Function at 0x14001423c
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x320
mov rax, qword [0x140028010]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r15, qword [0x14002ce68]
lea rcx, [0x14002cea0]
call qword [sym.imp.Cmmlib.dll_public:_bool___cdecl_Cmm::CStringT_wchar_t_::empty_void_const___ptr64]
xor ebx, ebx
test al, al
jne 0x1400146a6
call qword [sym.imp.Cmmlib.dll_public:_static_class_Cmm::CommandLine____ptr64___cdecl_Cmm::CommandLine::ForCurrentProcess_void_]
mov r14, rax
test rax, rax
je 0x140014717
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x58], rbx
lea r13d, [rbx + 0xf]
mov qword [rbp - 0x50], r13
mov byte [rbp - 0x68], bl
lea r8d, [rbx + 0xb]
lea rdx, str.runaszvideo
lea rcx, [rbp - 0x68]
call fcn.1400090e0
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Cmm::CommandLine::GetSwitchValueASCII_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14001431c
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014317
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014317
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015adc
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], r13
mov byte [rbp - 0x68], bl
lea rcx, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x10
cmovae rcx, rdi
cmp qword [rsp + 0x38], 4
jne 0x140014360
mov r8d, 4
lea rdx, str.TRUE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140014673
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], r13
mov byte [rsp + 0x70], bl
mov r8d, 7
lea rdx, str.multipt
lea rcx, [rsp + 0x70]
call fcn.1400090e0
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Cmm::CommandLine::GetSwitchValueASCII_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
mov rdi, rax
lea rax, [rsp + 0x28]
cmp rax, rdi
je 0x14001440b
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400143e2
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400143dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001443f
call fcn.140015adc
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x28], bl
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x38], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], r13
mov byte [rdi], bl
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14001444b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014446
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014446
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015adc
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x48], bl
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140014498
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014493
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014493
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015adc
lea rcx, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x10
cmovae rcx, rdi
cmp qword [rsp + 0x38], 4
jne 0x1400144d1
mov r8d, 4
lea rdx, str.TRUE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140014673
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], r13
mov byte [rsp + 0x70], bl
mov r8d, 7
lea rdx, str.runasps
lea rcx, [rsp + 0x70]
call fcn.1400090e0
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Cmm::CommandLine::GetSwitchValueASCII_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
mov rdi, rax
lea rax, [rsp + 0x28]
cmp rax, rdi
je 0x14001457c
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140014553
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001454e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400145b2
call fcn.140015adc
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x28], bl
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x38], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], r13
mov byte [rdi], bl
mov rdx, qword [rsp + 0x60]
mov r14d, 0x1000
cmp rdx, 0x10
jb 0x1400145be
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, r14
jb 0x1400145b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400145b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015adc
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x48], bl
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140014607
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x140014602
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014602
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015adc
lea rcx, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0x10
cmovae rcx, rdi
cmp qword [rsp + 0x38], 4
jne 0x14001463c
mov r8d, 4
lea rdx, str.TRUE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140014673
call fcn.14000bd30
test eax, eax
je 0x140014660
call fcn.14000cc48
test eax, eax
jne 0x140014660
call fcn.14000d2dc
test eax, eax
jne 0x140014660
call fcn.14000d3f8
test eax, eax
je 0x140014669
call fcn.14000d0e4
test eax, eax
je 0x1400146db
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp rsi, 0x10
jb 0x1400146a6
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14001469e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001470b
mov rcx, rdi
call fcn.140015adc
mov eax, 1
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140015a80
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140014717
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, r14
jb 0x140014712
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014712
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015adc
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CFileName::constructor_void____ptr64]
nop
xor edx, edx
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CFileName::GetModuleFileNameW_struct_HINSTANCE______ptr64____ptr64]
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CFileName::GetName_void_const___ptr64]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [0x14002cea0]
lea rcx, [rbp - 0x20]
call qword [sym.imp.Cmmlib.dll_public:_bool___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t__const____ptr64_const___ptr64]
test al, al
je 0x1400148c2
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_void____ptr64]
nop
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0xff
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400147a6
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x70]
call qword [reloc.Cmmlib.dll___4__CStringT__W_Cmm__QEAAAEAV01_PEB_W_Z]
lea rdx, str.Global_
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
lea rdi, [0x14001a3a8]
test eax, eax
jne 0x1400147ed
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_AEBV01__Z]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, [0x14002cea0]
lea rcx, [rsp + 0x48]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_AEBV01__Z]
call fcn.14000cc48
test eax, eax
je 0x140014828
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.uploadCrashDump
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
call fcn.14000d3f8
test eax, eax
je 0x140014851
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.uploadFeedback
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
call fcn.14000f150
test al, al
je 0x14001487a
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rdx, str.ZoomMedia
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov r9, rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r15], rax
test rax, rax
je 0x1400148e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400148e3
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov ebx, 1
lea rcx, [rbp - 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CFileName::destructor_void____ptr64]
mov eax, ebx
jmp 0x1400146ab
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
jmp 0x1400148c7