Function at 0x140041a78
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14d, r9d
mov dword [rsp + 0x40], r9d
mov qword [rsp + 0x58], r8
mov r12b, dl
mov qword [rsp + 0x50], rcx
mov rdi, qword [rbp + 0x238]
mov rbx, qword [rbp + 0x240]
mov r13, qword [rbp + 0x248]
xor esi, esi
mov qword [r13], rsi
test rdi, rdi
jne 0x140041aef
test rbx, rbx
je 0x140041af4
test dl, dl
je 0x140041aeb
mov eax, dword [rbx + 0xdc]
jmp 0x140041b07
mov eax, esi
jmp 0x140041b07
test rbx, rbx
je 0x140041afe
mov eax, 0x80070057
jmp 0x140041d08
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
test eax, eax
je 0x140041b13
mov ecx, eax
call qword [sym.imp.vsdebugeng.dll_DkmDllSetRootProcessId]
xor r9d, r9d
xor r8d, r8d
lea r15d, [r9 + 1]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rsi
lea ecx, [r15 + 0x47]
call fcn.14005f888
mov rsi, rax
mov qword [rsp + 0x60], rax
lea rax, [0x14037ccf8]
mov qword [rsi], rax
mov dword [rsi + 8], r15d
lea rax, [0x14037cce0]
mov qword [rsi], rax
mov ecx, r15d
lock xadd dword [0x1403e481c], ecx
add ecx, r15d
cmp ecx, 0x7fffffff
jb 0x140041b77
lea ecx, [r15 + 0xd]
int 0x29
lea rax, [0x14037e258]
mov qword [rsi], rax
lea r15, [rsi + 0x10]
lea rax, [0x14037e220]
mov qword [r15], rax
lea rax, [0x14037e200]
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], rdi
mov qword [rsi + 0x30], rbx
xor ecx, ecx
mov dword [rsi + 0x38], ecx
mov al, byte [rbp + 0x230]
mov byte [rsi + 0x3c], al
mov byte [rsi + 0x3d], cl
mov qword [rsi + 0x40], rcx
mov rbx, rsi
mov qword [rsp + 0x48], rbx
cmp r14d, 3
jne 0x140041c2c
mov dword [rsp + 0x38], 0x101
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x140041c0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x140041cf8
lea rcx, [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov rcx, qword [rsi + 0x40]
cmp rcx, rax
je 0x140041c2c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi + 0x40], r14
mov r14, qword [rsp + 0x50]
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x70], r12b
mov rax, qword [rsp + 0x58]
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x74], xmm0
mov eax, dword [rsp + 0x40]
mov dword [rbp - 0x7c], eax
mov qword [rbp - 0x78], r15
xor r15d, r15d
mov word [rbp - 0x70], r15w
test rdi, rdi
je 0x140041c69
movzx eax, word [rdi + 0x24]
mov word [rbp - 0x70], ax
xor edx, edx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, str.SoftwareMicrosoftVisualStudio16.0
call qword [sym.imp.vsdebugeng.dll_DkmDllEnsureInitialized]
mov edi, eax
test eax, eax
jns 0x140041ce9
cmp eax, 0x803d000b
je 0x140041ce2
mov esi, 0x803d000c
cmp eax, esi
je 0x140041cba
cmp eax, 0x803d0020
je 0x140041cdb
cmp eax, 0x803d0021
je 0x140041cba
cmp eax, 0x92330015
jne 0x140041cf8
mov edi, 0x805e000a
jmp 0x140041cf8
mov byte [rsp + 0x30], r15b
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140041fe0
test eax, eax
js 0x140041cd7
cmp byte [rsp + 0x30], r15b
jne 0x140041ce2
cmp edi, esi
jne 0x140041cf8
mov edi, 0x805e000b
jmp 0x140041cf8
mov edi, 0x805e0008
jmp 0x140041cf8
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov qword [r13], rsi
mov edi, r15d
test rbx, rbx
je 0x140041d06
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, edi
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14005f5e0
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret