Function at 0x14012fec0
Capabilities:
Get session user name

Disassembly:
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0xf8
mov dword [rsp + 0x3c], 0x5718ce90
mov byte [rsp + 0x30], 0x19
mov rax, qword [0x14017c008]
mov qword [rsp + 0x90], rax
movabs rax, 0x69604a3ae51be02d
cmp qword [rsp + 0x90], rax
je 0x14012ff03
jmp 0x14012ff44
movzx edx, word [rsp + 0x100]
movzx ecx, word [rsp + 0x100]
call fcn.14012fec0
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x48], eax
movzx r8d, byte [rsp + 0x30]
mov dl, 0x18
movzx ecx, word [rsp + 0x100]
call fcn.14012f840
nop
jmp 0x14012ff98
movzx eax, word [rsp + 0x100]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14012ff63
cmp dword [rsp + 0x44], 0x24a
je 0x14012ff88
jmp 0x14012ff98
mov eax, dword [rsp + 0x3c]
sub eax, 0xc278d59e
mov dword [rsp + 0x3c], eax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], 0x50
mov dword [rsp + 0x34], 0x7b2438e3
jmp 0x14012ff98
movzx eax, word [rsp + 0x100]
mov word [rsp + 0x108], ax
mov rax, qword [0x14017c008]
mov qword [rsp + 0x60], rax
movabs rax, 0x84cee7d515b6eb8b
cmp qword [rsp + 0x60], rax
je 0x14012ffcf
movabs rax, 0xe99845e71f30b28e
cmp qword [rsp + 0x60], rax
je 0x14013004a
jmp 0x140130092
movsx eax, byte [rsp + 0x30]
add eax, 0x40
movsx ecx, byte [rsp + 0x31]
cmp eax, ecx
jge 0x140130048
mov rax, qword [0x14017c008]
mov qword [rsp + 0x68], rax
movabs rax, 0xc77757a4debc3667
cmp qword [rsp + 0x68], rax
je 0x14013002e
movabs rax, 0xf01c5b4b48339280
cmp qword [rsp + 0x68], rax
je 0x140130010
jmp 0x140130048
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rsp + 0x54], eax
mov ecx, dword [rsp + 0x34]
call fcn.14012efc0
nop
jmp 0x140130048
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [rsp + 0x80], eax
jmp 0x140130092
movzx eax, word [rsp + 0x100]
mov word [rsp + 0x108], ax
mov eax, dword [rsp + 0x3c]
and eax, 0x2f3e54b8
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x87
lea r8, str.lintels_Beloved_Eavesdropped
mov edx, 0xc3
mov ecx, 0xb5
call qword [sym.imp.KERNEL32.dll_GetStringTypeExA]
mov dword [rsp + 0x54], eax
movzx eax, word [rsp + 0x100]
mov word [rsp + 0x40], ax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x58], al
cmp byte [rsp + 0x58], 0xc
je 0x1401300b1
jmp 0x140130111
movzx eax, word [rsp + 0x40]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0x667
je 0x1401300c8
jmp 0x1401300d7
mov edx, dword [rsp + 0x3c]
mov ecx, reloc.COMCTL32.dll_DrawInsert
call fcn.140130970
nop
lea rdx, [rsp + 0x70]
lea rcx, str.ConvectFerryingCrosschecks_banishes
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x34]
or eax, 0x7589017d
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
mov dword [rsp + 0x48], eax
jmp 0x140130274
movzx eax, byte [rsp + 0x32]
mov byte [rsp + 0x4c], al
cmp byte [rsp + 0x4c], 0x50
je 0x140130131
cmp byte [rsp + 0x4c], 0xf5
je 0x14013021a
jmp 0x140130268
mov eax, 0x5fda
mov word [rsp + 0x38], ax
lea rax, [rsp + 0x32]
mov qword [rsp + 0x98], rax
movsx eax, byte [rsp + 0x31]
cdq
mov ecx, 0x67
idiv ecx
movsx ecx, byte [rsp + 0x30]
cmp eax, ecx
jl 0x14013018e
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x98]
movzx r9d, byte [rax]
movzx r8d, word [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
movzx ecx, word [rsp + 0x38]
call fcn.1401308e0
nop
jmp 0x140130218
lea rax, [rsp + 0x40]
mov qword [rsp + 0xb0], rax
mov rax, qword [0x14017c008]
mov qword [rsp + 0x78], rax
movabs rax, 0x710990f3fb52771
cmp qword [rsp + 0x78], rax
je 0x1401301fb
movabs rax, 0x84cee7d515b6eb8b
cmp qword [rsp + 0x78], rax
je 0x1401301cb
jmp 0x140130218
movabs rax, 0x15655b77231f059c
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0xc0], rax
mov rax, qword [0x14017c008]
mov qword [rsp + 0xc8], rax
jmp 0x140130218
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelA]
mov dword [rsp + 0x88], eax
jmp 0x140130268
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x27353c70
je 0x140130238
cmp dword [rsp + 0x50], 0x482f1b29
je 0x140130251
jmp 0x140130268
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_ExitThread]
mov edx, 0x6f
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [rsp + 0x54], eax
movsx eax, byte [rsp + 0x30]
shl eax, 4
mov byte [rsp + 0x31], al
movsx eax, byte [rsp + 0x31]
xor eax, 0xe
mov byte [rsp + 0x30], al
mov eax, 0xa0
add rsp, 0xf8
ret