Function at 0x18004b980
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6b0
lea ebp, [r8 - 0xd]
mov r14, r9
mov r15, rcx
cmp r8d, ebp
jbe case.0x18004b9fd.9
mov rdi, qword [rsp + 0x58]
lea esi, [r8 - 0x90]
mov r13d, dword [rsp + 0x700]
lea r8, [0x180000000]
movzx r12d, byte [rsp + 0x700]
lea r9, [0x180018bb0]
nop word [rax + rax]
cmp esi, 0x34
ja case.0x18004b9fd.12
movzx eax, byte [r8 + rsi + 0x4bce4]
mov ecx, dword [r8 + rax*4 + 0x4bcb0]
add rcx, r8
jmp rcx
mov dword [rsp + 0x4c], 0xc
jmp case.0x18004b9fd.12
mov dword [rsp + 0x48], 0x104
jmp case.0x18004b9fd.12
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x6c]
call fcn.18004f630
mov rdi, rax
xor ebx, ebx
nop dword [rax + rax]
lea r9, [rsp + 0x700]
mov dword [rsp + 0x700], ebx
mov r8d, 0x8d
mov rdx, rdi
xor ecx, ecx
call fcn.1800314f0
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov qword [rsp + 0x20], rax
lea ecx, [rax + 0x2e]
call fcn.180061b10
inc ebx
cmp ebx, 0x14
jb 0x18004ba30
lea r9, [0x180018bb0]
mov rdx, qword [rsp + 0x6f8]
lea r8, [0x180000000]
dec esi
lea eax, [rsi + 0x90]
cmp eax, ebp
ja 0x18004b9e0
jmp case.0x18004b9fd.9
lea rcx, [r15 + 0xa]
cmp rcx, r14
je case.0x18004b9fd.12
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x18004babb
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
call fcn.18001f830
jmp 0x18004ba7a
lea rdx, [rsp + 0x50]
mov qword [r15], r9
lea rcx, [rsp + 0x80]
mov r13d, 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x18004baeb
xor r12b, r12b
jmp 0x18004ba7a
test r12b, r12b
je 0x18004ba7a
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x70]
lea rax, [rsp + 0x290]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
jmp 0x18004ba7a
movzx eax, word [rdx]
mov r9d, 0xcc
mov word [rsp + 0x700], ax
xor r8d, r8d
lea rax, [rsp + 0x700]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rax
mov r12b, 1
mov dword [rsp + 0x50], 0x104
mov qword [rsp + 0x58], 0
call fcn.18000a310
xor eax, eax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], eax
jmp 0x18004ba7a
movzx eax, byte [r15 + 6]
movzx ecx, byte [r15 + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15]
shl rcx, 8
or rcx, rax
mov qword [rsp + 0x40], rcx
jmp case.0x18004b9fd.12
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x4a0]
mov r8d, r13d
call sub.IMM32.dll_ImmGetDescriptionW
jmp 0x18004ba7a
mov rdx, rdi
mov ecx, 0x114
call fcn.18001e480
jmp 0x18004ba7a
mov r8, r14
mov rax, r15
sub r8, r15
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18004bc43
inc rax
test ecx, ecx
jne 0x18004bc30
xor eax, eax
test edx, edx
sete al
mov dword [rsp + 0x40], eax
jmp 0x18004ba81
mov ebx, dword [r14]
lea eax, [rbx + 1]
cmp eax, 4
ja 0x18004bc6c
mov dword [r15 + 0x18], ebx
mov dword [rsp + 0x40], 0
jmp case.0x18004b9fd.9
mov ecx, 2
call fcn.180070398
mov rcx, rax
lea rdx, str.Remove_Snapshot:
mov r8d, ebx
call fcn.180069b10
mov dword [rsp + 0x40], 0xffffffff
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x6f0]
add rsp, 0x6b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret