Function at 0x14000b140
Capabilities:
Get session information
Get user security identifier

Disassembly:
push rbp
push rdi
push r12
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.140032740
sub rsp, rax
mov rax, qword [0x140061148]
xor rax, rsp
mov qword [rbp + 0xf50], rax
xorps xmm0, xmm0
mov qword [rsp + 0x1068], r14
xor edi, edi
mov dword [rsp + 0x5c], 0x44
mov r12, rcx
mov qword [rsp + 0x48], rdi
xor eax, eax
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x60], eax
xor edx, edx
mov r8d, 0xfa0
mov r14d, edi
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 0x7cf
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov edx, 0xffffffff
mov dword [rsp + 0x54], 8
xor ecx, ecx
mov qword [rsp + 0x40], rdi
lea r8d, [rdi + 0x18]
mov qword [r12], rdi
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14000b34f
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000b34f
cmp dword [rsp + 0x50], 0xd8
jb 0x14000b34f
lea rdx, [rcx + 0x82]
add rcx, 0x60
call fcn.14000b3b0
mov r14, rax
test rax, rax
je 0x14000b34f
lea rax, [rsp + 0x54]
mov rdx, r14
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x5c]
lea rax, [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x60]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x14000b34f
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x14000b34f
mov qword [rsp + 0x1098], rbx
mov qword [rsp + 0x1060], r15
mov r15, qword [rsp + 0x40]
test r15, r15
jne 0x14000b2a3
mov ebx, edi
jmp 0x14000b33b
mov rcx, qword [rsp + 0x40]
mov edx, 0x10000
mov qword [rsp + 0x10a0], rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rsi, rax
cmp rax, 0x10000
jb 0x14000b2cb
mov rbx, rdi
jmp 0x14000b333
lea rcx, [rax + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14000b2f8
mov rbx, rdi
jmp 0x14000b333
add rsi, rsi
lea r8, [rsi + 2]
je 0x14000b32f
mov rcx, rbx
cmp r8, rsi
jb 0x14000b316
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14000b32f
xor edx, edx
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov word [rsi + rbx], di
mov rsi, qword [rsp + 0x10a0]
mov r15, qword [rsp + 0x1060]
mov qword [r12], rbx
mov rbx, qword [rsp + 0x1098]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000b35f
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14, r14
je 0x14000b36d
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x1068]
test rcx, rcx
je 0x14000b385
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp qword [r12], rdi
setne dil
mov eax, edi
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.1400322d0
add rsp, 0x1070
pop r12
pop rdi
pop rbp
ret