Function at 0x18008b1b0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push rbp
push rbx
push r13
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x18012a010]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r13, rcx
mov dword [rbp - 0x78], 0xff
lea rcx, [rbp + 0x1a0]
lea rdx, [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x60], 0xff
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x60]
lea rax, [rbp - 0x74]
mov dword [rbp - 0x74], 0xff
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0xa0]
lea rax, [rbp + 0x2a0]
xor ecx, ecx
lea rdx, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
lea rdx, [0x18012d798]
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.1800c2a30
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.18008b080
cmp qword [rax + 0x18], 0x10
jb 0x18008b270
mov rax, qword [rax]
mov r8d, 1
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.1800890f0
mov rdx, qword [rbp - 0x80]
mov dword [rsp + 0x60], eax
cmp rdx, 0x10
jb 0x18008b2c2
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008b2bd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008b5dd
call fcn.1800cff50
lea rdx, [0x18012d358]
mov qword [rsp + 0x4b0], r15
lea rcx, [rsp + 0x40]
call fcn.1800c2a30
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.18008b080
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x18008b2f5
mov rdx, qword [rax]
movzx r8d, byte [rbx + 5]
lea rcx, [rbp - 0x60]
mov r15, 0xffffffffffffffff
mov rax, r15
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18008b310
lea rcx, [rbp - 0x60]
add rcx, rax
call fcn.1800890f0
add dword [rsp + 0x60], eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18008b365
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008b360
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008b5e3
call fcn.1800cff50
mov qword [rsp + 0x4e8], rsi
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x4f0], rdi
mov qword [rsp + 0x4f8], r12
mov qword [rsp + 0x4b8], r14
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
xor r14d, r14d
movzx r12d, byte [rax]
test r12d, r12d
je 0x18008b4e6
cmp qword [0x18012ca10], 0x10
lea rsi, [0x18012c9f8]
mov rdi, qword [0x18012ca08]
movabs rax, 0x7fffffffffffffff
cmovae rsi, qword [0x18012c9f8]
cmp rdi, 0x10
jae 0x18008b3e2
movups xmm0, xmmword [rsi]
mov qword [rbp - 0x80], 0xf
movups xmmword [rsp + 0x68], xmm0
jmp 0x18008b452
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18008b42c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18008b5ef
mov rcx, rax
call fcn.1800cff58
mov rcx, rax
test rax, rax
je 0x18008b5d7
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18008b43a
test rcx, rcx
je 0x18008b438
call fcn.1800cff58
jmp 0x18008b43a
xor eax, eax
lea r8, [rdi + 1]
mov qword [rsp + 0x68], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d35e0
mov qword [rbp - 0x80], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x40]
call fcn.18008b080
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x18008b473
mov rbx, qword [rax]
mov edx, r14d
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
lea rcx, [rbp - 0x60]
mov rdx, rbx
mov r8d, dword [rax]
mov eax, dword [rsp + 0x60]
add rcx, rax
call fcn.1800890f0
add dword [rsp + 0x60], eax
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18008b4da
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008b4d5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008b5d7
call fcn.1800cff50
inc r14d
cmp r14d, r12d
jl 0x18008b3a2
mov qword [rsp + 0x78], 0
lea rax, [rbp - 0x60]
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
inc r15
cmp byte [rax + r15], 0
jne 0x18008b500
mov r8, r15
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x68]
call fcn.1800c30f0
mov r8d, 0x28
mov qword [r13 + 0x10], 0
cmp qword [rsp + 0x78], r8
lea rdx, [rsp + 0x68]
mov rcx, r13
mov qword [r13 + 0x18], 0xf
cmovb r8, qword [rsp + 0x78]
cmp qword [rbp - 0x80], 0x10
mov byte [r13], 0
cmovae rdx, qword [rsp + 0x68]
call fcn.1800c30f0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18008b591
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008b58c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008b5e9
call fcn.1800cff50
mov r14, qword [rsp + 0x4b8]
mov rax, r13
mov r12, qword [rsp + 0x4f8]
mov rdi, qword [rsp + 0x4f0]
mov rsi, qword [rsp + 0x4e8]
mov r15, qword [rsp + 0x4b0]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1800cfc90
add rsp, 0x4c0
pop r13
pop rbx
pop rbp
ret
call fcn.1800df1b0
int3
call fcn.1800df1b0
int3
call fcn.1800df1b0
int3
call fcn.1800df1b0
int3
call fcn.180089250
int3