp esi, 0x1eba0
je 0x18002e513
cmp esi, 0x202c8
je 0x18002e4cd
cmp esi, 0x231b4
jne 0x18002e60b
xor edx, edx
lea rcx, [rbp - 0x5c]
mov r8d, 0x344
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x60], 0x348
jmp 0x18002e5f9
xor r8d, r8d
mov rdx, r11
lea ecx, [r8 + 0x12]
call fcn.18003dfe0
test al, al
jne 0x18002e5f9
mov ecx, 0x12c
nop dword [rax]
mov eax, ecx
sub eax, 0x12b
je 0x18002e39e
cmp eax, 1
jne 0x18002e504
xor bl, bl
dec ecx
cmp ecx, 0x12a
ja 0x18002e4f0
jmp 0x18002e5f9
mov rax, qword [r10 + 8]
lea rcx, [rbp + 0x7c0]
mov edx, 4
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18002e523
mov rax, qword [r10 + 0x10]
lea rcx, [rbp + 0x9c0]
mov edx, 4
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18002e586
jmp 0x18002e606
xor r8d, r8d
lea rcx, [rbp + 0x570]
mov r9d, 0x110
lea edx, [r8 + 0x10]
call fcn.18002fce0
mov qword [rsp + 0x70], rax
mov r11, qword [rsp + 0x48]
xor r9d, r9d
mov r10, qword [rsp + 0x50]
mov edx, 0x33
imul ecx, r15d, 0x41
add esi, ecx
cmp esi, r14d
jbe 0x18002e1ba
mov rcx, qword [rsp + 0x58]
lea edi, [r15 + 0xa32]
mov esi, r15d
mov dword [rsp + 0x60], edi
cmp r15d, edi
jae 0x18002e39e
mov r13d, dword [rsp + 0x40]
movabs rdx, 0x6c0064002e
mov r15d, dword [rsp + 0x40]
mov r8d, 8
mov r14d, dword [rsp + 0x40]
mov r12, qword [rbp - 0x78]
nop dword [rax]
cmp esi, 0x2d4
ja 0x18002e853
je 0x18002e84c
cmp esi, 0x1b2
ja 0x18002e765
je 0x18002e729
mov eax, esi
sub eax, 0x114
je 0x18002e716
sub eax, 0xd
je 0x18002e6f2
sub eax, 9
je 0x18002e6e6
cmp eax, 0x7b
jne 0x18002e9e2
xor r9d, r9d
lea rdx, [rbp - 0x1c]
xor r8d, r8d
lea rcx, str.DISPLAY
call qword [sym.imp.GDI32.dll_CreateDCW]
mov rcx, rax
lea rdx, [rbp + 0x5c0]
mov r12, rax
call qword [sym.imp.GDI32.dll_SetDeviceGammaRamp]
movabs rdx, 0x6c0064002e
mov r8d, 8
xor r9d, r9d
jmp 0x18002e9e2
mov qword [rbp + 0x5ac], rdx
jmp 0x18002e9e2
mov rcx, qword [r11]
lea rdx, [rbp + 0xdd0]
xor r9d, r9d
mov r8d, 0x2000
call qword [rsp + 0x70]
mov r15d, eax
mov dword [rsp + 0x64], 0x104
jmp 0x18002e6ce
lea rcx, [r11 + 0x78]
xor r9d, r9d
lea r8, [rbp - 0x60]
xor edx, edx
call qword [rsp + 0x78]
jmp 0x18002e6ce
test r15d, r15d
jne 0x18002e758
mov ecx, 0xc8
mov eax, ecx
sub eax, 0xc8
je 0x18002e747
cmp eax, 1
je 0x18002e39e
jmp 0x18002e749
xor bl, bl
inc ecx
cmp ecx, 0xca
jb 0x18002e733
jmp 0x18002e9e2
jns 0x18002e9e2
xor al, al
jmp 0x18002e3a1
mov eax, esi
sub eax, 0x1bb
je 0x18002e820
sub eax, 0x7b
je 0x18002e812
sub eax, 0xd
je 0x18002e793
cmp eax, 9
jne 0x18002e9e2
mov word [rbp - 0x7e], r8w
jmp 0x18002e9e2
mov rdx, qword [r10 + 0x18]
mov rcx, qword [r10 + 0x10]
mov rax, rdx
sub rax, rcx
movsxd rsi, r15d
cmp rsi, rax
ja 0x18002e7dd
lea rax, [rcx + rsi]
mov qword [r10 + 0x10], rax
mov rax, r10
cmp rdx, 0x10
jb 0x18002e7bd
mov rax, qword [r10]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rbp + 0xdd0]
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
mov edi, dword [rsp + 0x60]
jmp 0x18002e7f7
lea r9, [rbp + 0xdd0]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, r10
call fcn.1800037e0
lea rdx, [rsp + 0x64]
lea rcx, [rbp + 0xbc0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, dword [rsp + 0x38]
jmp 0x18002e6ce
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x18002e6ce
lea rcx, [rbp + 0x5a0]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18002e830
mov eax, dword [0x1801648cc]
mov dword [rcx], eax
mov qword [rbp - 0x80], r9
jmp 0x18002e9e2
mov bl, 1
jmp 0x18002e9e2
cmp esi, 0x490
ja 0x18002e998
je 0x18002e929
mov eax, esi
sub eax, 0x2dd
je 0x18002e8ec
sub eax, 0x88
je 0x18002e39e
sub eax, 9
je 0x18002e8e1
cmp eax, 0x91
jne 0x18002e9e2
mov eax, dword [rcx]
lea r9, [rsp + 0x38]
mov dword [rsp + 0x68], eax
lea r8, [rsp + 0x68]
mov eax, dword [r10]
lea rcx, [rbp + 0x2f0]
mov edx, 0x99
mov dword [rsp + 0x38], eax
call fcn.180067eb0
test al, al
jne 0x18002e8d9
mov ecx, 0x2a
nop word [rax + rax]
mov eax, ecx
sub eax, 0x29
je 0x18002e39e
cmp eax, 1
jne 0x18002e8d2
xor bl, bl
dec ecx
cmp ecx, 0x28
ja 0x18002e8c0
xor r9d, r9d
mov r14d, r9d
jmp 0x18002e914
mov r13d, 4
jmp 0x18002e9e2
mov r9d, 0x110
lea rdx, str.WSASocketW
xor r8d, r8d
lea rcx, [rbp + 0x5a0]
call fcn.18002fce0
xor r9d, r9d
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x40], r9d
movabs rdx, 0x6c0064002e
mov r8d, 8
jmp 0x18002e9e2
mov dword [rsp + 0x28], 1
xor r8d, r8d
mov dword [rsp + 0x20], r9d
xor edx, edx
lea r9, [rbp + 0x2f0]
xor ecx, ecx
call qword [rbp - 0x78]
mov r9, qword [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
mov ecx, 0x105
mov qword [r9], rax
call fcn.18001a140
test al, al
jne 0x18002e6ce
mov ecx, 0x34
mov eax, ecx
sub eax, 0x34
je 0x18002e986
cmp eax, 0x4f
je 0x18002e39e
jmp 0x18002e988
xor bl, bl
add ecx, 0x4f
cmp ecx, 0xd2
jb 0x18002e974
jmp 0x18002e6ce
cmp esi, 0x521
je 0x18002e9d9
cmp esi, 0x5b2
je 0x18002e9b7
cmp esi, 0x643
jne 0x18002e9e2
mov al, 1
jmp 0x18002e3a1
mov edx, dword [rsp + 0x40]
lea rax, [rbp - 0x70]
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8d, r13d
lea rcx, [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_AddAccessDeniedAceEx]
jmp 0x18002e6ce
xor eax, eax
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], eax
add esi, 0x91
mov dword [rsp + 0x38], esi
cmp esi, edi
jae 0x18002e39e
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
jmp 0x18002e660