Function at 0x140087880
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1400a3ac8]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor r12d, r12d
mov rbx, rcx
cmp qword [0x1400a7bd8], r12
jne 0x1400878cb
mov eax, 0x80004005
jmp 0x140087b1e
mov r14, r12
mov r15b, r12b
test rbx, rbx
je 0x140087969
mov rax, qword gs:[0x30]
cmp dword [rax + 0x179c], r12d
jne 0x14008790e
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
nop dword [rax + rax]
test eax, eax
jle 0x140087906
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x14008790e
mov r14, rbx
mov r15b, 1
mov rcx, rbx
call fcn.140087684
test al, al
je 0x140087969
mov rcx, qword [str._0_n_]
lea rsi, str._0_n_
cmp rcx, rsi
je 0x14008794b
mov edi, 2
test byte [rcx + 0x1c], dil
je 0x14008794b
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 8]
lea r8, [0x1400993e8]
call fcn.14000459c
test r15b, r15b
je 0x14008795f
mov rcx, r14
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
nop dword [rax + rax]
mov eax, 1
jmp 0x140087b1e
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x29c
call sub.msvcrt.dll_memset
movups xmm0, xmmword [0x1400993d8]
mov edi, 2
mov dword [rsp + 0x30], 0x2b0
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x104
lea rdx, [rbp - 0x28]
mov ecx, edi
movdqu xmmword [rsp + 0x34], xmm0
call qword [sym.imp.Secur32.dll_GetUserNameExW]
nop dword [rax + rax]
lea rsi, str._0_n_
test al, al
jne 0x140087a01
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1400879d7
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x140087a01
test byte [rcx + 0x1c], 1
je 0x140087a01
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400993e8]
mov edx, 0xb
mov r9d, eax
call fcn.140004900
lea rdx, [rbp + 0x1e0]
mov rcx, rbx
call fcn.1400874c0
mov ebx, eax
test eax, eax
js 0x140087a81
lea r9, [rsp + 0x5a]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.ntdll.dll_RtlIpv6StringToAddressExW]
nop dword [rax + rax]
mov ebx, 0x10000000
or eax, ebx
jl 0x140087a4d
mov ecx, 0x17
mov word [rsp + 0x58], cx
jmp 0x140087a75
lea r9, [rsp + 0x5a]
xor edx, edx
lea r8, [rsp + 0x5c]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.ntdll.dll_RtlIpv4StringToAddressExW]
nop dword [rax + rax]
or eax, ebx
jl 0x140087a75
mov word [rsp + 0x58], di
test eax, eax
mov ebx, r12d
cmovs ebx, eax
test ebx, ebx
jns 0x140087abc
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x140087aab
test byte [rcx + 0x1c], dil
je 0x140087aab
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400993e8]
mov edx, 0xc
mov r9d, ebx
call fcn.140004900
mov word [rsp + 0x58], di
mov dword [rsp + 0x5c], r12d
cmp word [rbp - 0x28], r12w
je 0x140087b08
movabs r10, 0xfd29b6ad3e53e170
mov rax, qword [0x1400a7bd8]
lea rcx, [rsp + 0x30]
call qword [0x1400913f0]
mov ebx, eax
test eax, eax
jns 0x140087b08
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x140087b08
test byte [rcx + 0x1c], 1
je 0x140087b08
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400993e8]
mov edx, 0xd
mov r9d, eax
call fcn.140004900
test r15b, r15b
je 0x140087b1c
mov rcx, r14
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140001b10
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret