Function at 0x14000eaa0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400cfce8]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor ebx, ebx
mov dword [rsp + 0x48], 8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x50]
mov edx, 1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov r8d, edx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x68], rbx
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x14000eb25
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.GetSecurityInfo_error_
jmp 0x14000ebe9
mov rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov edx, dword [rsp + 0x44]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
jne 0x14000eb7a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.GlobalAlloc_error_
jmp 0x14000ebe9
mov edx, dword [rsp + 0x40]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
je 0x14000eb6a
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea r9, [rsp + 0x44]
lea rcx, [rsp + 0x40]
mov r8, rbx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x14000ec34
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
cmp eax, 0x534
jne 0x14000ebe2
lea rdx, str.Account_owner_not_found_for_specified_SID.
call fcn.140008c90
jmp 0x14000ec02
lea rdx, str.Error_in_LookupAccountSid:
call fcn.140008c90
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x1400097c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140055ba0
mov rbx, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
add rsp, 0x290
pop rbp
ret
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x101
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x58]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x14000ec12
lea rax, [rsp + 0x70]
mov r8, rbx
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ec84
add rax, 2
test ecx, ecx
jne 0x14000ec70
test edx, edx
je 0x14000ed77
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x14000ecd6
mov rdx, qword [rsp + 0x58]
lea r8, str.S_1_5_32_544
mov rax, 0xffffffffffffffff
nop dword [rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r8 + rax*2 + 2]
jne 0x14000ecd6
add rax, 2
cmp rax, 0xd
je 0x14000ed7c
movzx ecx, word [rdx + rax*2]
cmp cx, word [r8 + rax*2]
je 0x14000ecb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Unmatched_owner___current_user___
call fcn.140008e60
mov rcx, rax
mov rdx, rbx
call fcn.140008e60
mov rcx, rax
lea rdx, [0x14005f5d0]
call fcn.140008e60
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.140008e60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._IsUserAdmin
call fcn.140008e60
mov rbx, rax
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str._SIDOwner
call fcn.140008e60
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call fcn.140008e60
lea rdx, [0x140009800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000ec12
mov rdx, qword [rsp + 0x58]
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x14000ec14