Function at 0x5f24b0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f2e0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x32], 0
lea eax, [ebp - 0x38]
call fcn.00406ed8
mov byte [ebp - 0x39], 0
mov dword [ebp - 0x1c], 8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x44], eax
push 0x5f2e1c
call sub.kernel32.dll_GetModuleHandleW_2
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x5f2512
push 0x5f2e1c
call sub.kernel32.dll_LoadLibraryW
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x5f2df7
push 0x5f2e38
mov eax, dword [ebp - 0x44]
push eax
call fcn.0040e438
mov dword [ebp - 0x48], eax
push 0x5f2e64
mov eax, dword [ebp - 0x44]
push eax
call fcn.0040e438
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x48], 0
je 0x5f2df7
cmp dword [ebp - 0x4c], 0
je 0x5f2df7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408cd8
dec eax
test eax, eax
jl 0x5f2cd2
inc eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 4]
cmp eax, 7
ja case.0x5f2588.5
jmp dword [eax*4 + 0x5f258f]
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
mov dword [ebp - 0x20], 1
mov eax, 0x5f2e90
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
call fcn.004073f0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8]
call fcn.00407ac0
push eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 8]
push eax
call sub.advapi32.dll_LookupAccountNameW
mov eax, dword [ebp - 0x20]
call fcn.004046d8
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x2c]
mov dword [edx + eax*8 + 0x14], ecx
mov eax, dword [ebp - 0x24]
call fcn.004046d8
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8]
call fcn.00407ac0
push eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 8]
push eax
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x5f26b8
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
call sub.advapi32.dll_GetLengthSid
add eax, 8
add dword [ebp - 0x1c], eax
jmp case.0x5f2588.5
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
jmp case.0x5f2588.5
mov eax, dword [0x6d106c]
mov edx, dword [eax]
mov dword [ebp - 0x12], edx
mov dx, word [eax + 4]
mov word [ebp - 0xe], dx
mov byte [ebp - 0x51], 1
xor eax, eax
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x70], eax
xor eax, eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea eax, [edx + eax*8 + 0x14]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x70]
push eax
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov al, byte [ebp - 0x51]
push eax
lea eax, [ebp - 0x12]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x5f2780
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
call sub.advapi32.dll_GetLengthSid
mov edx, dword [ebp - 0x1c]
add edx, 0xc
sub edx, 4
add eax, edx
mov dword [ebp - 0x1c], eax
jmp case.0x5f2588.5
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
jmp case.0x5f2588.5
mov eax, dword [0x6d0b78]
mov edx, dword [eax]
mov dword [ebp - 0x12], edx
mov dx, word [eax + 4]
mov word [ebp - 0xe], dx
mov byte [ebp - 0x7d], 2
mov dword [ebp - 0x84], 0x20
mov dword [ebp - 0x88], 0x221
xor eax, eax
mov dword [ebp - 0x8c], eax
xor eax, eax
mov dword [ebp - 0x90], eax
xor eax, eax
mov dword [ebp - 0x94], eax
xor eax, eax
mov dword [ebp - 0x98], eax
xor eax, eax
mov dword [ebp - 0x9c], eax
xor eax, eax
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea eax, [edx + eax*8 + 0x14]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
push eax
mov eax, dword [ebp - 0xa0]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov al, byte [ebp - 0x7d]
push eax
lea eax, [ebp - 0x12]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x5f2888
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
call sub.advapi32.dll_GetLengthSid
mov edx, dword [ebp - 0x1c]
add edx, 0xc
sub edx, 4
add eax, edx
mov dword [ebp - 0x1c], eax
jmp case.0x5f2588.5
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
jmp case.0x5f2588.5
mov eax, dword [0x6d10e0]
mov edx, dword [eax]
mov dword [ebp - 0x12], edx
mov dx, word [eax + 4]
mov word [ebp - 0xe], dx
mov byte [ebp - 0xa9], 1
xor eax, eax
mov dword [ebp - 0xb0], eax
xor eax, eax
mov dword [ebp - 0xb4], eax
xor eax, eax
mov dword [ebp - 0xb8], eax
xor eax, eax
mov dword [ebp - 0xbc], eax
xor eax, eax
mov dword [ebp - 0xc0], eax
xor eax, eax
mov dword [ebp - 0xc4], eax
xor eax, eax
mov dword [ebp - 0xc8], eax
xor eax, eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea eax, [edx + eax*8 + 0x14]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
push eax
mov eax, dword [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0xc8]
push eax
mov eax, dword [ebp - 0xc4]
push eax
mov eax, dword [ebp - 0xc0]
push eax
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0xb4]
push eax
mov eax, dword [ebp - 0xb0]
push eax
mov al, byte [ebp - 0xa9]
push eax
lea eax, [ebp - 0x12]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x5f2992
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
call sub.advapi32.dll_GetLengthSid
mov edx, dword [ebp - 0x1c]
add edx, 0xc
sub edx, 4
add eax, edx
mov dword [ebp - 0x1c], eax
jmp case.0x5f2588.5
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
jmp case.0x5f2588.5
mov eax, dword [0x6d10e0]
mov edx, dword [eax]
mov dword [ebp - 0x12], edx
mov dx, word [eax + 4]
mov word [ebp - 0xe], dx
mov byte [ebp - 0xd5], 1
mov dword [ebp - 0xdc], 1
xor eax, eax
mov dword [ebp - 0xe0], eax
xor eax, eax
mov dword [ebp - 0xe4], eax
xor eax, eax
mov dword [ebp - 0xe8], eax
xor eax, eax
mov dword [ebp - 0xec], eax
xor eax, eax
mov dword [ebp - 0xf0], eax
xor eax, eax
mov dword [ebp - 0xf4], eax
xor eax, eax
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea eax, [edx + eax*8 + 0x14]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
push eax
mov eax, dword [ebp - 0xf8]
push eax
mov eax, dword [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0xec]
push eax
mov eax, dword [ebp - 0xe8]
push eax
mov eax, dword [ebp - 0xe4]
push eax
mov eax, dword [ebp - 0xe0]
push eax
mov eax, dword [ebp - 0xdc]
push eax
mov al, byte [ebp - 0xd5]
push eax
lea eax, [ebp - 0x12]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
je 0x5f2a9e
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
call sub.advapi32.dll_GetLengthSid
mov edx, dword [ebp - 0x1c]
add edx, 0xc
sub edx, 4
add eax, edx
mov dword [ebp - 0x1c], eax
jmp case.0x5f2588.5
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
jmp case.0x5f2588.5
mov eax, dword [0x6d0b78]
mov edx, dword [eax]
mov dword [ebp - 0x12], edx
mov dx, word [eax + 4]
mov word [ebp - 0xe], dx
mov byte [ebp - 0x101], 2
mov dword [ebp - 0x108], 0x20
mov dword [ebp - 0x10c], 0x220
xor eax, eax
mov dword [ebp - 0x110], eax
xor eax, eax
mov dword [ebp - 0x114], eax
xor eax, eax
mov dword [ebp - 0x118], eax
xor eax, eax
mov dword [ebp - 0x11c], eax
xor eax, eax
mov dword [ebp - 0x120], eax
xor eax, eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea eax, [edx + eax*8 + 0x14]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
push eax
mov eax, dword [ebp - 0x124]
push eax
mov eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0x108]
push eax
mov al, byte [ebp - 0x101]
push eax
lea eax, [ebp - 0x12]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x5f2bac
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
call sub.advapi32.dll_GetLengthSid
mov edx, dword [ebp - 0x1c]
add edx, 0xc
sub edx, 4
add eax, edx
mov dword [ebp - 0x1c], eax
jmp case.0x5f2588.5
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
jmp case.0x5f2588.5
mov eax, dword [0x6d0b78]
mov edx, dword [eax]
mov dword [ebp - 0x12], edx
mov dx, word [eax + 4]
mov word [ebp - 0xe], dx
mov byte [ebp - 0x12d], 1
mov dword [ebp - 0x134], 0x12
xor eax, eax
mov dword [ebp - 0x138], eax
xor eax, eax
mov dword [ebp - 0x13c], eax
xor eax, eax
mov dword [ebp - 0x140], eax
xor eax, eax
mov dword [ebp - 0x144], eax
xor eax, eax
mov dword [ebp - 0x148], eax
xor eax, eax
mov dword [ebp - 0x14c], eax
xor eax, eax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea eax, [edx + eax*8 + 0x14]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
push eax
mov eax, dword [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x13c]
push eax
mov eax, dword [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x134]
push eax
mov al, byte [ebp - 0x12d]
push eax
lea eax, [ebp - 0x12]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
je 0x5f2cb5
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
call sub.advapi32.dll_GetLengthSid
mov edx, dword [ebp - 0x1c]
add edx, 0xc
sub edx, 4
add eax, edx
mov dword [ebp - 0x1c], eax
jmp case.0x5f2588.5
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
inc dword [ebp - 0x40]
dec dword [ebp - 0x50]
jne 0x5f2570
mov eax, dword [ebp - 0x1c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebp - 0xc], eax
push 2
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_InitializeAcl
test eax, eax
je 0x5f2da5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408cd8
dec eax
test eax, eax
jl 0x5f2da5
inc eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax*8 + 0x10], 0
je 0x5f2d61
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0xc]
push eax
push 3
push 2
mov eax, dword [ebp - 0xc]
push eax
call dword [ebp - 0x48]
test eax, eax
jne 0x5f2d99
call sub.kernel32.dll_GetLastError_2
mov word [ebp - 0x32], ax
jmp 0x5f2d99
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0x14]
push eax
mov eax, dword [ebp - 0x40]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [edx + eax*8 + 0xc]
push eax
push 3
push 2
mov eax, dword [ebp - 0xc]
push eax
call dword [ebp - 0x4c]
test eax, eax
jne 0x5f2d99
call sub.kernel32.dll_GetLastError_2
mov word [ebp - 0x32], ax
inc dword [ebp - 0x40]
dec dword [ebp - 0x50]
jne 0x5f2d15
cmp word [ebp - 0x32], 0
jne 0x5f2de8
push 0x14
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebp - 8], eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x39], al
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x39], al
jmp 0x5f2dec
mov byte [ebp - 0x39], 0
cmp byte [ebp - 0x39], 0
jne 0x5f2df7
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2e14
lea eax, [ebp - 0x38]
call fcn.00406ed8
ret