Function at 0x18001e6f0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x638]
sub rsp, 0x738
mov rax, qword [0x180089b10]
xor rax, rsp
mov qword [rbp + 0x620], rax
mov esi, dword [rbp + 0x6a8]
mov r10, r9
mov rax, qword [rbp + 0x6b0]
mov r15, rdx
mov rdx, qword [rbp + 0x6a0]
mov r14d, esi
mov r11, qword [rbp + 0x6b8]
mov rbx, qword [rbp + 0x6c8]
imul edi, esi, 0x950
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x60], r9
mov r9, rcx
mov rcx, qword [rbp + 0x6c0]
mov qword [rbp - 0x58], rcx
mov rcx, qword [rbp + 0x6d0]
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], r11
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x80], rcx
mov dword [rsp + 0x60], edi
cmp esi, edi
ja 0x18001ee0a
mov rsi, qword [rbp - 0x78]
mov r12, qword [rbp - 0x78]
mov r13d, dword [rbp - 0x80]
nop dword [rax + rax]
cmp r14d, 0x54f6
ja 0x18001e9bc
je 0x18001e963
cmp r14d, 0x2435
ja 0x18001e89d
je 0x18001e87e
mov eax, r14d
sub eax, 0x1f
je 0x18001e859
sub eax, 0x58
je 0x18001e846
sub eax, 0x1a
je 0x18001e80d
cmp eax, 0x1199
jne 0x18001edd1
mov r8d, 3
lea rdx, [0x18007ddc8]
lea rcx, [rbp + 0x1a5]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x1a8], 0
jmp 0x18001edd1
mov r13d, dword [r9 + 0xcc]
test r13d, r13d
jne 0x18001edd1
mov ecx, 0x12
mov eax, ecx
sub eax, 0x11
je case.0x18001eeac.27
cmp eax, 1
jne 0x18001e83a
mov dword [rsp + 0x44], 0
dec ecx
cmp ecx, 0x10
ja 0x18001e822
jmp 0x18001edd1
mov ecx, 0x28
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
jmp 0x18001edd1
mov eax, dword [str.WSAStartup_socket_closesocket_WSASocketA_WSASocketW_gethostbyname_gethostbyaddr_gethostname]
mov dword [rbp + 0x1a0], eax
movzx eax, byte [0x18007de04]
mov byte [rbp + 0x1a4], al
mov byte [rbp + 0x1a5], 0
jmp 0x18001edd1
mov r8d, 2
lea rdx, [0x18007dd97]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18001edd1
cmp r14d, 0x3640
je 0x18001e948
cmp r14d, 0x45ba
je 0x18001e8cf
cmp r14d, 0x484b
jne 0x18001edd1
mov dword [rbp + 0x1c6], 0x33005f
jmp 0x18001edd1
test rsi, rsi
jne 0x18001e93c
mov ebx, 0x1d
nop dword [rax]
cmp ebx, 0x1d
je 0x18001e8f3
cmp ebx, 0xd41
je case.0x18001eeac.27
jmp 0x18001e92e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor edx, edx
mov ecx, dword [rax]
mov dword [rsp + 0x48], ecx
lea r8d, [rdx + 0x6b]
lea rcx, [rsp + 0x48]
call fcn.1800390d0
mov r9, rax
lea r8, str.NamesApply
mov edx, pe_nt_image_headers64
mov rcx, r15
call fcn.18006f620
mov dword [rsp + 0x44], 0xffffffff
add ebx, 0xd24
cmp ebx, 0x1a48
jbe 0x18001e8e0
mov qword [rsi], 0
jmp 0x18001edd1
mov eax, 0x77
mov dword [rbp + 0x1c2], 0x320073
mov word [rbp + 0x1c0], ax
jmp 0x18001edd1
mov r8, qword [rbp - 0x58]
lea rdx, [r9 + 0xd4]
xor ecx, ecx
sub r8, r9
bt r13d, ecx
jae 0x18001e9ac
mov eax, dword [rdx]
cmp dword [r8 + rdx], eax
je 0x18001e9ac
mov eax, 0x37
cmp eax, 0x37
je 0x18001e998
cmp eax, 0x974
je case.0x18001eeac.27
jmp 0x18001e9a0
mov dword [rsp + 0x44], 1
add eax, 0x93d
cmp eax, 0x127a
jbe 0x18001e986
inc ecx
add rdx, 4
cmp ecx, 0x12
jl 0x18001e973
jmp 0x18001edd1
cmp r14d, 0xfdc0
ja 0x18001ec8c
je case.0x18001eeac.27
cmp r14d, 0x8afd
je 0x18001ebdb
cmp r14d, 0xa95b
je 0x18001ebce
cmp r14d, 0xd040
jne 0x18001edd1
test rcx, rcx
je 0x18001eae5
cmp qword [r10], 0
je 0x18001eae5
mov edi, 0xd3
nop
mov eax, edi
sub eax, 0xd3
je 0x18001eaa1
cmp eax, 1
jne 0x18001eac7
cmp qword [rsi + 0x10], 0
jne 0x18001eac7
mov ebx, 0x14
mov eax, ebx
sub eax, 0x14
je 0x18001ea56
sub eax, 1
je 0x18001ea51
cmp eax, 1
jne 0x18001ea98
mov eax, 0xffffffff
jmp 0x18001f375
mov rcx, rsi
jmp 0x18001ea92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor edx, edx
mov ecx, dword [rax]
mov dword [rsp + 0x58], ecx
lea r8d, [rdx + 0x6b]
lea rcx, [rsp + 0x58]
call fcn.1800390d0
mov r9, rax
lea r8, str.backpatch:
mov edx, pe_nt_image_headers64
mov rcx, r15
call fcn.18006f620
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18001ea98
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc ebx
cmp ebx, 0x17
jb 0x18001ea36
jmp 0x18001eabf
mov rax, qword [r10]
lea rdx, [rsp + 0x50]
mov r8, rcx
mov qword [rsp + 0x50], rax
mov ecx, 0x13b
call fcn.180026250
mov qword [rsi + 0x10], rax
mov rcx, qword [rbp - 0x80]
mov r10, qword [rbp - 0x60]
inc edi
cmp edi, 0xd5
jb 0x18001ea10
mov r8, qword [rbp - 0x68]
xor eax, eax
mov rbx, qword [rbp - 0x70]
mov edi, dword [rsp + 0x60]
jmp 0x18001eaeb
xor eax, eax
mov qword [rsi + 0x10], rax
test r8, r8
je 0x18001ebc5
cmp qword [rbx], 0
je 0x18001ebc5
mov rax, qword [rbx]
lea rdx, [rsp + 0x50]
mov ecx, 0x13b
mov qword [rsp + 0x50], rax
call fcn.180026250
mov qword [rsi + 0x18], rax
test rax, rax
jne 0x18001edd1
mov ebx, SHSetInstanceExplorer
nop word [rax + rax]
mov eax, ebx
sub eax, 0xac
je case.0x18001eeac.27
sub eax, 1
je 0x18001ebaa
sub eax, 1
je 0x18001eb90
cmp eax, 1
jne 0x18001ebb2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor edx, edx
mov ecx, dword [rax]
mov dword [rsp + 0x68], ecx
lea r8d, [rdx + 0x6b]
lea rcx, [rsp + 0x68]
call fcn.1800390d0
mov r9, rax
lea r8, str._Z6lgammaf
mov edx, pe_nt_image_headers64
mov rcx, r15
call fcn.18006f620
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x18001ebb2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18001ebb2
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18001eb9f
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18001ebb2
mov dword [rsp + 0x44], 0xffffffff
dec ebx
cmp ebx, 0xab
ja 0x18001eb30
jmp 0x18001edd1
mov qword [rsi + 0x18], rax
jmp 0x18001edd1
mov dword [rsp + 0x44], 0
jmp 0x18001edd1
test r9, r9
je 0x18001ec7f
cmp qword [r11], 0
je 0x18001ec7f
mov rax, qword [r11]
lea rdx, [rsp + 0x50]
mov r8, r9
mov qword [rsp + 0x50], rax
mov ecx, 0x13b
call fcn.180026250
mov qword [rsi + 8], rax
test rax, rax
jne 0x18001edd1
mov ebx, 0xc9
nop word [rax + rax]
mov eax, ebx
sub eax, 0xc9
je 0x18001ec34
cmp eax, 1
je 0x18001ea47
jmp 0x18001ec70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor edx, edx
mov ecx, dword [rax]
mov dword [rsp + 0x70], ecx
lea r8d, [rdx + 0x6b]
lea rcx, [rsp + 0x70]
call fcn.1800390d0
mov r9, rax
lea r8, str.egReferrer
mov edx, pe_nt_image_headers64
mov rcx, r15
call fcn.18006f620
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc ebx
cmp ebx, 0xcb
jb 0x18001ec20
jmp 0x18001edd1
mov qword [rsi + 8], 0
jmp 0x18001edd1
cmp r14d, 0x11583
je 0x18001ecec
cmp r14d, 0x15ac6
je 0x18001ecc6
cmp r14d, 0x1a009
jne 0x18001edd1
test r12, r12
jne 0x18001ecbd
mov rax, qword [rbp - 0x58]
mov qword [rax + 0x18], rsi
jmp 0x18001edd1
mov qword [r12], rsi
jmp 0x18001edd1
mov rax, qword [rbp - 0x58]
mov r12, qword [rax + 0x18]
test r12, r12
je 0x18001ece1
mov rax, qword [r12]
test rax, rax
je 0x18001ece1
mov r12, rax
jmp 0x18001ecd3
mov r14d, 0x15ac6
jmp 0x18001edd1
test rdx, rdx
je 0x18001edc9
cmp qword [rax], 0
je 0x18001edc9
mov rax, qword [rax]
mov r8, rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov ecx, 0x13b
call fcn.180026250
mov qword [rsi + 0x20], rax
test rax, rax
jne 0x18001edd1
mov ebx, 0x80
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x80
je 0x18001ed77
sub eax, 1
je 0x18001ed62
sub eax, 1
je 0x18001ed5d
sub eax, 1
je 0x18001ed53
cmp eax, 1
je case.0x18001eeac.27
jmp 0x18001edb9
mov dword [rsp + 0x44], 0xffffffff
jmp 0x18001edb9
mov rcx, rsi
jmp 0x18001edb3
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x18001ed71
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 8]
jmp 0x18001edae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor edx, edx
mov ecx, dword [rax]
mov dword [rsp + 0x78], ecx
lea r8d, [rdx + 0x6b]
lea rcx, [rsp + 0x78]
call fcn.1800390d0
mov r9, rax
lea r8, str.authFailed
mov edx, pe_nt_image_headers64
mov rcx, r15
call fcn.18006f620
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x18001edb9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc ebx
cmp ebx, 0x85
jb 0x18001ed30
jmp 0x18001edd1
mov qword [rsi + 0x20], 0
mov edx, dword [rbp + 0x6a8]
imul eax, edx, 0x95
add r14d, eax
cmp r14d, edi
ja 0x18001ee0c
mov r9, qword [rbp - 0x50]
mov r10, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x38]
mov r11, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x70]
jmp 0x18001e7a0
mov edx, esi
lea eax, [rdx + 0x10]
mov dword [rbp - 0x80], eax
cmp edx, eax
jae case.0x18001eeac.27
movzx edi, byte [rsp + 0x40]
mov ebx, PathMakeUniqueName
mov r14, qword [rbp - 0x78]
mov r12, qword [rbp - 0x78]
mov r13d, dword [rbp - 0x80]
movzx esi, byte [rsp + 0x40]
movzx r15d, byte [rsp + 0x40]
lea eax, [rdx - 0x1f]
lea r8, [0x180000000]
cmp eax, 0x59
ja case.0x18001ee62.46
movzx eax, byte [r8 + rax + 0x1f5bc]
mov ecx, dword [r8 + rax*4 + 0x1f57c]
add rcx, r8
jmp rcx
xor eax, eax
mov dword [rsp + 0x44], eax
jmp case.0x18001ee62.46
mov r8, qword [rbp - 0x58]
xor edx, edx
lea ecx, [rdx + 0x5c]
call fcn.1800425e0
test al, al
jne 0x18001f55d
xor r8d, r8d
mov ebx, r8d
nop dword [rax + rax]
cmp ebx, 0x1b
ja case.0x18001eeac.19
lea rdx, [0x180000000]
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x1f618]
add rcx, rdx
jmp rcx
mov byte [rbp + 0x2f7], 0x69
jmp case.0x18001eeac.19
mov eax, 0x5342
mov word [rbp + 0x2f1], ax
jmp case.0x18001eeac.19
mov r8d, 2
lea rdx, [0x18007de79]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r8d, r8d
jmp case.0x18001eeac.19
mov byte [rbp + 0x2fa], 0
jmp case.0x18001eeac.19
mov r8d, 1
mov byte [rbp + 0x1f2], 0
lea rdx, [0x18007de84]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r8d, r8d
jmp case.0x18001eeac.19
mov r8d, 4
lea rdx, [0x18007dec2]
lea rcx, [rbp + 0x2fc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor r8d, r8d
mov byte [rbp + 0x300], 0
jmp case.0x18001eeac.19
mov byte [rbp + 0x2f0], 0x4c
jmp case.0x18001eeac.19
mov r8d, 2
mov byte [rbp + 0x1e0], 0
lea rdx, [0x18007df0a]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r8d, r8d
jmp case.0x18001eeac.19
mov r8d, 3
mov byte [rbp + 0x1ea], 0
lea rdx, [0x18007df18]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r8d, r8d
jmp case.0x18001eeac.19
mov byte [rbp + 0x2f8], 0
jmp case.0x18001eeac.19
movzx eax, word [0x18007df49]
mov word [rbp + 0x1e2], ax
movzx eax, byte [0x18007df4b]
mov byte [rbp + 0x1e4], al
mov byte [rbp + 0x1e5], 0
jmp case.0x18001eeac.19
mov dil, 1
jmp case.0x18001eeac.19
mov byte [rsp + 0x44], 0
jmp case.0x18001eeac.19
mov dword [rbp + 0x2f3], 0x6c707041
jmp case.0x18001eeac.19
mov r8d, 4
lea rdx, [0x18007df63]
lea rcx, [rbp + 0x300]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor r8d, r8d
mov byte [rbp + 0x304], 0
jmp case.0x18001eeac.19
test dil, dil
je 0x18001f034
mov rcx, r14
call qword [sym.imp.SHELL32.dll_ILFree]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x4000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
xor r8d, r8d
jmp case.0x18001eeac.19
mov eax, 0x7567
mov byte [rbp + 0x1e7], 0
mov word [rbp + 0x1e5], ax
jmp case.0x18001eeac.19
mov r12, r8
jmp case.0x18001eeac.19
mov r8d, r13d
lea rdx, [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov r14, rax
xor r8d, r8d
jmp case.0x18001eeac.19
mov r13d, r8d
jmp case.0x18001eeac.19
mov eax, dword [0x18007dfa7]
mov dword [rbp + 0x1ed], eax
movzx eax, byte [0x18007dfab]
mov byte [rbp + 0x1f1], al
jmp case.0x18001eeac.19
mov eax, 3
mov byte [rsp + 0x4a], 0
mov word [rsp + 0x48], ax
jmp case.0x18001eeac.19
mov eax, 0x6163
mov word [rbp + 0x2f8], ax
jmp case.0x18001eeac.19
movzx eax, word [0x18007e074]
mov word [rbp + 0x1e7], ax
movzx eax, byte [0x18007e076]
mov byte [rbp + 0x1e9], al
jmp case.0x18001eeac.19
test r14, r14
movzx edi, dil
cmove edi, r8d
inc ebx
lea eax, [rbx + 0x5b]
cmp eax, 0x77
jb 0x18001ee90
mov ebx, PathMakeUniqueName
jmp 0x18001f55d
mov ecx, 0x202
lea rdx, [rbp]
call qword [rbp - 0x38]
test eax, eax
je 0x18001f55d
mov ebx, 0xd2
cmp ebx, 0x3cf5a
ja 0x18001f29b
je 0x18001f290
cmp ebx, 0x1b1f2
ja 0x18001f230
je 0x18001f211
cmp ebx, 0xd2
je 0x18001f202
cmp ebx, 0x6d1a
je 0x18001f1c9
cmp ebx, 0xd962
je 0x18001f18a
cmp ebx, 0x145aa
jne 0x18001f3f6
mov eax, dword [str._The]
mov dword [rbp + 0x1b9], eax
movzx eax, byte [0x18007e0bc]
mov byte [rbp + 0x1bd], al
jmp 0x18001f3f6
mov r8d, 2
lea rdx, [0x18007e0b4]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea rcx, [rbp + 0x1b0]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001f1b0
movzx eax, word [0x180076edc]
mov word [rcx], ax
jmp 0x18001f3f6
mov r8d, 2
lea rdx, [0x18007bba0]
lea rcx, [rbp + 0x1b3]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 2
lea rdx, [0x18007e0b0]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18001f3f6
mov dword [rbp + 0x1b0], 0x657369
jmp 0x18001f3f6
mov r8d, 2
lea rdx, [0x180075f88]
lea rcx, [rbp + 0x1bd]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18001f3f6
cmp ebx, 0x21e3a
je 0x18001f271
cmp ebx, 0x28a82
je 0x18001f269
cmp ebx, 0x2f6ca
je 0x18001f261
cmp ebx, 0x36312
jne 0x18001f3f6
mov dword [rsp + 0x60], 0x104
jmp 0x18001f3f6
mov sil, 1
jmp 0x18001f3f6
mov r15b, 1
jmp 0x18001f3f6
mov r8d, 1
lea rdx, [0x180076e10]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18001f3f6
xor eax, eax
mov dword [rsp + 0x78], eax
jmp 0x18001f3f6
cmp ebx, 0x5ecc2
ja 0x18001f34c
je 0x18001f331
cmp ebx, 0x43ba2
je 0x18001f31f
cmp ebx, 0x4a7ea
je 0x18001f312
cmp ebx, 0x51432
je 0x18001f2e8
cmp ebx, 0x5807a
jne 0x18001f3f6
xor eax, eax
mov ecx, eax
movzx eax, sil
cmp dword [rsp + 0x70], ecx
cmovne ecx, eax
movzx esi, cl
jmp 0x18001f3f6
mov r8d, dword [rsp + 0x78]
lea r9, [rbp - 0x30]
mov edx, dword [rsp + 0x68]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_CredReadA]
mov dword [rsp + 0x70], eax
mov dword [rbp - 0x50], 0x104
jmp 0x18001f3f6
mov dword [rsp + 0x50], ILFindLastID
jmp 0x18001f3f6
xor eax, eax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], eax
mov dword [rsp + 0x68], eax
jmp 0x18001f3f6
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x58], eax
jmp 0x18001f3f6
cmp ebx, 0x6590a
je 0x18001f3e7
cmp ebx, 0x6c552
je 0x18001f398
cmp ebx, 0x7319a
jne 0x18001f3f6
mov byte [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.18006fee0
add rsp, 0x738
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
mov ecx, eax
movzx eax, r15b
cmp dword [rsp + 0x58], ecx
cmovne ecx, eax
movzx r15d, cl
test cl, cl
je 0x18001f3f6
lea rax, [rbp - 0x60]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x50]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
jmp 0x18001f3f6
test sil, sil
je 0x18001f3f6
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CredFree]
add ebx, 0x6c48
cmp ebx, 0x79d10
jbe 0x18001f120
mov ebx, PathMakeUniqueName
jmp 0x18001f55d
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x41]
cmp dword [rbp - 0x70], ecx
cmovne ecx, eax
mov byte [rsp + 0x41], cl
jmp case.0x18001ee62.46
mov dword [rbp + 0x1d2], 0x6c
jmp case.0x18001ee62.46
cmp byte [rsp + 0x40], 0
je 0x18001f450
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
mov edx, dword [rbp + 0x6a8]
cmp byte [rsp + 0x41], 0
je case.0x18001ee62.46
lea rax, [rbp - 0x28]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x44]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x10]
lea rax, [rbp + 0x510]
lea rdx, [rbp + 0x400]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
jmp 0x18001f55d
lea rcx, [rbp - 0x78]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x48], 0x104
jmp 0x18001f55d
mov dword [rbp + 0x1ce], 0x6c0064
jmp case.0x18001ee62.46
xor eax, eax
mov dword [rbp - 0x40], 0x104
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], eax
jmp case.0x18001ee62.46
mov byte [rsp + 0x41], 1
mov byte [rsp + 0x40], 1
jmp case.0x18001ee62.46
mov dword [rbp + 0x1ca], 0x2e0032
jmp case.0x18001ee62.46
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x80
call fcn.18000ed20
mov byte [rsp + 0x44], al
jmp 0x18001f55d
lea r8, [rbp + 0x1c0]
mov ecx, 0x71
lea rdx, [rbp + 0x1a0]
call fcn.1800053d0
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x44], ILFindLastID
jmp 0x18001f55d
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x400]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
movzx ecx, byte [rsp + 0x40]
mov dword [rbp - 0x70], eax
xor eax, eax
cmp dword [rbp - 0x68], eax
mov edx, eax
cmove edx, ecx
mov byte [rsp + 0x40], dl
mov edx, dword [rbp + 0x6a8]
inc edx
mov dword [rbp + 0x6a8], edx
cmp edx, dword [rbp - 0x80]
jae case.0x18001eeac.27
jmp 0x18001ee3b