Function at 0x180012390
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4d8]
sub rsp, 0x5a0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x18006f730]
xor rax, rsp
mov qword [rbp + 0x470], rax
imul eax, ecx, 0x5a0
xor r9d, r9d
mov ebx, r9d
mov qword [rbp - 0x60], r8
mov r12, r8
mov qword [rsp + 0x78], rdx
mov dword [rsp + 0x44], ecx
mov r13d, ecx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x74], eax
cmp ecx, eax
ja 0x18001251f
movzx edi, byte [rsp + 0x40]
movss xmm6, dword [0x180056100]
movss xmm7, dword [0x180055780]
mov dword [rsp + 0x50], edi
mov r10d, 0x16
movabs r8, 0x7fffffffffffffff
cmp r13d, 0xc75f
ja 0x18001258a
je 0x18001257c
cmp r13d, 0x3852
ja 0x1800124f7
je 0x18001251f
mov eax, r13d
sub eax, 0x9f
je 0x1800124ea
sub eax, 0x13
je 0x180012495
sub eax, 0x46
je 0x180012473
cmp eax, 0x3157
jne 0x180012baa
mov qword [rbp - 0x78], r9
jmp 0x180012baa
movss xmm1, dword [rdx]
movaps xmm0, xmm1
andps xmm0, xmm6
comiss xmm0, xmm7
ja 0x180012bd0
cvtps2pd xmm0, xmm1
movsd qword [r12 + 0x50], xmm0
jmp 0x180012baa
mov rbx, qword [r12]
mov rdi, qword [r12 + 8]
cmp rbx, rdi
je 0x1800124dc
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rbx]
xor r9d, r9d
lea ecx, [r9 + 0x5b]
call fcn.180015bc0
test al, al
jne 0x180012be0
mov rdx, qword [rsp + 0x78]
add rbx, 8
cmp rbx, rdi
jne 0x1800124b0
mov ecx, dword [rsp + 0x44]
xor r9d, r9d
mov edi, dword [rsp + 0x50]
mov byte [rsp + 0x4c], 0
jmp 0x180012baa
mov dil, 1
mov byte [rsp + 0x40], dil
jmp 0x180012ba6
cmp r13d, 0x4e78
je 0x180012572
cmp r13d, 0x63ff
je 0x180012561
cmp r13d, 0x95af
je 0x180012557
cmp r13d, 0x9bf8
jne 0x180012baa
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.18003c900
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x54], r9d
jmp 0x180012baa
mov dword [rsp + 0x60], 0x104
mov qword [rbp - 0x70], r9
jmp 0x180012baa
mov dword [rsp + 0x4c], r9d
jmp 0x180012baa
xor eax, eax
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], eax
jmp 0x180012baa
cmp r13d, 0x1bfcf
ja 0x180012aad
je 0x180012a8e
cmp r13d, 0xf90f
je 0x18001261a
cmp r13d, 0x12abf
je 0x1800125fb
cmp r13d, 0x15c6f
je 0x1800125ee
cmp r13d, 0x18e1f
jne 0x180012baa
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.GDI32.dll_UnrealizeObject]
movzx eax, byte [rsp + 0x40]
xor r9d, r9d
mov ecx, r9d
cmp dword [rsp + 0x58], ecx
cmove ecx, eax
mov byte [rsp + 0x40], cl
mov ecx, dword [rsp + 0x44]
jmp 0x180012baa
mov dword [rsp + 0x64], 0x104
jmp 0x180012baa
mov rcx, qword [rbp - 0x70]
lea rdx, [rsp + 0x54]
call qword [sym.imp.WINMM.dll_midiInGetID]
mov ecx, dword [rsp + 0x44]
xor r9d, r9d
mov dword [rsp + 0x58], eax
jmp 0x180012baa
cmp qword [r12 + 0x10], 0x35
mov dword [rsp + 0x68], 0xc
jb 0x180012baa
mov r15d, 0xcf
nop dword [rax]
nop dword [rax + rax]
cmp r15d, 0x1b3
ja 0x180012a26
je 0x1800128d1
mov eax, r15d
sub eax, 0xcf
je 0x1800128c8
sub eax, 0x39
je 0x1800127d2
sub eax, 0x39
je 0x1800127c8
cmp eax, 0x39
jne 0x180012a70
mov rax, qword [r12 + 0x10]
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
cmp rax, 0xb
jb 0x180012bf7
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
cmp qword [r12 + 0x18], 0x10
mov rax, r12
jb 0x1800126b6
mov rax, qword [r12]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x1800126dd
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x58], 0
jmp 0x18001276c
cmp rsi, r8
ja 0x180012bf1
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x1800126f7
mov rdi, r8
jmp 0x1800126ff
cmp rdi, 0x16
cmovb rdi, r10
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180012738
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180012bfd
mov rcx, rax
call fcn.18003c3b8
test rax, rax
je 0x180012bea
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18001274a
test rcx, rcx
je 0x180012747
call fcn.18003c3b8
mov rbx, rax
jmp 0x18001274a
mov rbx, r9
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
mov qword [rbp - 0x40], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 0x58], rbx
mov ebx, dword [rsp + 0x48]
or ebx, 2
lea rcx, [0x18005b4a8]
lea rdx, [rbp - 0x58]
mov dword [rsp + 0x48], ebx
call fcn.1800031c0
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x180012a5d
mov rcx, qword [rbp - 0x58]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800127be
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180012bea
call fcn.18003c3f4
jmp 0x180012a5d
mov dword [rsp + 0x5c], r9d
jmp 0x180012a70
mov esi, 0xb
mov qword [rbp - 0x40], 0xf
cmp qword [r12 + 0x10], rsi
mov r14, r12
mov byte [rbp - 0x58], 0
cmovb rsi, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 0x10
jb 0x1800127fd
mov r14, qword [r12]
cmp rsi, 0xf
ja 0x18001282a
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memmove
or ebx, 4
mov byte [rbp + rsi - 0x58], 0
lea rcx, [0x18005b488]
jmp 0x180012776
cmp rsi, r8
ja 0x180012bf1
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x180012844
mov rdi, r8
jmp 0x18001284c
cmp rdi, 0x16
cmovb rdi, r10
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180012885
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180012bfd
mov rcx, rax
call fcn.18003c3b8
test rax, rax
je 0x180012bea
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180012897
test rcx, rcx
je 0x180012894
call fcn.18003c3b8
mov rbx, rax
jmp 0x180012897
mov rbx, r9
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
mov qword [rbp - 0x40], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
lea rcx, [0x18005b488]
mov qword [rbp - 0x58], rbx
mov ebx, dword [rsp + 0x48]
or ebx, 4
jmp 0x180012776
mov qword [rbp - 0x68], r9
jmp 0x180012a70
mov rax, qword [r12 + 0x10]
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
cmp rax, 0x11
jb 0x180012bf7
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
cmp qword [r12 + 0x18], 0x10
mov rax, r12
jb 0x18001290b
mov rax, qword [r12]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x180012932
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x58], 0
jmp 0x1800129c1
cmp rsi, r8
ja 0x180012bf1
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x18001294c
mov rdi, r8
jmp 0x180012954
cmp rdi, 0x16
cmovb rdi, r10
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18001298d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180012bfd
mov rcx, rax
call fcn.18003c3b8
test rax, rax
je 0x180012bea
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18001299f
test rcx, rcx
je 0x18001299c
call fcn.18003c3b8
mov rbx, rax
jmp 0x18001299f
mov rbx, r9
mov r8, rsi
mov qword [rbp - 0x48], rsi
mov rdx, r14
mov qword [rbp - 0x40], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 0x58], rbx
mov ebx, dword [rsp + 0x48]
or ebx, 1
lea rdx, [rbp - 0x58]
lea rcx, [0x18005b468]
mov dword [rsp + 0x48], ebx
call fcn.1800031c0
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x180012a14
mov rcx, qword [rbp - 0x58]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012a0f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180012bea
call fcn.18003c3f4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x28], xmm0
mov dword [rbp - 8], eax
movups xmmword [rbp - 0x18], xmm0
jmp 0x180012a5d
mov eax, r15d
sub eax, 0x1ec
je 0x180012a70
sub eax, 0x39
je 0x180012a4c
sub eax, 0x39
je 0x180012a45
cmp eax, 0x39
je 0x18001251f
jmp 0x180012a70
mov byte [rsp + 0x4c], 1
jmp 0x180012a70
mov edx, dword [rsp + 0x5c]
lea r8, [rbp - 0x28]
mov rcx, qword [rbp - 0x68]
call sub.IMM32.dll_ImmGetRegisterWordStyleA
mov r10d, 0x16
xor r9d, r9d
movabs r8, 0x7fffffffffffffff
add r15d, 0x39
cmp r15d, 0x2d0
jb 0x180012640
mov edi, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x44]
jmp 0x180012baa
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, dword [rsp + 0x44]
xor r9d, r9d
mov dword [rsp + 0x70], eax
jmp 0x180012baa
cmp r13d, 0x1f17f
je 0x180012b1b
cmp r13d, 0x2232f
je 0x180012ad1
cmp r13d, 0x254df
je 0x18001251f
jmp 0x180012baa
test dil, dil
je 0x180012b11
lea rax, [rbp - 0x80]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x38]
lea rax, [rbp + 0x260]
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ecx, dword [rsp + 0x44]
xor r9d, r9d
mov byte [rsp + 0x4c], 0
jmp 0x180012baa
cmp byte [rsp + 0x40], 0
je 0x180012b99
mov r12d, dword [rsp + 0x6c]
mov ebx, 0xea
nop dword [rax]
mov eax, ebx
sub eax, 0xea
je 0x180012b62
sub eax, 0x5e
je 0x180012b5a
cmp eax, 0x5e
jne 0x180012b7e
mov ecx, dword [rsp + 0x54]
lea rdx, [rbp]
mov r8d, r12d
call qword [sym.imp.WINMM.dll_midiInGetDevCapsW]
mov dword [rsp + 0x58], eax
jmp 0x180012b7e
mov r12d, 0x4c
jmp 0x180012b7e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
mov qword [rbp + 0x40], rax
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x48], eax
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
add ebx, 0x5e
cmp ebx, 0x204
jb 0x180012b30
mov ecx, dword [rsp + 0x44]
xor r9d, r9d
mov dword [rsp + 0x6c], r12d
mov r12, qword [rbp - 0x60]
cmp dword [rsp + 0x70], 0
movzx edi, dil
cmove edi, r9d
mov dword [rsp + 0x50], edi
lea eax, [rcx + rcx*4]
shl eax, 4
add r13d, eax
cmp r13d, dword [rsp + 0x74]
ja 0x18001251f
mov ebx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
jmp 0x180012411
mov eax, 0xffffffff
jmp 0x180012523
mov byte [rsp + 0x4c], 1
jmp 0x18001251f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180021440
int3
call fcn.180021480
int3
call fcn.180021300
int3