Function at 0x14005fc00
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r15, rdx
mov qword [rsp + 0x78], rdx
xor r14d, r14d
mov dword [rsp + 0x60], r14d
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140060004
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea r12, [0x1402e82f0]
lea rdi, [r14 - 1]
cmp r12, 0x10000
jae 0x14005fc86
movzx edx, r12w
lea rcx, [rsp + 0x50]
call fcn.14000d610
jmp 0x14005fcab
mov rax, rdi
nop dword [rax]
inc rax
cmp word [r12 + rax*2], 0
jne 0x14005fc90
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14000df90
movzx ebx, r12w
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006000f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
movzx esi, bx
cmp r12, 0x10000
jae 0x14005fce9
mov edx, esi
lea rcx, [rsp + 0x58]
call fcn.14000d610
jmp 0x14005fd0c
mov rax, rdi
nop dword [rax]
inc rax
cmp word [r12 + rax*2], 0
jne 0x14005fcf0
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.14000df90
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14006001a
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14005ffee
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r15], rax
cmp r12, 0x10000
jae 0x14005fd5f
mov edx, esi
mov rcx, r15
call fcn.14000d610
jmp 0x14005fd7c
mov rax, rdi
inc rax
cmp word [r12 + rax*2], 0
jne 0x14005fd62
mov r8d, eax
mov rdx, r12
mov rcx, r15
call fcn.14000df90
nop
mov esi, 1
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x48], 0x400
mov dword [rsp + 0x4c], 0x400
mov dword [rsp + 0x64], 0x100
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x400
or eax, ecx
jge 0x14005fdc2
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.14000df10
mov rbx, qword [rsp + 0x40]
lea rdx, [rsp + 0x4c]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edx, dword [rsp + 0x4c]
test edx, edx
js 0x14005fff9
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x14005fdf9
lea rcx, [rsp + 0x40]
call fcn.14000df10
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x14005fe03
mov eax, r14d
jmp 0x14005fe10
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14005fe06
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14000df90
test rbx, rbx
jne 0x14005fe2a
mov eax, r14d
jmp 0x14005fe3e
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14024bd08
test eax, eax
js 0x14005fff9
cmp eax, dword [rbx - 0xc]
jg 0x14005fff9
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], r14w
mov edx, dword [rsp + 0x48]
test edx, edx
js 0x14005fff9
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x14005fe7a
lea rcx, [rsp + 0x40]
call fcn.14000df10
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x64]
lea r8, [rbp - 0x80]
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [rsp + 0x48]
test edx, edx
js 0x14005fff9
sub esi, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, esi
jge 0x14005fed0
lea rcx, [rsp + 0x40]
call fcn.14000df10
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x14005feda
mov eax, r14d
jmp 0x14005feea
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14005fee0
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14000df90
test rbx, rbx
jne 0x14005ff04
mov eax, r14d
jmp 0x14005ff18
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14024bd08
test eax, eax
js 0x14005fff9
cmp eax, dword [rbx - 0xc]
jg 0x14005fff9
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], r14w
mov qword [rsp + 0x68], r14
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14005ff5d
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14005ff50
mov r14d, eax
mov r8d, r14d
mov rcx, r15
call fcn.14000df90
nop
mov eax, edi
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14005ff84
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005ffa3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005ffc0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, r15
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1402155d0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400080b0
int3
mov ecx, 0x80070057
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3