Function at 0x14000b1b0
Capabilities:
Get session information
Get user security identifier

Disassembly:
push rbp
push rdi
push r12
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.140032a60
sub rsp, rax
mov rax, qword [0x140061148]
xor rax, rsp
mov qword [rbp + 0xf50], rax
xorps xmm0, xmm0
mov qword [rsp + 0x1068], r14
xor edi, edi
mov dword [rsp + 0x5c], 0x44
mov r12, rcx
mov qword [rsp + 0x48], rdi
xor eax, eax
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x60], eax
xor edx, edx
mov r8d, 0xfa0
mov r14d, edi
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 0x7cf
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov edx, 0xffffffff
mov dword [rsp + 0x54], 8
xor ecx, ecx
mov qword [rsp + 0x40], rdi
lea r8d, [rdi + 0x18]
mov qword [r12], rdi
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14000b3bf
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000b3bf
cmp dword [rsp + 0x50], 0xd8
jb 0x14000b3bf
lea rdx, [rcx + 0x82]
add rcx, 0x60
call fcn.14000b420
mov r14, rax
test rax, rax
je 0x14000b3bf
lea rax, [rsp + 0x54]
mov rdx, r14
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x5c]
lea rax, [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x60]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x14000b3bf
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x14000b3bf
mov qword [rsp + 0x1098], rbx
mov qword [rsp + 0x1060], r15
mov r15, qword [rsp + 0x40]
test r15, r15
jne 0x14000b313
mov ebx, edi
jmp 0x14000b3ab
mov rcx, qword [rsp + 0x40]
mov edx, 0x10000
mov qword [rsp + 0x10a0], rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rsi, rax
cmp rax, 0x10000
jb 0x14000b33b
mov rbx, rdi
jmp 0x14000b3a3
lea rcx, [rax + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14000b368
mov rbx, rdi
jmp 0x14000b3a3
add rsi, rsi
lea r8, [rsi + 2]
je 0x14000b39f
mov rcx, rbx
cmp r8, rsi
jb 0x14000b386
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14000b39f
xor edx, edx
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov word [rsi + rbx], di
mov rsi, qword [rsp + 0x10a0]
mov r15, qword [rsp + 0x1060]
mov qword [r12], rbx
mov rbx, qword [rsp + 0x1098]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000b3cf
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14, r14
je 0x14000b3dd
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x1068]
test rcx, rcx
je 0x14000b3f5
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp qword [r12], rdi
setne dil
mov eax, edi
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.1400325f0
add rsp, 0x1070
pop r12
pop rdi
pop rbp
ret