Function at 0x14001d4d0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x14012d228]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov rsi, rcx
mov qword [rbp - 0x68], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
lea r14, [0x14012d0c8]
cmp qword [0x14012d0d8], r12
jne 0x14001d8ed
xor edx, edx
mov r8d, 0x224
lea rcx, [rbp - 0x40]
call fcn.1400bb2f0
mov dword [rbp - 0x78], 0x112
movups xmm0, xmmword [str.bd::OBK::]
movups xmmword [rbp - 0x60], xmm0
mov eax, dword [0x1400f4bb8]
mov dword [rbp - 0x50], eax
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp + 0x1f0]
call fcn.1400bb2f0
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x40]
lea ecx, [r12 + 2]
call sub.Secur32.dll_GetUserNameExW
mov ecx, dword [0x140132b68]
test al, al
mov eax, dword [0x140132b64]
je 0x14001d841
lea r15, str.desktops::GetOBKDesktopName
add ecx, eax
je 0x14001d5f7
mov dword [rsp + 0x70], r12d
call fcn.14000c6e0
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov edi, 1
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x68]
call fcn.14000c110
mov dword [rbp - 0x74], 0x20
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, str.GetUserNameExW_ok_error_szUserName_1__s
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
lea r9, [0x140000000]
lea r8, [rbp - 0x74]
movsx edx, r12w
mov rcx, rax
call fcn.14000ef60
jmp 0x14001d5fb
mov edi, dword [rsp + 0x40]
mov rbx, 0xffffffffffffffff
test dil, 1
je 0x14001d638
and edi, 0xfffffffe
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x68], r12
mov eax, ebx
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
js 0x14001d633
call fcn.14000efb0
mov eax, ebx
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
jns 0x14001d621
lock inc dword [rsp + 0x70]
mov rcx, r12
lea rdx, [rbp - 0x40]
mov rax, rbx
inc rax
cmp word [rdx + rax*2], cx
jne 0x14001d642
test rax, rax
je 0x14001d67f
mov r8d, 0x2e
cmp word [rbp + rcx*2 - 0x40], 0x5c
jne 0x14001d664
mov word [rbp + rcx*2 - 0x40], r8w
inc rcx
lea rdx, [rbp - 0x40]
mov rax, rbx
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14001d670
cmp rcx, rax
jb 0x14001d656
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14001d6fc
mov dword [rsp + 0x50], r12d
call fcn.14000c6e0
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
or dword [rsp + 0x40], 2
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x14001d6c1
call fcn.14000c6e0
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov dword [rbp - 0x70], 0x20
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, str.GetUserNameExW_ok_error_szUserName_2__s
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [0x140000000]
lea r8, [rbp - 0x70]
movsx edx, r12w
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x40]
test al, 2
je 0x14001d737
and eax, 0xfffffffd
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], r12
mov eax, ebx
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
js 0x14001d732
nop dword [rax]
call fcn.14000efb0
mov eax, ebx
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jns 0x14001d720
lock inc dword [rsp + 0x50]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
lea r8, [0x1400f4ca8]
mov edx, 0x11c
lea rcx, [rbp + 0x1f0]
call fcn.1400148c0
mov ecx, dword [0x140132b68]
mov eax, dword [0x140132b64]
add ecx, eax
je 0x14001d7dc
mov dword [rsp + 0x60], r12d
call fcn.14000c6e0
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
or dword [rsp + 0x40], 4
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x14001d79e
call fcn.14000c6e0
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov dword [rbp - 0x6c], 0x20
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x30], rax
lea rax, str.szDesktopName_s
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [0x140000000]
lea r8, [rbp - 0x6c]
movsx edx, r12w
call fcn.14000ef60
nop
mov eax, dword [rsp + 0x40]
test al, 4
je 0x14001d817
and eax, 0xfffffffb
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x58], r12
mov eax, ebx
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
js 0x14001d812
nop dword [rax]
call fcn.14000efb0
mov eax, ebx
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
jns 0x14001d800
lock inc dword [rsp + 0x60]
lea rax, [rbp + 0x1f0]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14001d820
mov r8, rbx
lea rdx, [rbp + 0x1f0]
mov rcx, r14
call fcn.140004260
jmp 0x14001d8ed
add ecx, eax
je 0x14001d8af
mov dword [rbp - 0x80], r12d
call fcn.14000c6e0
mov qword [rsp + 0x78], rax
lock inc dword [rbp - 0x80]
mov edi, 8
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x78]
call fcn.14000c110
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x68], 0x20
mov dword [rsp + 0x30], eax
lea rax, str.GetUserNameExW_failed_error__ld
mov qword [rsp + 0x28], rax
lea r15, str.desktops::GetOBKDesktopName
mov qword [rsp + 0x20], r15
lea r9, [0x140000000]
lea r8, [rbp - 0x68]
movsx edx, r12w
mov rcx, rbx
call fcn.14000ef60
jmp 0x14001d8b3
mov edi, dword [rsp + 0x40]
test dil, 8
je 0x14001d8ed
and edi, 0xfffffff7
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x78], r12
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rbp - 0x80], eax
cmp eax, 1
js 0x14001d8e9
call fcn.14000efb0
mov eax, ebx
lock xadd dword [rbp - 0x80], eax
cmp eax, 1
jns 0x14001d8d8
lock inc dword [rbp - 0x80]
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov rdi, qword [0x14012d0d8]
cmp qword [0x14012d0e0], 8
cmovae r14, qword [0x14012d0c8]
cmp rdi, 8
jae 0x14001d923
movups xmm0, xmmword [r14]
movups xmmword [rsi], xmm0
mov ebx, 7
jmp 0x14001d96f
mov rbx, rdi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001d9a5
lfence
add rcx, rcx
call fcn.140004450
mov qword [rsi], rax
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.1400bac40
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rbx
mov rax, rsi
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.14005aef0
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140001ea0
int3