Function at 0x1400803b4
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x14009b978]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor r12d, r12d
mov rbx, rcx
cmp qword [0x14009f868], r12
jne 0x1400803ff
mov eax, 0x80004005
jmp 0x140080652
mov r14, r12
mov r15b, r12b
test rbx, rbx
je 0x14008049d
mov rax, qword gs:[0x30]
cmp dword [rax + 0x179c], r12d
jne 0x140080442
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
nop dword [rax + rax]
test eax, eax
jle 0x14008043a
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140080442
mov r14, rbx
mov r15b, 1
mov rcx, rbx
call fcn.1400801b8
test al, al
je 0x14008049d
mov rcx, qword [0x14009b020]
lea rsi, [0x14009b020]
cmp rcx, rsi
je 0x14008047f
mov edi, 2
test byte [rcx + 0x1c], dil
je 0x14008047f
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 8]
lea r8, [0x140091d48]
call fcn.1400042fc
test r15b, r15b
je 0x140080493
mov rcx, r14
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
nop dword [rax + rax]
mov eax, 1
jmp 0x140080652
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x29c
call sub.msvcrt.dll_memset
movups xmm0, xmmword [0x140091d38]
mov edi, 2
mov dword [rsp + 0x30], 0x2b0
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x104
lea rdx, [rbp - 0x28]
mov ecx, edi
movdqu xmmword [rsp + 0x34], xmm0
call qword [sym.imp.Secur32.dll_GetUserNameExW]
nop dword [rax + rax]
lea rsi, [0x14009b020]
test al, al
jne 0x140080535
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14008050b
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [0x14009b020]
cmp rcx, rsi
je 0x140080535
test byte [rcx + 0x1c], 1
je 0x140080535
mov rcx, qword [rcx + 0x10]
lea r8, [0x140091d48]
mov edx, 0xb
mov r9d, eax
call fcn.140004668
lea rdx, [rbp + 0x1e0]
mov rcx, rbx
call fcn.14007fff4
mov ebx, eax
test eax, eax
js 0x1400805b5
lea r9, [rsp + 0x5a]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.ntdll.dll_RtlIpv6StringToAddressExW]
nop dword [rax + rax]
mov ebx, 0x10000000
or eax, ebx
jl 0x140080581
mov ecx, 0x17
mov word [rsp + 0x58], cx
jmp 0x1400805a9
lea r9, [rsp + 0x5a]
xor edx, edx
lea r8, [rsp + 0x5c]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.ntdll.dll_RtlIpv4StringToAddressExW]
nop dword [rax + rax]
or eax, ebx
jl 0x1400805a9
mov word [rsp + 0x58], di
test eax, eax
mov ebx, r12d
cmovs ebx, eax
test ebx, ebx
jns 0x1400805f0
mov rcx, qword [0x14009b020]
cmp rcx, rsi
je 0x1400805df
test byte [rcx + 0x1c], dil
je 0x1400805df
mov rcx, qword [rcx + 0x10]
lea r8, [0x140091d48]
mov edx, 0xc
mov r9d, ebx
call fcn.140004668
mov word [rsp + 0x58], di
mov dword [rsp + 0x5c], r12d
cmp word [rbp - 0x28], r12w
je 0x14008063c
movabs r10, 0xfd29b6ad3e53e170
mov rax, qword [0x14009f868]
lea rcx, [rsp + 0x30]
call qword [0x14008a2c0]
mov ebx, eax
test eax, eax
jns 0x14008063c
mov rcx, qword [0x14009b020]
cmp rcx, rsi
je 0x14008063c
test byte [rcx + 0x1c], 1
je 0x14008063c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140091d48]
mov edx, 0xd
mov r9d, eax
call fcn.140004668
test r15b, r15b
je 0x140080650
mov rcx, r14
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400018f0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret