Function at 0x7ff698f97440
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x7ff69902b080]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov r12, rcx
mov qword [rbp + 0xa8], rdx
xor r13d, r13d
cmp byte [0x7ff699055908], r13b
jne 0x7ff698f974b8
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
lea r8d, [r13 + 0x52]
lea rdx, [0x7ff698ff05b0]
lea rcx, [rsp + 0x78]
call fcn.7ff698f3fda0
lea rcx, [rsp + 0x78]
call fcn.7ff698f95070
mov dword [rbp + 0xb0], 0x64
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x100]
call qword [sym.imp.advapi32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
lea rax, [rbp + 0x100]
mov rcx, 0xffffffffffffffff
mov rbx, rcx
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff698f97500
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x7ff698f97c91
mov eax, 0x16
cmp rbx, 0x10
jae 0x7ff698f9756e
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], 0xf
mov r8, rbx
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xb8]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0xb8], 0
mov rdi, qword [rbp + 0xd0]
mov rbx, qword [rbp + 0xc8]
mov r15, qword [rbp + 0xb8]
jmp 0x7ff698f975cc
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x7ff698f9757f
mov rdi, r14
jmp 0x7ff698f97586
cmp rdi, rax
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, rcx
lea rcx, [rbp + 0xb8]
call fcn.7ff698f412f0
mov r15, rax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], rdi
mov r8, rbx
lea rdx, [rbp + 0x100]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rbx], 0
mov dword [rsp + 0x58], 0x130b145c
mov dword [rsp + 0x5c], 0xe5e90d1b
mov word [rsp + 0x60], 0xbf
mov byte [rsp + 0x62], 1
mov dword [rsp + 0x20], 0x101d155c
mov dword [rsp + 0x24], 0x100421b
mov dword [rsp + 0x68], 0xe19085c
mov dword [rsp + 0x6c], 0xefef160d
mov dword [rsp + 0x70], 0xb9e7eb
mov byte [rsp + 0x74], 1
mov dword [rsp + 0x48], 0xe19165c
mov dword [rsp + 0x4c], 0xe4e71e0d
mov word [rsp + 0x50], 0xbf
mov byte [rsp + 0x52], 1
mov dword [rsp + 0x28], 0x81f0b5c
mov dword [rsp + 0x2c], 0xbcf21a0d
mov word [rsp + 0x30], 0x100
mov dword [rsp + 0x38], 0x180c020e
mov dword [rsp + 0x3c], 0xe6ef1343
mov word [rsp + 0x40], 0x100
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x78]
call fcn.7ff698f93ab0
nop
lea rdx, [rbp + 0xb8]
cmp rdi, 0x10
cmovae rdx, r15
mov r8, rbx
mov rcx, rax
call fcn.7ff698f3d460
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x58]
call fcn.7ff698f93cb0
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x7ff698f976cb
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.7ff698f3d460
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x38]
call fcn.7ff698f93eb0
nop
lea rdx, [r12 + 0x238]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff698f9771e
mov rdx, qword [rdx]
mov rcx, rax
call fcn.7ff698f3d460
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 8]
call fcn.7ff698f939d0
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x7ff698f97766
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.7ff698f3d460
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x28]
call fcn.7ff698f93cb0
nop
lea rdx, [r12 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff698f977b9
mov rdx, qword [rdx]
mov rcx, rax
call fcn.7ff698f3d460
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x7ff698f97823
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f9781e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f9781e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
movdqa xmm0, xmmword [0x7ff6990158b0]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x7ff698f97874
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f9786e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f9786e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x7ff698f978b2
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f978ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f978ad
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
movdqa xmm0, xmmword [0x7ff6990158b0]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x7ff698f97902
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f978fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f978fc
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x7ff698f97940
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f9793b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f9793b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
movdqa xmm0, xmmword [0x7ff6990158b0]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x7ff698f97990
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f9798a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f9798a
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x7ff698f979ce
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f979c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f979c9
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
movdqa xmm0, xmmword [0x7ff6990158b0]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x7ff698f97a1e
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f97a18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f97a18
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x7ff698f97a5f
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f97a5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f97a5a
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
movdqa xmm0, xmmword [0x7ff6990158b0]
movdqu xmmword [rbp + 0x88], xmm0
mov byte [rbp + 0x78], 0
lea rax, [rbp - 0x48]
mov qword [rbp + 0x98], rax
lea rdx, [r12 + 0x80]
lea rcx, [rbp - 0x48]
call fcn.7ff698f4b2b0
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
lea r15, [rbp + 0xd8]
mov rdi, qword [rbp + 0xd8]
mov r13, qword [rbp + 0xf0]
cmp r13, 0x10
cmovae r15, rdi
mov rbx, qword [rbp + 0xe8]
cmp rbx, r14
ja 0x7ff698f97c8b
mov qword [rbp - 0x70], 0xf
cmp rbx, 0x10
jae 0x7ff698f97aec
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x78], xmm0
jmp 0x7ff698f97b41
mov rax, rbx
or rax, 0xf
cmp rax, r14
ja 0x7ff698f97b08
mov r14, rax
cmp rax, 0x16
mov eax, 0x16
cmovb r14, rax
mov rdx, r14
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x78]
call fcn.7ff698f412f0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r14
lea r8, [rbx + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
mov r8, r12
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.7ff698f98b30
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x7ff698f97b91
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f97b8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f97b8b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
nop
cmp r13, 0x10
jb 0x7ff698f97bcc
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x7ff698f97bc3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f97bc3
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.7ff698fe9f20
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x7ff698f97c11
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f97c0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f97c0b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698fe9f20
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x7ff698f97c47
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x7ff698f97c42
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff698f97c84
mov rcx, r8
call fcn.7ff698fe9f20
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.7ff698fe98c0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff698f30240
nop
call fcn.7ff698f30240
int3