Function at 0x14009a8f0
Capabilities:
Get session user name
Impersonate user

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
lea rcx, str.Enter_interface_GetLocalizedResource__
mov r15, r9
mov r13d, r8d
mov r14d, edx
call fcn.1400191f0
lea rcx, str.GetLocalizedResource:_lMessageId_in_:__d
mov edx, r14d
call fcn.1400191f0
lea rcx, str.GetLocalizedResource:_lLanguageId_in_:__d
mov edx, r13d
call fcn.1400191f0
mov rax, qword [0x14011d880]
lea rcx, [0x14011d880]
call qword [rax + 0x18]
xor r12b, r12b
or rbp, 0xffffffffffffffff
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
test r15, r15
je 0x14009aab2
xor eax, eax
lea rdi, [rsp + 0x38]
mov ecx, reloc.ATL100.DLL_Ordinal_56
rep stosb byte [rdi], al
xor edi, edi
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, dword [rsp + 0x20]
test eax, eax
jne 0x14009a9a6
test ecx, ecx
je 0x14009aa55
mov eax, 2
mov qword [rsp + 0xb0], rsi
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.1400ca8e8
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14009aa40
test rsi, rsi
je 0x14009aa4d
mov dword [rsp + reloc.ATL100.DLL_Ordinal_56], 0x38
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea rdx, [rsp + 0x28]
mov ecx, eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14009aa40
lea rdx, [rsp + 0x38]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x14009aa40
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x14009aa40
lea r8, [rsp + 0x30]
xor r9d, r9d
mov edx, r14d
movzx ecx, r13w
call fcn.140099df0
mov rbx, qword [rsp + 0x30]
movzx r12d, al
test rsi, rsi
je 0x14009aa4d
mov rcx, rsi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rsi, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14009aa75
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14009aa8a
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14009aa8a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rdi
lea rcx, str.GetUserDefaultUILanguage:__d
xor edx, edx
call fcn.1400191f0
test r12b, r12b
je 0x14009aaab
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r15], rax
jmp 0x14009aab7
mov edi, 0x80040209
jmp 0x14009aab7
mov edi, 0x80004003
lea rcx, str.Return_value_is:__x
mov edx, edi
call fcn.1400191f0
lea rcx, str.Leave_interface_GetLocalizedResource__
call fcn.1400191f0
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
mov rbx, qword [rsp + 0xa0]
dec ebp
test ebp, ebp
mov rbp, qword [rsp + 0xa8]
jg 0x14009ab13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, edi
add rsp, 0x90
pop rdi
ret