Function at 0x1000818fc
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x6a0
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x690], rax
xor ebp, ebp
mov rbx, rcx
xor esi, esi
and qword [rsp + 0x40], rsi
and qword [r9], rsi
lea r8, [rsp + 0x50]
lea ecx, [rbp + 2]
lea rdx, [rsp + 0x60]
mov r12, r9
mov qword [rsp + 0x48], rbp
xor edi, edi
mov dword [rsp + 0x50], reloc.certcli.dll_Ordinal_260
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x100081993
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
lea rcx, [0x10001e8d0]
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ebx, eax
call fcn.1000ba5ac
mov edx, 0x515013a
xor r9d, r9d
xor ecx, ecx
mov r8d, ebx
call fcn.1000b51b8
jmp 0x100081c16
lea rcx, [rsp + 0x60]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcschr]
mov edx, 2
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x480]
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 1]
mov dword [rsp + 0x50], reloc.certcli.dll_Ordinal_260
mov qword [rsp + 0x20], rax
call sub.Secur32.dll_TranslateNameW
test al, al
jne 0x100081a05
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
lea rcx, [0x10001e8f0]
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ebx, eax
call fcn.1000ba5ac
xor r9d, r9d
mov edx, 0x52e013a
lea rcx, [rsp + 0x60]
jmp 0x100081986
mov edx, 0x185
xor ecx, ecx
call qword [sym.imp.WLDAP32.dll_Ordinal_145]
mov rdi, rax
test rax, rax
jne 0x100081a46
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
lea rcx, [0x10001e7b0]
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ebx, eax
call fcn.1000ba5ac
mov edx, 0x53f013a
jmp 0x100081981
mov r9d, 0x486
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WLDAP32.dll_Ordinal_73]
test eax, eax
je 0x100081a98
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov edx, eax
call fcn.1000d5dd0
lea rcx, [0x10001e7c8]
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ebx, eax
call fcn.1000ba5ac
mov edx, 0x547013a
jmp 0x100081b23
lea r9, [0x10001e8a0]
lea r8, [0x10001e910]
lea rcx, [rsp + 0x270]
mov edx, 0x208
call fcn.10003e304
lea r11, [rsp + 0x40]
lea r9, [rsp + 0x270]
mov qword [rsp + 0x30], r11
and dword [rsp + 0x28], esi
lea rdx, [rsp + 0x480]
mov r8d, 2
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WLDAP32.dll_Ordinal_208_1]
test eax, eax
je 0x100081b3a
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov edx, eax
call fcn.1000d5dd0
lea rcx, [0x10001e7f8]
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ebx, eax
call fcn.1000ba5ac
mov edx, 0x566013a
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov rbp, qword [rsp + 0x48]
jmp 0x100081bf9
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_36]
test eax, eax
jne 0x100081b7c
mov ecx, 0x888
call fcn.1000ba420
mov rdx, qword [rbx]
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ebx, 0x80092004
mov edx, 0x56e013a
jmp 0x100081981
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
test rax, rax
jne 0x100081bbb
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
lea rcx, [0x10001e920]
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ebx, eax
call fcn.1000ba5ac
mov edx, 0x578013a
jmp 0x100081981
mov r8, qword [rbx]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_140]
mov rsi, rax
test rax, rax
jne 0x100081bd6
xor ebx, ebx
jmp 0x100081c16
mov rdx, r12
mov rcx, rax
call fcn.100081804
mov ebx, eax
test eax, eax
je 0x100081c16
xor r9d, r9d
mov r8d, eax
mov edx, 0x58d013a
xor ecx, ecx
call fcn.1000b51b8
test rbp, rbp
je 0x100081c16
lea rcx, [0x1000048e8]
mov rdx, rbp
call fcn.1000b99b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x100081c26
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
test rsi, rsi
je 0x100081c34
mov rcx, rsi
call qword [sym.imp.WLDAP32.dll_Ordinal_224]
test rdi, rdi
je 0x100081c42
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_13]
mov eax, ebx
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.1000ef870
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret