Function at 0x1800314a8
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x30
mov r12, rcx
lea rdx, str._GETSID_METHOD_1__n
mov ecx, 0x136
xor ebx, ebx
call fcn.180030818
lea r14d, [rbx + 8]
mov r13d, 0x202
mov edi, 0x101
mov edx, r14d
mov r8d, r13d
mov rcx, r12
mov dword [rbp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1800315e7
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x180031525
mov rdx, rsi
mov rcx, r12
call fcn.18003181c
mov rbx, rax
test rax, rax
jne 0x1800317f9
mov dword [rbp + 0x50], edi
xor eax, eax
mov rcx, r13
mov rdi, rsi
rep stosb byte [rdi], al
lea rcx, str.secur32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x180031588
lea rdx, str.GetUserNameExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003157f
lea r8, [rbp + 0x50]
mov rdx, rsi
mov ecx, 2
call rax
test al, al
jne 0x180031598
lea rdx, str.GUN_failed
mov ecx, 0x159
call fcn.180030818
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r8, rsi
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800315e7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, rsi
mov rcx, r12
call fcn.18003181c
mov r8, rsi
xor edx, edx
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x1800315e5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x180031807
mov r8, rbx
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1800315e7
xor ebx, ebx
lea rdx, str._METHOD_2__n
mov ecx, 0x16a
call fcn.180030818
and qword [rbp + 0x58], 0
xor esi, esi
and dword [rbp + 0x48], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rbp + 0x58]
lea r8d, [rsi + 1]
mov rcx, rax
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x18003164f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x1800317e5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x58]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800317e5
mov rcx, qword [rbp + 0x58]
xor r9d, r9d
lea rax, [rbp + 0x48]
lea edx, [r9 + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1800317e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800317e5
mov r8d, dword [rbp + 0x48]
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1800317e5
mov r9d, dword [rbp + 0x48]
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x48]
mov r8, rsi
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1800317e5
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea rdx, str.GetLengthSid___d_n
mov ecx, 0x18d
mov r8d, eax
mov r14d, eax
call fcn.180030818
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
xor edx, edx
mov rcx, r12
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1800317e5
mov rdi, qword [rsi]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov r8, rdi
mov rdx, rbx
mov ecx, eax
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1800317e5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x18003174c
mov r8, rbx
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
jmp 0x1800317e5
lea rdx, str.pSid_n
mov ecx, 0x198
call fcn.180030818
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
xor edi, edi
movzx r13d, byte [rax]
test r13d, r13d
jle 0x180031797
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
lea rdx, [0x18003a408]
mov ecx, 0x19b
mov r8d, dword [rax]
call fcn.180030818
inc edi
cmp edi, r13d
jl 0x180031771
lea rdx, str.ptiUser__User.Sid_n
mov r8d, r14d
mov ecx, 0x19d
call fcn.180030818
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
xor edi, edi
movzx r13d, byte [rax]
test r13d, r13d
jle 0x1800317e5
mov rcx, qword [rsi]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
lea rdx, [0x18003a408]
mov ecx, 0x1a0
mov r8d, dword [rax]
call fcn.180030818
inc edi
cmp edi, r13d
jl 0x1800317bf
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x1800317f4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x180031807
mov r8, rsi
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rbx
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret