Function at 0x14007e264
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
mov rax, qword [0x14009b940]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor r13d, r13d
mov rbx, rcx
cmp qword [0x14009f758], r13
jne 0x14007e2b4
mov eax, 0x80004005
jmp 0x14007e4f5
mov r15, r13
mov r12b, r13b
mov edi, 1
test rbx, rbx
je 0x14007e348
mov rax, qword gs:[0x30]
cmp dword [rax + 0x179c], r13d
jne 0x14007e2fe
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14007e2fe
mov r15, rbx
mov r12b, dil
mov rcx, rbx
call fcn.14007e074
test al, al
je 0x14007e348
mov rcx, qword [0x14009b028]
lea r14, [0x14009b028]
cmp rcx, r14
je 0x14007e4df
mov esi, 2
test byte [rcx + 0x1c], sil
je 0x14007e4df
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 8]
lea r8, [0x14008e898]
call fcn.140001024
jmp 0x14007e4df
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x29c
call sub.msvcrt.dll_memset
movups xmm0, xmmword [0x14008e888]
mov esi, 2
mov dword [rsp + 0x30], 0x2b0
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x104
lea rdx, [rbp - 0x28]
mov ecx, esi
movdqu xmmword [rsp + 0x34], xmm0
call qword [sym.imp.Secur32.dll_GetUserNameExW]
nop dword [rax + rax]
lea r14, [0x14009b028]
test al, al
jne 0x14007e3e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx r9d, ax
or r9d, 0x80070000
test eax, eax
cmovle r9d, eax
mov rcx, qword [0x14009b028]
cmp rcx, r14
je 0x14007e3e0
test byte [rcx + 0x1c], dil
je 0x14007e3e0
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 9]
lea r8, [0x14008e898]
call fcn.140001050
lea rdx, [rbp + 0x1e0]
mov rcx, rbx
call fcn.14007df04
mov ebx, eax
test eax, eax
js 0x14007e460
lea r9, [rsp + 0x5a]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.ntdll.dll_RtlIpv6StringToAddressExW]
nop dword [rax + rax]
mov ebx, 0x10000000
or eax, ebx
jl 0x14007e42c
mov ecx, 0x17
mov word [rsp + 0x58], cx
jmp 0x14007e454
lea r9, [rsp + 0x5a]
xor edx, edx
lea r8, [rsp + 0x5c]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.ntdll.dll_RtlIpv4StringToAddressExW]
nop dword [rax + rax]
or eax, ebx
jl 0x14007e454
mov word [rsp + 0x58], si
test eax, eax
mov ebx, r13d
cmovs ebx, eax
test ebx, ebx
jns 0x14007e49b
mov rcx, qword [0x14009b028]
cmp rcx, r14
je 0x14007e48a
test byte [rcx + 0x1c], sil
je 0x14007e48a
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008e898]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov r9d, ebx
call fcn.140001050
mov word [rsp + 0x58], si
mov dword [rsp + 0x5c], r13d
cmp word [rbp - 0x28], r13w
je 0x14007e4dd
mov rax, qword [0x14009f758]
lea rcx, [rsp + 0x30]
call qword [0x1400878a0]
mov ebx, eax
test eax, eax
jns 0x14007e4dd
mov rcx, qword [0x14009b028]
cmp rcx, r14
je 0x14007e4dd
test byte [rcx + 0x1c], dil
je 0x14007e4dd
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008e898]
mov edx, 0xd
mov r9d, eax
call fcn.140001050
mov edi, ebx
test r12b, r12b
je 0x14007e4f3
mov rcx, r15
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.14007ec30
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret