Function at 0x1400126a0
Capabilities:
Get user security identifier

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xff0]
mov eax, 0x10f0
call fcn.14005f060
sub rsp, rax
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x1130], rbx
mov rax, qword [0x1401385c0]
xor rax, rsp
mov qword [rbp + 0xfe0], rax
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov dword [rbp + 0xfb0], r15d
mov dword [rbp + 0xfb8], 0x44
mov dword [rbp + 0xfb4], 8
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov dword [rcx + 0x40], eax
lea rcx, [rsp + 0x48]
call fcn.1400029b0
nop
mov ebx, 2
mov dword [rsp + 0x40], ebx
cmp qword [rax + 0x18], 8
jb 0x140012749
mov rax, qword [rax]
lea rcx, [rbp + 0xfb4]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xfb0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xfb8]
mov r8, rdi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x14001278f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14001278f
mov sil, 1
jmp 0x140012792
xor sil, sil
and ebx, 0xfffffffd
mov dword [rsp + 0x40], ebx
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x1400127b6
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140003f50
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
test bl, 1
je 0x140012805
and ebx, 0xfffffffe
mov dword [rsp + 0x40], ebx
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x1400127f2
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140003f50
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r15
mov word [rsp + 0x68], r15w
test sil, sil
je 0x140012859
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.140002960
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140012824
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, str.null
lea rdx, str.Could_not_create_security_identifier_from_account_lookup__size_query_with_system__s_and_account__s_failed___i_.
lea rcx, [rbp - 0x70]
call fcn.140005290
lea rdx, [0x140135110]
lea rcx, [rbp - 0x70]
call fcn.140060304
nop
mov edx, dword [rbp + 0xfb0]
mov qword [rbp + 0xfd0], r15
mov qword [rbp + 0xfd8], r15
mov qword [rbp + 0xfd8], 7
mov qword [rbp + 0xfd0], r15
mov word [rbp + 0xfc0], r15w
xor r8d, r8d
lea rcx, [rbp + 0xfc0]
call fcn.1400031b0
nop
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.1400029b0
nop
lea rcx, [rbp + 0xfc0]
cmp qword [rbp + 0xfd8], 8
cmovae rcx, qword [rbp + 0xfc0]
cmp qword [rax + 0x18], 8
jb 0x1400128c6
mov rax, qword [rax]
lea rdx, [rbp + 0xfb4]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp + 0xfb0]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0xfb8]
mov r8, rdi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
sete sil
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14001291b
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140003f50
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
test bl, 8
je 0x14001296a
and ebx, 0xfffffff7
mov dword [rsp + 0x40], ebx
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x140012957
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140003f50
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r15
mov word [rsp + 0x68], r15w
test sil, sil
je 0x1400129be
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.140002960
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140012989
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, str.null
lea rdx, str.Could_not_create_security_identifier_from_account_lookup_with_system__s_and_account__s___i_.
lea rcx, [rbp - 0x70]
call fcn.140005290
lea rdx, [0x140135110]
lea rcx, [rbp - 0x70]
call fcn.140060304
nop
mov r8, qword [rbp + 0xfd8]
cmp r8, 8
jb 0x1400129e1
inc r8
mov rdx, qword [rbp + 0xfc0]
lea rcx, [rbp + 0xfc0]
call fcn.140003f50
mov qword [rbp + 0xfd8], 7
mov qword [rbp + 0xfd0], r15
mov word [rbp + 0xfc0], r15w
mov rax, rdi
mov rcx, qword [rbp + 0xfe0]
xor rcx, rsp
call fcn.14005f0d0
mov rbx, qword [rsp + 0x1130]
add rsp, 0x10f0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret