Function at 0x140087c68
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor r13d, r13d
mov rbx, rcx
cmp qword [0x14009a790], r13
jne 0x140087cb8
mov eax, 0x80004005
jmp 0x140087ed3
mov r15, r13
mov r12b, r13b
mov edi, 1
test rcx, rcx
je 0x140087d42
mov rax, qword gs:[0x30]
cmp dword [rax + 0x179c], r13d
jne 0x140087cf8
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x140087cf8
mov r15, rbx
mov r12b, dil
mov rcx, rbx
call fcn.140087aa8
test al, al
je 0x140087d42
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x140087ec3
mov esi, 2
test byte [rcx + 0x1c], sil
je 0x140087ec3
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 8]
lea r8, [0x14000cff8]
call fcn.14000e618
jmp 0x140087ec3
mov esi, 0x2b0
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, esi
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], esi
mov esi, 2
movups xmm0, xmmword [0x14000cfe8]
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x28]
mov ecx, esi
movdqu xmmword [rsp + 0x34], xmm0
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.Secur32.dll_GetUserNameExW]
lea r14, str.___t_
test al, al
jne 0x140087dcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
test eax, eax
cmovle r9d, eax
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x140087dcc
test byte [rcx + 0x1c], dil
je 0x140087dcc
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 9]
lea r8, [0x14000cff8]
call fcn.14000e63c
lea rdx, [rbp + 0x1e0]
mov rcx, rbx
call fcn.14008795c
mov ebx, eax
test eax, eax
js 0x140087e3f
lea r9, [rsp + 0x5a]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.ntdll.dll_RtlIpv6StringToAddressExW]
or eax, 0x10000000
jl 0x140087e10
mov eax, 0x17
mov word [rsp + 0x58], ax
jmp 0x140087e38
lea r9, [rsp + 0x5a]
lea r8, [rsp + 0x5c]
lea rcx, [rbp + 0x1e0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlIpv4StringToAddressExW]
mov ebx, eax
or ebx, 0x10000000
jl 0x140087e3b
mov word [rsp + 0x58], si
mov ebx, r13d
test ebx, ebx
jns 0x140087e7a
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x140087e69
test byte [rcx + 0x1c], sil
je 0x140087e69
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000cff8]
mov edx, 0xc
mov r9d, ebx
call fcn.14000e63c
mov word [rsp + 0x58], si
mov dword [rsp + 0x5c], r13d
cmp word [rbp - 0x28], r13w
je 0x140087ec1
mov rbx, qword [0x14009a790]
mov rcx, rbx
call qword [fcn.14002c9e0]
lea rcx, [rsp + 0x30]
call rbx
mov ebx, eax
test eax, eax
jns 0x140087ec1
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x140087ec1
test byte [rcx + 0x1c], dil
je 0x140087ec1
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000cff8]
mov edx, 0xd
mov r9d, eax
call fcn.14000e63c
mov edi, ebx
test r12b, r12b
je 0x140087ed1
mov rcx, r15
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
mov eax, edi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140088640
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret