Function at 0x11308e0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x114792b
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [0x1161d94]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x234], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 0x218], bl
mov byte [ebp - 0x217], bl
mov byte [ebp - 0x216], bl
mov byte [ebp - 0x215], bl
mov byte [ebp - 0x214], bl
mov byte [ebp - 0x213], 5
mov byte [ebp - 0x220], bl
mov byte [ebp - 0x21f], bl
mov byte [ebp - 0x21e], bl
mov byte [ebp - 0x21d], bl
mov byte [ebp - 0x21c], bl
mov byte [ebp - 0x21b], 1
call eax
add eax, 0x10
mov dword [ebp - 0x228], eax
cmp edi, ebx
mov dword [ebp - 4], ebx
je 0x1130b7e
cmp esi, ebx
je 0x1130b7e
mov ecx, dword [ebp - 0x234]
xor esi, esi
push ecx
lea ecx, [ebp - 0x228]
mov dword [edi], 1
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], esi
call fcn.0107f660
mov edx, dword [ebp - 0x228]
push 0x106c280
push edx
call fcn.01128fcd
add esp, 8
test eax, eax
jne 0x1130a29
lea eax, [ebp - 0x218]
mov byte [ebp - 0x224], 2
lea ecx, [ebx + 0x20]
mov dword [ebp - 0x258], 0x220
cmp dword [edi], ebx
je 0x1130ab2
mov edx, dword [ebp - 0x230]
push edx
mov edx, dword [ebp - 0x258]
push esi
push esi
push esi
push esi
push esi
push esi
push edx
push ecx
mov ecx, dword [ebp - 0x224]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
jmp 0x1130b56
mov eax, dword [ebp - 0x228]
push 0x106c270
push eax
call fcn.01128fcd
add esp, 8
test eax, eax
jne 0x1130a55
lea eax, [ebp - 0x218]
mov byte [ebp - 0x224], 1
mov ecx, 0x12
jmp 0x11309f9
mov ecx, dword [ebp - 0x228]
push 0x106c258
push ecx
call fcn.01128fcd
add esp, 8
test eax, eax
jne 0x1130a84
lea eax, [ebp - 0x218]
mov byte [ebp - 0x224], 1
mov ecx, 4
jmp 0x11309f9
mov edx, dword [ebp - 0x228]
push 0x1064750
push edx
call fcn.01128fcd
add esp, 8
test eax, eax
jne 0x1130ab0
lea eax, [ebp - 0x220]
mov byte [ebp - 0x224], 1
xor ecx, ecx
jmp 0x11309f9
mov dword [edi], ebx
mov edi, dword [ebp - 0x234]
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [eax]
lea edx, [ebp - 0x22c]
push edx
push ecx
push edi
push ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x224], 0xff
call esi
cmp eax, ebx
jne 0x1130b85
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1130b5a
mov edx, dword [ebp - 0x22c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov ecx, dword [ebp - 0x230]
mov dword [ecx], eax
jne 0x1130b2b
mov esi, 0x8007000e
jmp 0x1130b8b
lea edx, [ebp - 0x238]
push edx
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x22c]
push ecx
push eax
push edi
push ebx
mov dword [ebp - 0x224], 0xff
call esi
cmp eax, ebx
jne 0x1130b85
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1130b6c
call esi
mov esi, eax
jmp 0x1130b8b
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1130b8b
mov esi, 0x80070057
jmp 0x1130b8b
mov esi, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1130bb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 0xc