Function at 0x140004ac8
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x248]
sub rsp, 0x320
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r15, qword [0x140029b68]
lea rcx, [0x140029c98]
call qword [sym.imp.Cmmlib.dll_public:_bool___cdecl_Cmm::CStringT_wchar_t_::empty_void_const___ptr64]
xor ebx, ebx
test al, al
jne 0x140004dcd
call qword [sym.imp.Cmmlib.dll_public:_static_class_Cmm::CommandLine____ptr64___cdecl_Cmm::CommandLine::ForCurrentProcess_void_]
mov r14, rax
test rax, rax
je 0x140004e3e
lea r12d, [rbx + 0xf]
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], 0xb
movsd xmm0, qword [str.runaszvideo]
movsd qword [rbp - 0x68], xmm0
movzx ecx, word [0x14001bb98]
mov word [rbp - 0x60], cx
mov cl, byte [0x14001bb9a]
mov byte [rbp - 0x5e], cl
mov byte [rbp - 0x5d], bl
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Cmm::CommandLine::GetSwitchValueASCII_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
nop
mov r13d, 0x1000
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140004bb6
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, r13
jb 0x140004bb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bb1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015138
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], r12
mov byte [rbp - 0x68], bl
lea rcx, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x10
cmovae rcx, rdi
cmp qword [rsp + 0x38], 4
jne 0x140004bfa
mov r8d, 4
lea rdx, str.TRUE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004d9e
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x80], 7
mov eax, dword [str.multipt]
mov dword [rsp + 0x70], eax
movzx eax, word [0x14001bbac]
mov word [rsp + 0x74], ax
mov al, byte [0x14001bbae]
mov byte [rsp + 0x76], al
mov byte [rsp + 0x77], bl
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Cmm::CommandLine::GetSwitchValueASCII_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
mov rdi, rax
lea rax, [rsp + 0x28]
cmp rax, rdi
je 0x140004cad
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004c84
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, r13
jb 0x140004c7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004cdd
call fcn.140015138
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x28], bl
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x38], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], r12
mov byte [rdi], bl
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140004ce9
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, r13
jb 0x140004ce4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ce4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015138
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r12
mov byte [rsp + 0x48], bl
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140004d32
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r13
jb 0x140004d2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015138
lea rcx, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x10
cmovae rcx, rdi
cmp qword [rsp + 0x38], 4
jne 0x140004d67
mov r8d, 4
lea rdx, str.TRUE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004d9e
call fcn.140003294
test eax, eax
je 0x140004d8b
call fcn.1400040f0
test eax, eax
jne 0x140004d8b
call fcn.140004648
test eax, eax
jne 0x140004d8b
call fcn.14000475c
test eax, eax
je 0x140004d94
call fcn.1400044e4
test eax, eax
je 0x140004e02
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp rsi, 0x10
jb 0x140004dcd
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, r13
jb 0x140004dc5
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004e32
mov rcx, rdi
call fcn.140015138
mov eax, 1
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140014e50
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004e3e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, r13
jb 0x140004e39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015138
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CFileName::constructor_void____ptr64]
nop
xor edx, edx
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CFileName::GetModuleFileNameW_struct_HINSTANCE______ptr64____ptr64]
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CFileName::GetName_void_const___ptr64]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [0x140029c98]
lea rcx, [rbp - 0x20]
call qword [sym.imp.Cmmlib.dll_public:_bool___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t__const____ptr64_const___ptr64]
test al, al
je 0x140004fe9
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_void____ptr64]
nop
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0xff
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140004ecd
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x70]
call qword [reloc.Cmmlib.dll___4__CStringT__W_Cmm__QEAAAEAV01_PEB_W_Z]
lea rdx, str.Global_
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
lea rdi, [0x14001bbc0]
test eax, eax
jne 0x140004f14
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, [0x140029c98]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
call fcn.1400040f0
test eax, eax
je 0x140004f4f
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.uploadCrashDump
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_char_const____ptr64____ptr64]
call fcn.14000475c
test eax, eax
je 0x140004f78
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.uploadFeedback
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_char_const____ptr64____ptr64]
call fcn.140007168
test al, al
je 0x140004fa1
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.ZoomMedia
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_char_const____ptr64____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64_void_const___ptr64]
mov r9, rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r15], rax
test rax, rax
je 0x14000500a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000500a
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov ebx, 1
lea rcx, [rbp - 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CFileName::destructor_void____ptr64]
mov eax, ebx
jmp 0x140004dd2
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
jmp 0x140004fee