Function at 0x140015b70
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14003ae50]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rsi, r9
mov r12, r8
mov r13, rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r9
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x20], 0x104
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140001b20
nop
mov ecx, dword [rsp + 0x20]
lea edx, [rbx + 2]
call fcn.1400194f8
mov r14, rax
test rax, rax
jne 0x140015c7e
mov r8, r12
mov rdx, rsi
mov rcx, r13
call fcn.1400117b0
nop
cmp qword [rsp + 0x68], 8
jb 0x140015c21
mov rcx, qword [rsp + 0x50]
call fcn.1400187b4
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp qword [r12 + 0x18], 8
jb 0x140015c45
mov rcx, qword [r12]
call fcn.1400187b4
mov qword [r12 + 0x18], 7
mov qword [r12 + 0x10], rbx
mov word [r12], bx
cmp qword [rsi + 0x18], 8
jb 0x140015c67
mov rcx, qword [rsi]
call fcn.1400187b4
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
mov word [rsi], bx
mov rax, r13
jmp 0x14001609f
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x140015c9a
mov rcx, r14
call fcn.140018b3c
jmp 0x140015d0c
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rbx
mov word [rsp + 0xa0], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r14
lea rcx, [rsp + 0xa0]
call fcn.1400039a0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.1400083e0
nop
cmp qword [rsp + 0xb8], 8
jb 0x140015d0c
mov rcx, qword [rsp + 0xa0]
call fcn.1400187b4
mov rcx, r14
call fcn.140018b3c
nop
mov ecx, 0x10
call fcn.140018b7c
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140015d36
mov rcx, rax
call fcn.140010820
mov rdi, rax
jmp 0x140015d39
mov rdi, rbx
test rdi, rdi
jne 0x140015dbc
mov r8, r12
mov rdx, rsi
mov rcx, r13
call fcn.1400117b0
nop
cmp qword [rsp + 0x68], 8
jb 0x140015d5f
mov rcx, qword [rsp + 0x50]
call fcn.1400187b4
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp qword [r12 + 0x18], 8
jb 0x140015d83
mov rcx, qword [r12]
call fcn.1400187b4
mov qword [r12 + 0x18], 7
mov qword [r12 + 0x10], rbx
mov word [r12], bx
cmp qword [rsi + 0x18], 8
jb 0x140015da5
mov rcx, qword [rsi]
call fcn.1400187b4
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
mov word [rsi], bx
mov rax, r13
jmp 0x14001609f
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x60]
add r9, r9
movzx r15d, word [rsp + 0x130]
movzx edx, r15w
mov rcx, rdi
call fcn.1400108c0
movzx r14d, ax
shl r14d, 0x10
movzx eax, r15w
xor r14d, eax
mov rcx, rdi
call fcn.1400108a0
mov rcx, rdi
call fcn.1400187b4
nop
mov edx, 2
lea ecx, [rdx + 8]
call fcn.1400194f8
mov r15, rax
test rax, rax
jne 0x140015e7c
mov r8, r12
mov rdx, rsi
mov rcx, r13
call fcn.1400117b0
nop
cmp qword [rsp + 0x68], 8
jb 0x140015e40
mov rcx, qword [rsp + 0x50]
call fcn.1400187b4
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp qword [r12 + 0x18], 8
jb 0x140015e64
mov rcx, qword [r12]
call fcn.1400187b4
mov qword [r12 + 0x18], 7
mov qword [r12 + 0x10], rbx
mov word [r12], bx
jmp 0x140015c58
mov r9d, r14d
lea r8, [0x14002c9e8]
mov edx, 0xa
mov rcx, rax
call fcn.140019eac
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rbx
mov word [rsp + 0xa0], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r15
lea rcx, [rsp + 0xa0]
call fcn.1400039a0
nop
mov r8, r12
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x78]
call fcn.140008f20
nop
cmp qword [rsp + 0xb8], 8
jb 0x140015f01
mov rcx, qword [rsp + 0xa0]
call fcn.1400187b4
mov rcx, r15
call fcn.140018b3c
mov qword [r13 + 0x18], 7
mov qword [r13 + 0x10], rbx
mov word [r13], bx
lea rax, [rsp + 0x78]
cmp r13, rax
je 0x140015fae
cmp qword [r13 + 0x18], 8
jb 0x140015f38
mov rcx, qword [r13]
call fcn.1400187b4
mov qword [r13 + 0x18], 7
mov qword [r13 + 0x10], rbx
mov word [r13], bx
mov rcx, qword [rsp + 0x90]
cmp rcx, 8
jae 0x140015f7b
mov r8, qword [rsp + 0x88]
lea r8, [r8 + r8 + 2]
lea rdx, [rsp + 0x78]
mov rcx, r13
call fcn.1400187d0
mov rcx, qword [rsp + 0x90]
jmp 0x140015f89
mov rax, qword [rsp + 0x78]
mov qword [r13], rax
mov qword [rsp + 0x78], rbx
mov rax, qword [rsp + 0x88]
mov qword [r13 + 0x10], rax
mov qword [r13 + 0x18], rcx
mov qword [rsp + 0x88], rbx
mov rax, rbx
mov qword [rsp + 0x90], rbx
jmp 0x140015fb6
mov rax, qword [rsp + 0x90]
cmp rax, 8
jb 0x140015fc6
mov rcx, qword [rsp + 0x78]
call fcn.1400187b4
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbx
mov word [rsp + 0x78], bx
cmp qword [rsp + 0x68], 8
jb 0x140015ff1
mov rcx, qword [rsp + 0x50]
call fcn.1400187b4
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp qword [r12 + 0x18], 8
jb 0x140016015
mov rcx, qword [r12]
call fcn.1400187b4
mov qword [r12 + 0x18], 7
mov qword [r12 + 0x10], rbx
mov word [r12], bx
jmp 0x140015c58
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1400194d0
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret