Function at 0x14001a9e2
Capabilities:
Get session user name
Get user security identifier

Disassembly:
jmp 0x140044f70
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x538
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xde
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x558]
mov rax, qword [0x140068040]
xor rax, rbp
mov qword [rbp + 0x4e8], rax
mov dword [rbp + 0x4d4], 1
lea rcx, [0x14007491a]
call fcn.14001b3ab
nop
mov rdx, qword [str.RegistryUser]
mov rcx, qword [rbp + 0x518]
call fcn.14001a677
nop
mov eax, dword [rbp + 0x4d4]
or eax, 1
mov dword [rbp + 0x4d4], eax
mov dword [rbp + 0x274], 0x104
mov dword [rbp + 0x314], 0
mov dword [rbp + 0x334], 0
lea rdx, [rbp + 0x274]
lea rcx, [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x140045056
mov dword [rbp + 0x4d4], 0
mov eax, dword [rbp + 0x4d4]
and eax, 1
test eax, eax
je 0x14004504a
and dword [rbp + 0x4d4], 0xfffffffe
mov rcx, qword [rbp + 0x518]
call fcn.14001b108
nop
mov rax, qword [rbp + 0x518]
jmp 0x140045303
lea rax, [rbp + 0x2f4]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x334]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x314]
xor r8d, r8d
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1400450d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400450d3
mov dword [rbp + 0x4d4], 0
mov eax, dword [rbp + 0x4d4]
and eax, 1
test eax, eax
je 0x1400450c7
and dword [rbp + 0x4d4], 0xfffffffe
mov rcx, qword [rbp + 0x518]
call fcn.14001b108
nop
mov rax, qword [rbp + 0x518]
jmp 0x140045303
mov eax, dword [rbp + 0x314]
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x2b8], rax
cmp qword [rbp + 0x2b8], 0
jne 0x14004512b
mov dword [rbp + 0x4d4], 0
mov eax, dword [rbp + 0x4d4]
and eax, 1
test eax, eax
je 0x14004511f
and dword [rbp + 0x4d4], 0xfffffffe
mov rcx, qword [rbp + 0x518]
call fcn.14001b108
nop
mov rax, qword [rbp + 0x518]
jmp 0x140045303
mov eax, dword [rbp + 0x334]
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x298], rax
cmp qword [rbp + 0x298], 0
jne 0x140045191
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov dword [rbp + 0x4d4], 0
mov eax, dword [rbp + 0x4d4]
and eax, 1
test eax, eax
je 0x140045185
and dword [rbp + 0x4d4], 0xfffffffe
mov rcx, qword [rbp + 0x518]
call fcn.14001b108
nop
mov rax, qword [rbp + 0x518]
jmp 0x140045303
lea rax, [rbp + 0x2f4]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x334]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x298]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x314]
mov r8, qword [rbp + 0x2b8]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140045226
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov dword [rbp + 0x4d4], 0
mov eax, dword [rbp + 0x4d4]
and eax, 1
test eax, eax
je 0x14004521a
and dword [rbp + 0x4d4], 0xfffffffe
mov rcx, qword [rbp + 0x518]
call fcn.14001b108
nop
mov rax, qword [rbp + 0x518]
jmp 0x140045303
lea rdx, [rbp + 0x2d8]
mov rcx, qword [rbp + 0x2b8]
call fcn.14001a86b
test eax, eax
jne 0x14004528d
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov dword [rbp + 0x4d4], 0
mov eax, dword [rbp + 0x4d4]
and eax, 1
test eax, eax
je 0x140045284
and dword [rbp + 0x4d4], 0xfffffffe
mov rcx, qword [rbp + 0x518]
call fcn.14001b108
nop
mov rax, qword [rbp + 0x518]
jmp 0x140045303
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rdx, [0x14005ea44]
mov rcx, qword [rbp + 0x518]
call fcn.14001b2cf
nop
mov rdx, qword [rbp + 0x2d8]
mov rcx, qword [rbp + 0x518]
call fcn.14001b2cf
nop
mov dword [rbp + 0x4d4], 0
mov eax, dword [rbp + 0x4d4]
and eax, 1
test eax, eax
je 0x1400452fc
and dword [rbp + 0x4d4], 0xfffffffe
mov rcx, qword [rbp + 0x518]
call fcn.14001b108
nop
mov rax, qword [rbp + 0x518]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14005d870]
call fcn.14001b090
mov rax, rdi
mov rcx, qword [rbp + 0x4e8]
xor rcx, rbp
call fcn.14001a99c
lea rsp, [rbp + 0x4f8]
pop rdi
pop rbp
ret