Function at 0x14007acb0
Capabilities:
Get session user name
Impersonate user

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r13, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor r12d, r12d
lea rcx, [rbp - 0x40]
call fcn.140021c60
nop
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, str.RegistryValue
test rdx, 0xffffffffffff0000
jne 0x14007ad41
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x14007ad52
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140001f70
jmp 0x14007ad52
mov r8d, Ordinal_17
lea rcx, [rsp + 0x48]
call fcn.140001e80
nop
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, str.DebugInfoSearch
test rdx, 0xffffffffffff0000
jne 0x14007ad9f
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x14007adb0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001f70
jmp 0x14007adb0
mov r8d, Ordinal_20
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
mov r9, r13
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x40]
call fcn.140021600
test al, al
sete dil
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007adf0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007ae0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test dil, dil
je 0x14007b12c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x14007ae2d
mov rcx, r13
call fcn.140001a60
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140002710
nop
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140002710
nop
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov rcx, qword [rsp + 0x38]
cmp dword [rcx - 0x10], 0
jle 0x14007b0bd
mov edx, 0x5c
call qword [sym.imp.MSVCR100.dll_wcschr]
test rax, rax
je 0x14007b0bd
sub rax, qword [rsp + 0x38]
sar rax, 1
cmp eax, 0xffffffff
je 0x14007b0bd
mov r8d, eax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.140001d30
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14007af03
cmp dword [rdi + 0x10], 0
jl 0x14007aef4
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14007aef4
call fcn.140001b90
mov rsi, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14007aee9
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x14007af03
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140001e80
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007af22
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, str.HKEY_CURRENT_USER
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14007b072
lea rdi, [rbp - 0x78]
mov ecx, reloc.ATL100.DLL_Ordinal_56
rep stosb byte [rdi], al
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x30], r12d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, dword [rsp + 0x30]
test eax, eax
jne 0x14007af6e
test ecx, ecx
je 0x14007b041
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1400ca8e8
mov rdi, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14007b034
test rdi, rdi
je 0x14007b041
mov dword [rbp - 0x78], reloc.ATL100.DLL_Ordinal_56
mov qword [rbp - 0x70], rdi
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x40]
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14007b034
lea rdx, [rbp - 0x78]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x14007b034
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x14007b034
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
mov r8, qword [rbp - 0x48]
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.140078f00
nop
mov rdx, rax
mov rcx, r13
call fcn.140002250
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007b034
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test rdi, rdi
je 0x14007b041
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x14007b060
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14007b0bd
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14007b0bd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14007b0bd
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, r15
call fcn.140078f00
nop
mov rdx, rax
mov rcx, r13
call fcn.140002250
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007b0bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [r13]
mov ecx, 0x20000007
cmp dword [rax - 0x10], 0
cmove r12d, ecx
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007b0ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007b10e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14007b12c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp - 0x40]
call fcn.140021ae0
mov eax, r12d
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret