Function at 0x1400335e0
Capabilities:
Get session user name
Impersonate user

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r14, r9
mov rbx, r8
mov r13, rdx
mov r12d, 0x80004005
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
xor r15d, r15d
or rsi, 0xffffffffffffffff
test r13, r13
je 0x140033682
test r13, 0xffffffffffff0000
jne 0x14003366f
movzx edi, r13w
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x140033695
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140001f70
jmp 0x140033695
xor eax, eax
mov rcx, rsi
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x140033685
mov ecx, r15d
mov r8d, ecx
mov rdx, r13
lea rcx, [rbp - 0x70]
call fcn.140001e80
nop
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
test rbx, rbx
je 0x1400336f3
test rbx, 0xffffffffffff0000
jne 0x1400336e0
movzx edi, bx
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x140033707
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140001f70
jmp 0x140033707
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x1400336f6
mov ecx, r15d
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140001e80
nop
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x60], r15d
lea rcx, [rsp + 0x40]
call fcn.1400386c0
nop
lea rax, [rbp - 0x50]
mov qword [rbp - 0x28], rax
mov r13, qword [rbp + 0x70]
mov rdi, qword [r13]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140033769
cmp rax, qword [rdi - 0x18]
jne 0x140033769
lea rbx, [rdi - 0x18]
lock inc dword [rdi - 8]
jmp 0x1400337a7
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x140033785
call fcn.140001920
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
inc eax
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call qword [sym.imp.MSVCR100.dll_memcpy_s]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x50], rax
mov rdi, qword [r14]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1400337d5
cmp rax, qword [rdi - 0x18]
jne 0x1400337d5
lea rbx, [rdi - 0x18]
lock inc dword [rdi - 8]
jmp 0x140033813
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x1400337f1
call fcn.140001920
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
inc eax
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call qword [sym.imp.MSVCR100.dll_memcpy_s]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x38], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x40]
call fcn.140012630
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140033864
cmp rax, qword [rdi - 0x18]
jne 0x140033864
lea rbx, [rdi - 0x18]
lock inc dword [rdi - 8]
jmp 0x1400338a2
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x140033880
call fcn.140001920
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
inc eax
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call qword [sym.imp.MSVCR100.dll_memcpy_s]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x30], rax
mov r8d, dword [rsp + 0x44]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400124a0
test eax, eax
jne 0x1400338c6
jmp 0x140033ca1
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
mov r9d, 1
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140015dc0
test eax, eax
jne 0x140033966
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x140033953
mov rbx, qword [rsp + 0x78]
cmp rdi, rbx
je 0x14003394b
nop dword [rax + rax]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003393d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rdi, 8
cmp rdi, rbx
jne 0x140033920
mov rdi, qword [rsp + 0x70]
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
jmp 0x140033ca1
lea rdi, [rbp - 0x18]
xor eax, eax
mov ecx, reloc.ATL100.DLL_Ordinal_56
rep stosb byte [rdi], al
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x48], r15d
lea rdx, [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, dword [rsp + 0x48]
test eax, eax
jne 0x14003399a
test ecx, ecx
je 0x140033c14
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400ca8e8
mov r15, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140033c04
test r15, r15
je 0x140033c11
mov dword [rbp - 0x18], reloc.ATL100.DLL_Ordinal_56
mov qword [rbp - 0x10], r15
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x50]
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140033c04
lea rdx, [rbp - 0x18]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x140033c04
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140033c04
lea rcx, [rbp - 0x68]
call fcn.140006c20
nop
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x68]
call fcn.140006950
mov r12d, eax
test eax, eax
js 0x140033bf5
mov rdx, qword [rsp + 0x68]
cmp dword [rdx - 0x10], 0
je 0x140033bf5
lea rcx, [0x14011d880]
mov rdx, qword [0x14011d880]
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x60], rdi
xor r14d, r14d
mov rax, qword [rsp + 0x78]
sub rax, qword [rsp + 0x70]
sar rax, 3
test rax, rax
je 0x140033bcb
xor r13d, r13d
nop dword [rax]
mov rax, qword [rsp + 0x70]
mov rdx, qword [r13 + rax]
lea rcx, [rdx - 0x18]
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x140033af1
cmp dword [rbx + 0x10], 0
jl 0x140033ae0
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140033ae0
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140033ad6
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
add rdi, 0x18
mov qword [rbp - 0x60], rdi
jmp 0x140033af1
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x60]
call fcn.140001e80
mov rdi, qword [rbp - 0x60]
cmp dword [rdi - 0x10], 0
je 0x140033ba2
lea rdx, [0x1400e01d8]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
je 0x140033bc4
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x140033b70
cmp eax, 1
je 0x140033b70
lea rax, [rbp - 0x58]
mov qword [rbp - 0x28], rax
lea rcx, [rdi - 0x18]
call fcn.140001b90
add rax, 0x18
mov qword [rbp - 0x58], rax
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
call fcn.140001b90
add rax, 0x18
mov qword [rbp - 0x48], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x60]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x40]
call fcn.1400184b0
jmp 0x140033b92
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
call fcn.140001b90
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.140061320
test eax, eax
jne 0x140033bc4
test r12d, r12d
mov eax, 0x80004005
cmove r12d, eax
inc r14d
add r13, 8
mov rcx, qword [rsp + 0x78]
sub rcx, qword [rsp + 0x70]
sar rcx, 3
movsxd rax, r14d
cmp rax, rcx
jae 0x140033bc7
jmp 0x140033a90
xor r12d, r12d
mov r13, qword [rbp + 0x70]
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140033be6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp - 0x68]
call fcn.140006820
mov r14, qword [rbp + 0x68]
jmp 0x140033c04
mov r12d, 0x80004005
lea rcx, [rbp - 0x68]
call fcn.140006820
test r15, r15
je 0x140033c11
mov rcx, r15
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
xor r15d, r15d
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x140033c33
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140033c48
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140033c48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], r15
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x140033c93
mov rbx, qword [rsp + 0x78]
cmp rdi, rbx
je 0x140033c8b
nop dword [rax]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140033c7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rdi, 8
cmp rdi, rbx
jne 0x140033c60
mov rdi, qword [rsp + 0x70]
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
lea rcx, [rsp + 0x40]
call fcn.1400036a0
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140033ccc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140033cec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140033d0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140033d29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140033d45
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, r12d
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret