Function at 0x180035fd4
Capabilities:
Get session user name

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x340
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800764c0]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rbx, rdx
mov r13, rcx
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x60], r14d
mov r12, 0xffffffff80000002
lea rbp, str.SoftwareWOW6432Nodeprojonepodlp_rptcachependings_
mov edi, 0x80
cmp word [0x18007b220], r14w
jne 0x18003614c
mov word [r11 - 0x138], r14w
xor edx, edx
lea r8d, [rdi + 0x7e]
lea rcx, [r11 - 0x136]
call fcn.18003eb60
mov dword [rsp + 0x60], edi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x230]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp eax, r14d
je 0x18003614c
lea rdx, str.system
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, r14d
jne 0x18003611c
lea r9, str.agentUser
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rdx, r12
lea rcx, [rsp + 0x130]
call fcn.18001c1d4
cmp qword [rsp + 0x148], r14
jne 0x1800360d8
mov r8d, edi
lea rdx, [rsp + 0x230]
lea rcx, [0x18007b220]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x180036102
lea rdx, [rsp + 0x138]
cmp qword [rsp + 0x150], 8
cmovae rdx, qword [rsp + 0x138]
mov r8d, edi
lea rcx, [0x18007b220]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp qword [rsp + 0x150], 8
jb 0x18003614c
mov rcx, qword [rsp + 0x138]
call fcn.18003c660
jmp 0x18003614c
call fcn.18001965c
cmp eax, r14d
jne 0x180036134
mov r12, 0xffffffff80000001
lea rbp, str.Softwareprojonepodlp_rptcachependings
mov r8d, edi
lea rdx, [rsp + 0x230]
lea rcx, [0x18007b220]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp byte [0x18007b320], r14b
jne 0x18003619b
lea rcx, [rsp + 0xd8]
call fcn.180033140
cmp qword [rax + 0x20], 0x10
jb 0x18003616f
mov rdx, qword [rax + 8]
jmp 0x180036173
lea rdx, [rax + 8]
mov r8d, edi
lea rcx, [0x18007b320]
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp qword [rsp + 0xf8], 0x10
jb 0x18003619b
mov rcx, qword [rsp + 0xe0]
call fcn.18003c660
cmp word [0x18007b220], r14w
je 0x180036794
cmp byte [0x18007b320], r14b
je 0x180036794
cmp r13, r14
je 0x180036790
cmp byte [rbx + 8], 7
jne 0x180036790
mov edi, 0xf
mov qword [rsp + 0x150], rdi
mov qword [rsp + 0x148], r14
mov byte [rsp + 0x138], r14b
lea r8d, [rdi - 7]
lea rdx, str.i_action
lea rcx, [rsp + 0x130]
call fcn.1800023b4
nop
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xf0], r14
mov byte [rsp + 0xe0], r14b
xor r8d, r8d
lea rdx, [0x18005f729]
lea rcx, [rsp + 0xd8]
call fcn.1800023b4
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0x130]
mov rdx, rbx
lea rcx, [rsp + 0x158]
call fcn.180002de8
nop
cmp qword [rsp + 0x150], 0x10
jb 0x180036267
mov rcx, qword [rsp + 0x138]
call fcn.18003c660
mov qword [rsp + 0x150], rdi
mov qword [rsp + 0x148], r14
mov byte [rsp + 0x138], r14b
lea rdx, str.replace
lea rcx, [rsp + 0x158]
call fcn.180008718
cmp al, r14b
jne 0x1800362b5
lea rdx, str.delete
lea rcx, [rsp + 0x158]
call fcn.180008718
cmp al, r14b
je 0x18003633b
lea rdx, str.i_key_columns
mov rcx, rbx
call fcn.180026a24
cmp byte [rax + 8], 4
jne 0x1800362f6
lea rdx, str.i_key_columns
mov rcx, rbx
call fcn.180026a24
mov rcx, rax
lea rdx, [rsp + 0x78]
call fcn.1800258ec
mov esi, 1
cmp qword [rax + 0x18], r14
je 0x1800362f6
mov dil, r14b
jmp 0x1800362f9
mov dil, 1
test sil, 1
je 0x180036317
cmp qword [rsp + 0x98], 0x10
jb 0x180036317
mov rcx, qword [rsp + 0x80]
call fcn.18003c660
cmp dil, r14b
je 0x18003633b
cmp qword [rsp + 0x178], 0x10
jb 0x180036334
mov rcx, qword [rsp + 0x160]
call fcn.18003c660
xor eax, eax
jmp 0x180036796
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.1800255a0
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
mov rdx, r13
lea rcx, [rsp + 0x78]
call fcn.1800254b0
mov rdi, rax
lea rdx, str.i_dt
lea rcx, [rsp + 0xb0]
call fcn.180026aa8
mov rcx, rax
mov rdx, rdi
call fcn.1800257e4
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x68], rcx
lea rdx, [0x18007b320]
lea rcx, [rsp + 0x78]
call fcn.1800254b0
mov rdi, rax
lea rdx, str.client_unique
lea rcx, [rsp + 0xb0]
call fcn.180026aa8
mov rcx, rax
mov rdx, rdi
call fcn.1800257e4
lea rdx, str.user_name
lea rcx, [rsp + 0xb0]
call fcn.180026aa8
cmp byte [rax + 8], r14b
jne 0x1800364c8
lea rax, [rsp + 0x108]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x1a0], 7
mov qword [rsp + 0x198], r14
mov word [rsp + 0x188], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18007b220]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x18007b220]
lea rcx, [rsp + 0x180]
call fcn.180002638
nop
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x78]
call fcn.180002d54
nop
mov rdx, rax
lea rcx, [rsp + 0x108]
call fcn.180025558
mov rdi, rax
lea rdx, str.user_name
lea rcx, [rsp + 0xb0]
call fcn.180026aa8
mov rcx, rax
mov rdx, rdi
call fcn.1800257e4
nop
cmp qword [rsp + 0x98], 0x10
jb 0x180036494
mov rcx, qword [rsp + 0x80]
call fcn.18003c660
mov qword [rsp + 0x98], 0xf
mov qword [rsp + 0x90], r14
mov byte [rsp + 0x80], r14b
cmp qword [rsp + 0x1a0], 8
jb 0x1800364c8
mov rcx, qword [rsp + 0x188]
call fcn.18003c660
lea rdx, str.data_time
lea rcx, [rsp + 0xb0]
call fcn.180026aa8
cmp byte [rax + 8], r14b
jne 0x1800365bc
mov byte [rsp + 0x180], r14b
xor eax, eax
mov qword [rsp + 0x181], rax
mov qword [rsp + 0x189], rax
mov qword [rsp + 0x191], rax
mov dword [rsp + 0x199], eax
mov word [rsp + 0x19d], ax
mov byte [rsp + 0x19f], al
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x74]
movzx eax, word [rsp + 0x72]
movzx ecx, word [rsp + 0x70]
movzx edi, word [rsp + 0x6e]
movzx r8d, word [rsp + 0x6a]
movzx r9d, word [rsp + 0x68]
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r8d
lea r8, str._04d__02d__02d__02d:_02d:_02d
mov edx, 0x20
lea rcx, [rsp + 0x180]
call qword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x68], rcx
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x108]
call fcn.1800254b0
mov rdi, rax
lea rdx, str.data_time
lea rcx, [rsp + 0xb0]
call fcn.180026aa8
mov rcx, rax
mov rdx, rdi
call fcn.1800257e4
mov word [rsp + 0x1b0], r14w
xor edx, edx
lea r8d, [rdx + 0x7e]
lea rcx, [rsp + 0x1b2]
call fcn.18003eb60
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [0x18007b3a0]
mov ebx, edx
inc edx
mov dword [0x18007b3a0], edx
call fcn.18001ab80
movzx ecx, word [rsp + 0xac]
movzx edx, word [rsp + 0xaa]
movzx edi, word [rsp + 0xa8]
movzx r8d, word [rsp + 0xa6]
movzx r10d, word [rsp + 0xa2]
movzx r9d, word [rsp + 0xa0]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r10d
lea r8, str._04d__02d__02d__02d:_02d:_02d__d__08x
mov edx, 0x40
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0xb0]
call fcn.180026f94
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.18000104c
cmp qword [rax + 0x20], 8
jb 0x180036696
mov r9, qword [rax + 8]
jmp 0x18003669a
lea r9, [rax + 8]
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0x1b0]
mov rdx, rbp
mov rcx, r12
call fcn.18001c154
mov ebx, eax
cmp qword [rsp + 0x98], 8
jb 0x1800366cc
mov rcx, qword [rsp + 0x80]
call fcn.18003c660
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], r14
mov word [rsp + 0x80], r14w
cmp qword [rsp + 0x1a0], 0x10
jb 0x180036701
mov rcx, qword [rsp + 0x188]
call fcn.18003c660
cmp ebx, r14d
je 0x180036745
lea r8, str.GlobalD36B0A68_AE78_4fa2_BD9C_05FD95224F52
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rdi, rax
cmp rax, r14
je 0x18003672f
cmp rax, 0xffffffffffffffff
je 0x180036766
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp rdi, 0xffffffffffffffff
je 0x180036766
cmp rdi, r14
je 0x180036766
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180036766
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x1b0]
mov rdx, rbp
lea rcx, str.CachedReport_write_register_failed:__s._s__d
call fcn.180019070
nop
lea rcx, [rsp + 0xb0]
call fcn.18002574c
nop
cmp qword [rsp + 0x178], 0x10
jb 0x18003678c
mov rcx, qword [rsp + 0x160]
call fcn.18003c660
mov eax, ebx
jmp 0x180036796
xor eax, eax
jmp 0x180036796
xor eax, eax
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.18003c1a0
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret