Function at 0x140025de0
Capabilities:
Get session user name

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
xor esi, esi
mov r14, rcx
mov r12d, esi
call fcn.140042340
cmp byte [r14], 0x7e
mov r15, rax
mov qword [rsp + 0x38], rax
je 0x140025e3c
lea edx, [rsi + 0x24]
mov rcx, r14
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x140025e3c
mov rax, r15
jmp 0x14002624c
movzx eax, byte [r15]
mov r8d, esi
mov qword [rsp + 0x6f8], rbx
mov qword [rsp + 0x700], rdi
mov rdi, r15
mov dword [rsp + 0x24], esi
test al, al
je 0x140025eee
mov rbx, rsi
cmp al, 0x24
jne 0x140025e99
lea rdx, [rdi + 1]
nop dword [rax]
movzx eax, byte [rdx]
lea ecx, [rax - 0x30]
cmp cl, 9
jbe 0x140025e8f
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x140025e8f
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x140025e8f
cmp al, 0x5f
jne 0x140025e94
inc rdx
jmp 0x140025e70
sub rdx, rdi
jmp 0x140025eb1
lea rdx, [0x1400875fc]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcspn]
mov r8d, dword [rsp + 0x24]
mov rdx, rax
cmp rbx, 0x64
jge 0x140025fa2
mov qword [rbp + rbx*8 + 0xe0], rdi
mov dword [rsp + rbx*4 + 0x50], edx
jae 0x14002626b
add rdi, rdx
mov byte [rbp + rbx + 0x470], sil
inc r8d
inc rbx
mov dword [rsp + 0x24], r8d
movzx eax, byte [rdi]
test al, al
jne 0x140025e65
mov qword [rsp + 0x708], r13
mov r13d, 1
movsxd r15, r8d
test r8d, r8d
jle 0x1400260a6
mov rbx, rsi
nop dword [rax + rax]
mov rdi, qword [rbp + rbx*8 + 0xe0]
cmp byte [rdi], 0x24
jne 0x140026095
movsxd rax, dword [rsp + rbx*4 + 0x50]
cmp eax, r13d
je 0x140026095
mov r12, rax
lea rcx, [rdi + 1]
movzx eax, byte [rax + rdi]
mov byte [rsp + 0x20], al
mov byte [r12 + rdi], sil
call fcn.14002b180
mov rcx, rax
call fcn.140042340
mov rcx, rax
test rax, rax
jne 0x14002605a
lea rdx, [0x140087640]
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140025fbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__getpid]
lea r8, [0x14007c460]
mov edx, 0x64
mov r9d, eax
lea rcx, [rbp + 0x400]
call fcn.140030660
lea rcx, [rbp + 0x400]
call fcn.140020b50
jmp 0x140026057
mov r8, r14
lea rdx, str.Util_ExpandString
lea rcx, str._s:_Filename___s__has_too_many_chunks._n
call fcn.14001bf60
jmp 0x140026203
lea rdx, str.USER
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14002601c
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x28], 0x64
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14002600e
mov r8d, r13d
lea rcx, [rbp + 0x4e0]
mov rdx, 0xffffffffffffffff
call fcn.140042490
mov rcx, rax
test rax, rax
jne 0x14002605a
lea rcx, str.unknown
call fcn.140042340
jmp 0x140026057
mov r8, r14
lea rdx, [rdi + 1]
lea rcx, str.Environment_variable__s_not_defined_in__s._n
call fcn.14001bf60
mov r8d, 0x64
lea rcx, [rbp + 0x400]
mov rdx, rdi
call fcn.140030740
xor r8d, r8d
lea rcx, [rbp + 0x400]
lea rdx, [r8 - 1]
call fcn.140042490
mov rcx, rax
movzx eax, byte [rsp + 0x20]
mov byte [r12 + rdi], al
mov qword [rbp + rbx*8 + 0xe0], rcx
test rcx, rcx
je 0x14002619c
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x140026080
mov dword [rsp + rbx*4 + 0x50], eax
mov byte [rbp + rbx + 0x470], r13b
inc rbx
cmp rbx, r15
jl 0x140025f10
mov r8d, dword [rsp + 0x24]
mov r9d, esi
test r8d, r8d
jle 0x14002612f
cmp r8d, 8
jb 0x14002612f
mov ecx, r8d
xorps xmm2, xmm2
xorps xmm1, xmm1
and ecx, 0x80000007
jge 0x1400260d0
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, r8d
sub eax, ecx
movsxd rcx, eax
mov rax, rsi
nop dword [rax + rax]
movdqu xmm0, xmmword [rsp + rax*4 + 0x50]
add r9d, 8
paddd xmm0, xmm2
movdqa xmm2, xmm0
movdqu xmm0, xmmword [rsp + rax*4 + 0x60]
add rax, 8
paddd xmm0, xmm1
movdqa xmm1, xmm0
cmp rax, rcx
jl 0x1400260e0
paddd xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd r13d, xmm1
inc r13d
movsxd rcx, r9d
mov edx, esi
mov r8d, esi
cmp rcx, r15
jge 0x140026173
mov rax, r15
sub rax, rcx
cmp rax, 2
jl 0x140026162
lea rax, [r15 - 1]
nop dword [rax]
add edx, dword [rsp + rcx*4 + 0x50]
add r8d, dword [rsp + rcx*4 + 0x54]
add rcx, 2
cmp rcx, rax
jl 0x140026150
cmp rcx, r15
jge 0x14002616c
add r13d, dword [rsp + rcx*4 + 0x50]
lea eax, [r8 + rdx]
add r13d, eax
movsxd rcx, r13d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test rax, rax
jne 0x1400261b7
mov r8, r14
lea rdx, str.Util_ExpandString
lea rcx, str._s:_Cannot_allocate_memory_for_the_expansion_of___s_._n
call fcn.14001bf60
jmp 0x1400261f6
mov r8, r14
lea rdx, str.Util_ExpandString
lea rcx, str._s:_Cannot_allocate_memory_to_expand___in___s_._n
call fcn.14001bf60
mov r12, rsi
jmp 0x1400261f6
mov r14, rax
test r15, r15
jle 0x1400261f3
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
movsxd rbx, dword [rsp + rdi*4 + 0x50]
mov rcx, r14
mov rdx, qword [rbp + rdi*8 + 0xe0]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add r14, rbx
inc rdi
cmp rdi, r15
jl 0x1400261d0
mov byte [r14], sil
mov r15, qword [rsp + 0x38]
mov r13, qword [rsp + 0x708]
movsxd rbx, dword [rsp + 0x24]
test rbx, rbx
jle 0x140026230
nop dword [rax]
cmp byte [rbp + rsi + 0x470], 0
je 0x140026228
mov rcx, qword [rbp + rsi*8 + 0xe0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc rsi
cmp rsi, rbx
jl 0x140026210
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x6f8]
mov rax, r12
mov rdi, qword [rsp + 0x700]
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.14006a480
add rsp, 0x6c0
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
call fcn.14006a624
int3