Function at 0x14000b190
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x2b0
mov rax, qword [0x14007a040]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x90]
call fcn.140040ae0
mov dword [rsp + 0x80], 0x104
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 3
lea rdx, [0x14006c440]
lea rcx, [rsp + 0x20]
call fcn.14000fb90
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000b25b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b256
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b98f
call fcn.140028130
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 8
lea rdx, [0x14006c448]
lea rcx, [rsp + 0x20]
call fcn.14000fb90
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000b2d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b2cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b995
call fcn.140028130
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0xf
lea rdx, str.C:UsersPublic
lea rcx, [rsp + 0x20]
call fcn.14000fb90
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000b34d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b348
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b99b
call fcn.140028130
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rsp + 0x20]
call fcn.14000fb90
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000b3c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b3c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9a1
call fcn.140028130
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x16
lea rdx, str.C:ProgramDataDrivers
lea rcx, [rsp + 0x20]
call fcn.14000fb90
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000b43f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b43a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9a7
call fcn.140028130
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x20
lea rdx, str.C:ProgramDataDriversIntel_AMD
lea rcx, [rsp + 0x20]
call fcn.14000fb90
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000b4b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b4b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9ad
call fcn.140028130
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 9
lea rdx, str.C:Kisass
lea rcx, [rsp + 0x20]
call fcn.14000fb90
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000b531
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b52c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9b3
call fcn.140028130
lea rax, str.C:Users
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0xb
lea rax, [rsp + 0x90]
mov qword [rsp + 0x58], rax
movabs rbx, 0xb000000000000000
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140011f60
nop
mov r8b, 1
lea rdx, [rsp + 0x60]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000b5f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b5eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9b9
call fcn.140028130
lea rax, str.C:UsersAppDataRoaming
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x1b
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140011f60
nop
xor r8d, r8d
lea rdx, [rsp + 0x60]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000b6a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9bf
call fcn.140028130
lea rax, str.C:UsersAppDataLocal
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x19
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140011f60
nop
xor r8d, r8d
lea rdx, [rsp + 0x60]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000b75a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b755
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9c5
call fcn.140028130
lea rax, str.C:UsersAppDataLocalWordGenius_Technologies
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x31
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140011f60
nop
xor r8d, r8d
lea rdx, [rsp + 0x60]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000b80f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b80a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9cb
call fcn.140028130
lea rax, str.C:UsersAppDataLocalGreenTech_Dynamics
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x2c
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140011f60
nop
xor r8d, r8d
lea rdx, [rsp + 0x60]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000b8c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b8bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9d1
call fcn.140028130
lea rax, str.C:UsersAppDataLocalSkySync_Technologies
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x2e
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140011f60
nop
xor r8d, r8d
lea rdx, [rsp + 0x60]
call fcn.14000b9e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000b976
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b970
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9d7
call fcn.140028130
nop
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140028110
add rsp, 0x2b0
pop rbx
ret
call fcn.14002e1f4
nop
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3
call fcn.14002e1f4
int3