Function at 0x140001d20
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x140005030]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov edi, 0xffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rbp + 0x1d8], 0xf
mov qword [rbp + 0x1d0], 0xf
movsd xmm0, qword [0x140001248]
movsd qword [rbp + 0x1c0], xmm0
mov eax, dword [0x140001250]
mov dword [rbp + 0x1c8], eax
movzx eax, word [0x140001254]
mov word [rbp + 0x1cc], ax
movzx eax, byte [0x140001256]
mov byte [rbp + 0x1ce], al
mov byte [rbp + 0x1cf], r14b
mov qword [rsp + 0x78], r14
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [0x140001068]
xor edx, edx
lea r8d, [r14 + 1]
lea rcx, [0x140001088]
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x68]
movups xmmword [rbp + 0x10], xmm0
movsd xmm0, qword [rbp + 0x78]
movsd qword [rsp + 0x68], xmm0
lea rcx, [rbp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x50]
movups xmmword [rbp], xmm0
movsd xmm0, qword [rbp + 0x60]
movsd qword [rbp - 0x78], xmm0
lea rcx, [rbp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x38]
movups xmmword [rbp - 0x10], xmm0
movsd xmm0, qword [rbp + 0x48]
movsd qword [rsp + 0x50], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x10]
movaps xmmword [rbp + 0xe0], xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rbp + 0xf0], xmm0
movups xmm0, xmmword [rbp]
movaps xmmword [rbp + 0x100], xmm0
movsd xmm0, qword [rbp - 0x78]
movsd qword [rbp + 0x110], xmm0
movups xmm0, xmmword [rbp - 0x10]
movaps xmmword [rbp + 0x120], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp + 0x130], xmm0
movups xmm0, xmmword [rbp + 0x20]
movaps xmmword [rbp + 0x140], xmm0
movsd xmm1, qword [rbp + 0x30]
movsd qword [rbp + 0x150], xmm1
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x100]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x140]
call qword [rax + 0x50]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rbp - 0x80], r14
lea ecx, [rdi + 0x19]
call fcn.140003668
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140001f70
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x140001258]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140002752
jmp 0x140001f73
mov rbx, r14
mov qword [rbp + 0xb0], rbx
test rbx, rbx
je 0x14000277e
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r8, [rbp - 0x80]
mov rdx, qword [rbx]
call qword [rax + 0x38]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140001fd2
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001fb3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001fc5
call fcn.140003660
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003660
lea rsi, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0x10
cmovae rsi, qword [rbp + 0x1c0]
mov ecx, 0x18
call fcn.140003668
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140002018
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
mov rcx, rsi
call fcn.140003310
mov qword [rbx], rax
jmp 0x14000201b
mov rbx, r14
mov qword [rbp + 0xb8], rbx
test rbx, rbx
je 0x14000277e
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x78]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140002078
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002059
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000206b
call fcn.140003660
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003660
mov qword [rsp + 0x58], r14
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp - 0x68], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
call qword [rax + 0x38]
mov ecx, 0x18
call fcn.140003668
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400020e0
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x140001260]
call fcn.140003310
mov qword [rbx], rax
jmp 0x1400020e3
mov rbx, r14
mov qword [rbp + 0xc0], rbx
test rbx, rbx
je 0x14000277e
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x50]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000213d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000211e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002130
call fcn.140003660
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003660
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp - 0x60], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
call qword [rax + 0x58]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
mov edx, edi
call qword [rax + 0xb0]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp - 0x58], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rbp - 0x58]
call qword [rax + 0x48]
mov qword [rbp - 0x50], r14
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
mov esi, 8
mov edx, esi
call qword [rax + 0x50]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x60], r14
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
lea rdx, [0x140001078]
call qword [rax]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea ecx, [rsi + 0x10]
call fcn.140003668
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140002208
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x140001270]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000275d
jmp 0x14000220b
mov rbx, r14
mov qword [rbp + 0xd8], rbx
test rbx, rbx
je 0x14000277e
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x48]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140002266
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002247
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002259
call fcn.140003660
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003660
mov ecx, 0x18
call fcn.140003668
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400022a3
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x140001288]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140002768
jmp 0x1400022a6
mov rbx, r14
mov qword [rbp - 0x10], rbx
test rbx, rbx
je 0x14000277e
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x78]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400022fe
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400022df
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400022f1
call fcn.140003660
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003660
mov ecx, 0x18
call fcn.140003668
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000233b
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x1400012b0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140002773
jmp 0x14000233e
mov rbx, r14
mov qword [rbp], rbx
test rbx, rbx
je 0x14000277e
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x88]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140002399
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000237a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000238c
call fcn.140003660
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003660
mov ecx, 0x18
call fcn.140003668
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400023cc
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x1400012d8]
call fcn.140003310
mov qword [rbx], rax
jmp 0x1400023cf
mov rbx, r14
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14000277e
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0xa8]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000242a
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000240b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000241d
call fcn.140003660
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003660
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp - 0x48], r14
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
call qword [rax + 0x88]
mov qword [rbp - 0x40], r14
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
lea r8, [rbp - 0x40]
xor edx, edx
call qword [rax + 0x60]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp - 0x38], r14
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea r8, [rbp - 0x38]
lea rdx, [0x140001098]
call qword [rax]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
lea rdx, [0x140001318]
call qword [rax + 0x58]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp - 0x30], r14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
mov dword [rbp + 0x240], eax
mov dword [rbp - 0x70], 0x64
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x98]
movups xmmword [rsp + 0x68], xmm0
movsd xmm0, qword [rbp + 0xa8]
movsd qword [rsp + 0x50], xmm0
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x80]
movups xmmword [rbp + 0xc8], xmm0
movsd xmm0, qword [rbp + 0x90]
movsd qword [rbp - 0x78], xmm0
mov word [rbp - 0x28], si
lea rcx, [rbp + 0x1e0]
call fcn.140003310
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [rsp + 0x68]
movaps xmmword [rbp + 0x160], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp + 0x170], xmm0
movups xmm0, xmmword [rbp + 0xc8]
movaps xmmword [rbp + 0x180], xmm0
movsd xmm0, qword [rbp - 0x78]
movsd qword [rbp + 0x190], xmm0
movups xmm0, xmmword [rbp - 0x28]
movaps xmmword [rbp + 0x1a0], xmm0
movsd xmm1, qword [rbp - 0x18]
movsd qword [rbp + 0x1b0], xmm1
lea rsi, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0x10
cmovae rsi, qword [rbp + 0x1c0]
mov ecx, 0x18
call fcn.140003668
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400025ef
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
mov rcx, rsi
call fcn.140003310
mov qword [rbx], rax
jmp 0x1400025f2
mov rbx, r14
mov qword [rbp - 0x78], rbx
test rbx, rbx
je 0x140002747
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x160]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 3
lea rdx, [rbp + 0x180]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x1a0]
mov qword [rsp + 0x20], rdx
mov r9d, 6
mov r8, qword [rsp + 0x58]
mov rdx, qword [rbx]
call qword [rax + 0x88]
nop
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x14000268b
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000266b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000267d
call fcn.140003660
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003660
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x14000271b
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002716
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002716
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003660
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140003640
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140003300
nop
mov ecx, 0x8007000e
call fcn.140003300
nop
mov ecx, 0x8007000e
call fcn.140003300
nop
mov ecx, 0x8007000e
call fcn.140003300
nop
mov ecx, 0x8007000e
call fcn.140003300
nop
mov ecx, 0x8007000e
call fcn.140003300
int3