Function at 0x140029b60
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401385c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x20], 2
test rdx, rdx
jne 0x140029bab
lea eax, [rdx + 2]
jmp 0x140029eda
call fcn.1400278f0
nop
mov rsi, qword [r15 + 8]
test rsi, rsi
je 0x140029bbf
xor r14d, r14d
jmp 0x140029bf9
mov ecx, 0x18
call fcn.14005f120
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140029bf3
mov r9d, 0x14
xor r8d, r8d
lea rdx, [0x140105e08]
mov rcx, rax
call fcn.140027300
mov rsi, rax
xor r14d, r14d
jmp 0x140029bf9
xor r14d, r14d
mov esi, r14d
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rdi + 0x168]
call fcn.140060ef0
mov dword [rdi + 0x20], 1
mov dword [rdi + 0x168], r14d
mov dword [rdi + 0x16c], 0xff231ac2
mov dword [rdi + 0x170], 0x60000
xor ecx, ecx
call fcn.14006a8e0
mov dword [rdi + 0x20c], eax
mov eax, dword [r15 + 0x10]
mov dword [rdi + 0x184], eax
mov ecx, dword [r15 + 0x10]
call fcn.140029490
mov dword [rdi + 0x188], eax
mov dword [rdi + 0x21c], r14d
mov dword [rdi + 0x220], r14d
mov dword [rdi + 0x244], 2
mov dword [rsp + 0x24], r14d
lea rdx, str._default_
lea rcx, [rdi + 0x18c]
mov r8, rdi
sub r8, rdx
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx + 0x18c], al
lea rdx, [rdx + 1]
test al, al
jne 0x140029c90
mov dword [rsp + 0x24], 0x80
lea rdx, [rsp + 0x24]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DISPLAY
call qword [sym.imp.GDI32.dll_CreateDCA]
mov rbx, rax
mov rcx, rax
cmp dword [r15 + 0x1c], 0
je 0x140029d1e
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140049530
mov ecx, dword [rsp + 0x28]
mov dword [rdi + 0x214], ecx
mov ecx, dword [rsp + 0x2c]
mov dword [rdi + 0x218], ecx
mov ecx, 0x50
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rdi + 0x240], eax
test eax, eax
jne 0x140029d4d
jmp 0x140029d43
mov edx, 0x76
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rdi + 0x214], eax
mov edx, 0x75
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rdi + 0x218], eax
mov dword [rdi + 0x240], 1
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [r15]
mov ecx, edx
sub ecx, 0x70
je 0x140029d76
cmp ecx, 1
je 0x140029d6d
mov dword [rdi + 0x248], edx
jmp 0x140029daf
mov dword [rdi + 0x248], r14d
jmp 0x140029daf
xor edx, edx
mov rcx, rsi
call fcn.1400294f0
test rax, rax
jne 0x140029da4
mov rcx, rsi
call fcn.140029510
test rax, rax
je 0x140029d9f
mov rcx, rsi
call fcn.140029510
cmp byte [rax], 0
je 0x140029da4
mov eax, r14d
jmp 0x140029da9
call fcn.1400282f0
mov dword [rdi + 0x248], eax
xor edx, edx
mov rcx, rsi
call fcn.1400294f0
test rax, rax
jne 0x140029de6
mov rcx, rsi
call fcn.140029510
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.1400281c0
mov r8d, 0x14
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.14002b490
mov ecx, dword [rdi + 0x248]
test ecx, ecx
jne 0x140029dfd
mov rdx, rsi
mov rcx, rdi
call fcn.14002a1f0
jmp 0x140029e41
mov ebx, 9
mov dword [rsp + 0x20], ebx
call fcn.140028160
mov qword [rdi + 0x368], rax
test rax, rax
je 0x140029e5e
mov rcx, rsi
call fcn.140023b40
mov rbx, rax
xor edx, edx
mov rcx, rsi
call fcn.1400294f0
mov rdx, rax
xor r9d, r9d
mov r8d, ebx
mov rcx, qword [rdi + 0x368]
call fcn.140042b30
mov r8d, dword [rdi + 0x248]
lea rdx, [rdi + 0x224]
mov rcx, rsi
call fcn.140028340
mov ebx, r14d
mov dword [rsp + 0x20], ebx
mov dword [rdi + 0x338], r14d
mov qword [rdi + 0x340], r14
mov qword [rdi + 0x348], r14
mov dword [rdi + 0x354], r14d
mov dword [rdi + 0x350], r14d
test ebx, ebx
jne 0x140029ea4
mov rcx, rdi
call fcn.140027820
mov rcx, rdi
call fcn.14002bb40
mov ebx, 2
test eax, eax
cmovne ebx, r14d
mov dword [rsp + 0x20], ebx
test rsi, rsi
je 0x140029ec5
cmp rsi, qword [r15 + 8]
je 0x140029ec5
mov rcx, rsi
call fcn.140027500
mov edx, 0x18
mov rcx, rsi
call fcn.14005f164
nop
jmp 0x140029ed0
mov rcx, rdi
call fcn.14002b470
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005f0d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret