Function at 0x100009ae4
Capabilities:
Get session user name
Prompt user for credentials

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
xor edi, edi
lea rcx, [0x1000058b0]
mov dword [rax + 0x18], 0x202
mov dword [rax + 0x20], edi
mov r13, rdi
mov r14, rdi
mov rbp, rdi
mov rsi, rdi
mov r15, rdi
mov r12, rdi
call fcn.100007178
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, rdi
je 0x100009d46
cmp rax, 0xffffffffffffffff
je 0x100009d46
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x800
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
cmp rax, rdi
jne 0x100009b70
mov ebx, 0x8007000e
jmp 0x100009d63
mov word [rax], di
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
cmp rax, rdi
je 0x100009b66
mov word [rax], di
mov edi, dword [rsp + 0xe0]
add rdi, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edi, edi
mov rbp, rax
cmp rax, rdi
je 0x100009b66
mov word [rax], di
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
mov r8d, 0x202
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, rdi
je 0x100009b66
lea r8d, [rdi + 0x28]
lea rcx, [rsp + 0x58]
xor edx, edx
mov word [rax], di
call sub.msvcrt.dll_memset
mov edi, 0x400
mov r9d, edi
mov r8, r13
mov edx, 0x7e
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, edi
mov r8, r14
mov edx, 0x16
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
lea r8, [rsp + 0xe0]
mov rdx, rbp
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
mov edi, 0x80070000
test al, al
jne 0x100009c54
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x100009d63
mov rax, qword [rsp + 0xd0]
mov dword [rsp + 0x48], 0x140082
lea rdx, [0x100001870]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x101
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x202
mov dword [rsp + 0xe0], 0x202
mov dword [rsp + 0x58], 0x28
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x68], r14
call qword [sym.imp.credui.dll_CredUIPromptForCredentialsW]
xor ebx, ebx
test eax, eax
je 0x100009cd5
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
cmp bx, 0x4c7
mov ecx, 0x8007051f
cmove ebx, ecx
test ebx, ebx
js 0x100009d63
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, 0x8007000e
test rax, rax
mov r15, rax
cmove ebx, edi
test ebx, ebx
js 0x100009d63
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
test rax, rax
mov r12, rax
cmove ebx, edi
test ebx, ebx
js 0x100009d63
mov rcx, qword [rsp + 0xd8]
mov r8, r12
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + 0x1d0]
mov ebx, eax
jmp 0x100009d63
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x100009d63
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100009d73
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rsi, rsi
je 0x100009da6
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov rdi, rsi
not rcx
dec rcx
add rcx, rcx
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
cmp r12, rsi
je 0x100009dd0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
mov rdi, r12
not rcx
dec rcx
add rcx, rcx
rep stosb byte [rdi], al
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp r15, rsi
je 0x100009dde
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp rbp, rsi
je 0x100009df7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r14, rsi
je 0x100009e10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13, rsi
je 0x100009e29
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret