Function at 0x100012560
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
push rdi
push r13
push r14
sub rsp, 0x30
mov rsi, rcx
xor ecx, ecx
mov r14, r9
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x1000127fa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1000127fa
mov edi, 1
cmp dword [rsp + 0x78], edi
jne 0x1000125e2
test rbp, rbp
je 0x1000125c3
cmp dword [rsp + 0x60], 2
jb 0x1000125c3
test r14, r14
jne 0x1000125e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000125d6
lea ecx, [rax + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.10000e274
xor eax, eax
jmp 0x1000127ff
mov rcx, rsi
mov rbx, rsi
call fcn.1000114a8
cmp eax, edi
jne 0x1000125f5
lea rbx, [rsi + 4]
cmp dword [rsp + 0x78], edi
jne 0x10001262b
test r14, r14
je 0x10001262b
lea rdx, [0x1000015ac]
xor r9d, r9d
mov r8d, edi
mov rcx, r14
call fcn.10000fa28
test eax, eax
jne 0x10001262b
mov rcx, rbx
call fcn.1000116e8
test eax, eax
jne 0x10001272e
jmp 0x1000125d6
mov rcx, rbx
xor r13d, r13d
call fcn.1000116e8
test eax, eax
je 0x1000125d6
test rbp, rbp
je 0x100012677
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100012677
xor r8d, r8d
lea r9, [0x100001c98]
mov rdx, rbp
cmp dword [rsp + 0x78], r8d
mov rcx, rsi
cmove r8, r14
call fcn.100011ef4
mov ebx, eax
cmp dword [rsp + 0x78], edi
jne 0x100012690
mov r13d, edi
jmp 0x100012690
lea r9, [0x100001c98]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov r13d, edi
call fcn.100011ef4
mov ebx, eax
cmp ebx, 0x55
jne 0x1000126a7
mov ecx, 0x50010001
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x1000127ff
test ebx, ebx
jne 0x1000126b4
cmp r13d, edi
je 0x100012695
xor ecx, ecx
jmp 0x10001269a
cmp ebx, 0x34
je 0x1000127dd
cmp ebx, 0x56
je 0x100012723
cmp ebx, 0x4be
je 0x1000127dd
cmp ebx, 0x4c3
je 0x100012719
cmp ebx, 0x4ce
jbe 0x1000125d6
cmp ebx, 0x4d1
jbe 0x1000127dd
cmp ebx, 0x52e
je 0x100012723
mov esi, 0xa0010001
cmp ebx, esi
jne 0x1000125d6
mov ecx, 0x157e
call fcn.10000e684
mov rcx, rax
call fcn.10000e0a0
mov ecx, esi
jmp 0x10001269a
mov ecx, 0x4c3
jmp 0x10001269a
cmp dword [rsp + 0x78], 0
je 0x1000125db
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x100012753
lea r8, [rsp + 0x60]
lea ecx, [rax + 2]
mov rdx, rbp
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x1000125d6
mov ecx, 0x157d
call fcn.10000e684
mov rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov r9, rbx
lea rcx, [rax + 0x30]
mov r8d, edi
mov edx, edi
mov qword [rsp + 0x20], rbp
call fcn.10000fdf8
mov edx, 0xfe
mov rcx, r14
call fcn.10001011c
lea r9, [0x100001c98]
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call fcn.100011ef4
mov ebx, eax
test eax, eax
je 0x1000126a0
cmp eax, 0x34
je 0x1000127dd
cmp eax, 0x4be
je 0x1000127dd
cmp eax, 0x4c3
je 0x100012719
cmp eax, 0x4ce
jbe 0x1000125d6
cmp eax, 0x4d1
jbe 0x1000127dd
mov esi, 0xa0010001
cmp eax, esi
jmp 0x1000126fd
mov ecx, 0x4c6
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.10000e274
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1000125db
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop rdi
ret