Function at 0x140013ff0
Capabilities:
Get session user name
Impersonate user
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r14, qword [rbp + 0x190]
xor eax, eax
xor r15d, r15d
xor dil, dil
mov r13, r9
mov r12, r8
mov ebx, r15d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], r15
mov rsi, rdx
cmp rdx, 0xffffffff80000001
jne 0x140014165
lea rdx, [rsp + 0x38]
xor ecx, ecx
mov dword [rsp + 0x38], r15d
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r11d, dword [rsp + 0x38]
test r11d, r11d
je 0x140014227
mov rcx, 0xffffffffffffffff
mov eax, 2
mul r11
cmovo rax, rcx
mov rcx, rax
call fcn.1400ca8e8
lea rdx, [rsp + 0x38]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140014255
test rbx, rbx
je 0x140014227
mov dword [rsp + 0x50], reloc.ATL100.DLL_Ordinal_56
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea rdx, [rsp + 0x30]
mov ecx, eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001421f
lea rdx, [rsp + 0x50]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x14001412d
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x30]
mov ebx, r15d
test rcx, rcx
je 0x140014132
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r15d
mov qword [rsp + 0x30], rcx
jmp 0x140014132
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140014165
test rbx, rbx
je 0x140014150
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rbx, r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140014165
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400141e0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x3c], 0x190
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400141e0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp - 0x70]
repne scasw ax, word [rdi]
lea rdx, [rbp - 0x70]
not rcx
lea r8d, [rcx - 1]
mov rcx, r14
call fcn.140001e80
mov dil, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x1400141ff
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001421a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r15
test rbx, rbx
je 0x140014227
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
movzx eax, dil
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400cafa0
mov rbx, qword [rsp + 0x270]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rbx, rbx
jne 0x14001421f
jmp 0x140014227