Function at 0x7ff65a729080
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x7ff65a7b0200]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov r12, rcx
mov qword [rbp + 0xa8], rdx
xor r13d, r13d
cmp byte [0x7ff65a7b16a8], r13b
jne 0x7ff65a7290f8
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
lea r8d, [r13 + 0x52]
lea rdx, [0x7ff65a787930]
lea rcx, [rsp + 0x78]
call fcn.7ff65a6f3710
lea rcx, [rsp + 0x78]
call fcn.7ff65a724f20
mov dword [rbp + 0xb0], 0x64
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x100]
call qword [sym.imp.advapi32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
lea rax, [rbp + 0x100]
mov rcx, 0xffffffffffffffff
mov rbx, rcx
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff65a729140
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x7ff65a7298d1
mov eax, 0x16
cmp rbx, 0x10
jae 0x7ff65a7291ae
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], 0xf
mov r8, rbx
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xb8]
call sub.VCRUNTIME140.dll_memcpy_1
mov byte [rbp + rbx + 0xb8], 0
mov rdi, qword [rbp + 0xd0]
mov rbx, qword [rbp + 0xc8]
mov r15, qword [rbp + 0xb8]
jmp 0x7ff65a72920c
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x7ff65a7291bf
mov rdi, r14
jmp 0x7ff65a7291c6
cmp rdi, rax
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, rcx
lea rcx, [rbp + 0xb8]
call fcn.7ff65a6f38f0
mov r15, rax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], rdi
mov r8, rbx
lea rdx, [rbp + 0x100]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy_1
mov byte [r15 + rbx], 0
mov dword [rsp + 0x58], 0xf0eaf3bd
mov dword [rsp + 0x5c], 0xc6c8d2fa
mov word [rsp + 0x60], 0x9e
mov byte [rsp + 0x62], 1
mov dword [rsp + 0x20], 0xf3fcf2bd
mov dword [rsp + 0x24], 0x1009dfa
mov dword [rsp + 0x68], 0xedf8efbd
mov dword [rsp + 0x6c], 0xcccec9ec
mov dword [rsp + 0x70], 0x98c0ca
mov byte [rsp + 0x74], 1
mov dword [rsp + 0x48], 0xedf8f1bd
mov dword [rsp + 0x4c], 0xc7c6c1ec
mov word [rsp + 0x50], 0x9e
mov byte [rsp + 0x52], 1
mov dword [rsp + 0x28], 0xebfeecbd
mov dword [rsp + 0x2c], 0x9fd3c5ec
mov word [rsp + 0x30], 0x100
mov dword [rsp + 0x38], 0xfbede5ef
mov dword [rsp + 0x3c], 0xc5cecca2
mov word [rsp + 0x40], 0x100
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x78]
call fcn.7ff65a71a330
nop
lea rdx, [rbp + 0xb8]
cmp rdi, 0x10
cmovae rdx, r15
mov r8, rbx
mov rcx, rax
call fcn.7ff65a710710
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x58]
call fcn.7ff65a71a530
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x7ff65a72930b
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.7ff65a710710
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x38]
call fcn.7ff65a71a730
nop
lea rdx, [r12 + 0x238]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff65a72935e
mov rdx, qword [rdx]
mov rcx, rax
call fcn.7ff65a710710
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 8]
call fcn.7ff65a71a250
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x7ff65a7293a6
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.7ff65a710710
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x28]
call fcn.7ff65a71a530
nop
lea rdx, [r12 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff65a7293f9
mov rdx, qword [rdx]
mov rcx, rax
call fcn.7ff65a710710
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x7ff65a729463
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a72945e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a72945e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
movdqa xmm0, xmmword [0x7ff65a787330]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x7ff65a7294b4
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a7294ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a7294ae
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x7ff65a7294f2
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a7294ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a7294ed
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
movdqa xmm0, xmmword [0x7ff65a787330]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x7ff65a729542
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a72953c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a72953c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x7ff65a729580
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a72957b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a72957b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
movdqa xmm0, xmmword [0x7ff65a787330]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x7ff65a7295d0
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a7295ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a7295ca
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x7ff65a72960e
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a729609
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a729609
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
movdqa xmm0, xmmword [0x7ff65a787330]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x7ff65a72965e
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a729658
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a729658
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x7ff65a72969f
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a72969a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a72969a
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
movdqa xmm0, xmmword [0x7ff65a787330]
movdqu xmmword [rbp + 0x88], xmm0
mov byte [rbp + 0x78], 0
lea rax, [rbp - 0x48]
mov qword [rbp + 0x98], rax
lea rdx, [r12 + 0x80]
lea rcx, [rbp - 0x48]
call fcn.7ff65a6fc0a0
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
lea r15, [rbp + 0xd8]
mov rdi, qword [rbp + 0xd8]
mov r13, qword [rbp + 0xf0]
cmp r13, 0x10
cmovae r15, rdi
mov rbx, qword [rbp + 0xe8]
cmp rbx, r14
ja 0x7ff65a7298cb
mov qword [rbp - 0x70], 0xf
cmp rbx, 0x10
jae 0x7ff65a72972c
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x78], xmm0
jmp 0x7ff65a729781
mov rax, rbx
or rax, 0xf
cmp rax, r14
ja 0x7ff65a729748
mov r14, rax
cmp rax, 0x16
mov eax, 0x16
cmovb r14, rax
mov rdx, r14
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x78]
call fcn.7ff65a6f38f0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r14
lea r8, [rbx + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy_1
nop
mov r8, r12
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.7ff65a72ba80
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x7ff65a7297d1
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a7297cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a7297cb
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
nop
cmp r13, 0x10
jb 0x7ff65a72980c
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x7ff65a729803
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a729803
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.7ff65a77f448
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x7ff65a729851
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a72984b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a72984b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x7ff65a729887
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x7ff65a729882
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff65a7298c4
mov rcx, r8
call fcn.7ff65a77f448
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.7ff65a77fd80
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff65a6f1ab0
nop
call fcn.7ff65a6f1ab0
int3