Function at 0x10006010
Capabilities:
Get user security identifier
Link many functions at runtime

Disassembly:
mov eax, 0x8064
call fcn.1000cf70
mov eax, dword [0x1003b040]
xor eax, esp
mov dword [esp + 0x8060], eax
mov eax, dword [esp + 0x8070]
push ebx
mov ebx, dword [esp + 0x806c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x8078]
push ebp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x8080]
push esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x8088]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x8090]
push str.advapi32.dll
mov dword [esp + 0x50], ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10006492
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ConvertSidToStringSidW
push eax
call edi
mov dword [esp + 0x30], eax
test eax, eax
je 0x10006492
push str.netapi32.dll
call fcn.10005f67
mov esi, eax
pop ecx
test esi, esi
je 0x10006492
push str.NetLocalGroupAdd
push esi
call edi
mov ebp, eax
test ebp, ebp
je 0x10006492
push str.NetLocalGroupGetInfo
push esi
call edi
mov dword [esp + 0x34], eax
test eax, eax
je 0x10006492
push str.NetApiBufferFree
push esi
call edi
mov dword [esp + 0x3c], eax
test eax, eax
je 0x10006492
push str.NetUserAdd
push esi
call edi
mov dword [esp + 0x44], eax
test eax, eax
je 0x10006492
push str.NetUserGetInfo
push esi
call edi
mov dword [esp + 0x28], eax
test eax, eax
je 0x10006492
push str.NetLocalGroupAddMembers
push esi
call edi
mov dword [esp + 0x2c], eax
test eax, eax
je 0x10006492
push dword [esp + 0x24]
xor eax, eax
push ebx
mov word [esp + 0x78], ax
call fcn.1000a99e
push dword [esp + 0x28]
mov dword [esp + 0x4c], eax
push ebx
call fcn.1000a99e
push dword [esp + 0x24]
mov dword [esp + 0x38], eax
push ebx
call fcn.1000a99e
push dword [esp + 0x34]
mov edi, eax
push ebx
mov dword [esp + 0x40], edi
call fcn.1000a99e
push dword [esp + 0x38]
mov esi, eax
push ebx
call fcn.1000a99e
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
xor ecx, ecx
add esp, 0x28
mov dword [esp + 0x48], eax
mov byte [esp + 0x13], cl
test esi, esi
je 0x1000621c
cmp byte [esp + 0x8094], cl
je 0x100061e5
push ecx
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push 1
push ecx
mov dword [esp + 0x44], esi
call ebp
mov edi, eax
test edi, edi
je 0x100061da
cmp edi, 0x8af
je 0x100061bc
cmp edi, 0x563
jne 0x100061c6
cmp byte [esp + 0x8098], 0
je 0x100061d8
push edi
push 1
lea eax, [esp + 0x78]
push str._d__d
push eax
call ebx
add esp, 0x10
test edi, edi
mov edi, dword [esp + 0x20]
sete byte [esp + 0x13]
jmp 0x1000621c
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push 1
push esi
push ecx
call dword [esp + 0x44]
test eax, eax
jne 0x1000620a
cmp dword [esp + 0x14], eax
je 0x1000621c
push dword [esp + 0x14]
call dword [esp + 0x40]
jmp 0x1000621c
push eax
push 6
lea eax, [esp + 0x78]
push str._d__d
push eax
call ebx
add esp, 0x10
lea eax, [esp + 0x70]
push eax
call fcn.10014ace
pop ecx
test eax, eax
jne 0x1000641e
mov eax, dword [esp + 0x40]
xor ecx, ecx
mov dword [esp + 0x50], eax
inc ecx
mov eax, dword [esp + 0x24]
xor ebp, ebp
mov dword [esp + 0x54], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x54]
mov dword [esp + 0x60], ecx
push eax
push ecx
push ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ebp
call dword [esp + 0x54]
test eax, eax
jne 0x10006408
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebp
push eax
push 0x17
push dword [esp + 0x58]
push ebp
call dword [esp + 0x38]
test eax, eax
jne 0x100063f4
test esi, esi
je 0x100062c6
mov eax, dword [esp + 0x18]
push 1
mov eax, dword [eax + 0x10]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
push ebp
push esi
push ebp
call dword [esp + 0x40]
test eax, eax
je 0x100062c6
cmp eax, 0x562
je 0x100062c6
push eax
push 4
lea eax, [esp + 0x78]
push str._d__d
push eax
call ebx
add esp, 0x10
lea eax, [esp + 0x70]
push eax
call fcn.10014ace
pop ecx
test eax, eax
jne 0x100063e3
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x10]
call ebp
cmp dword [esp + 0x14], 0
lea eax, [esp + 0x70]
je 0x100063d6
push dword [esp + 0x14]
push eax
call fcn.10014da6
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
pop ecx
pop ecx
test esi, esi
je 0x100063ce
mov eax, 0x2000
push eax
mov dword [esp + 0x30], eax
call fcn.1000cf9b
pop ecx
mov edi, eax
mov dword [esp + 0x30], 0x2000
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x4078]
push eax
lea eax, [esp + 0x38]
push eax
push edi
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x100063c0
and dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
push edi
call ebp
cmp dword [esp + 0x1c], 0
je 0x100063c0
mov ebp, 0x10023358
lea eax, [esp + 0x70]
push ebp
push eax
call fcn.10015481
push dword [esp + 0x24]
lea eax, [esp + 0x7c]
push eax
call fcn.10015481
lea eax, [esp + 0x80]
push ebp
push eax
call fcn.10015481
cmp byte [esp + 0x2b], 0
mov ecx, str.false
mov eax, 0x1002335c
cmove eax, ecx
push eax
lea eax, [esp + 0x8c]
push eax
call fcn.10015481
add esp, 0x20
push dword [esp + 0x1c]
call ebx
push 0
push edi
call fcn.1000cf4a
mov edi, dword [esp + 0x28]
pop ecx
pop ecx
push dword [esp + 0x14]
call ebx
jmp 0x100063e3
push 5
push 0x10023374
push eax
call ebx
add esp, 0xc
cmp dword [esp + 0x18], 0
je 0x1000641e
push dword [esp + 0x18]
call dword [esp + 0x40]
jmp 0x1000641e
push eax
push 3
lea eax, [esp + 0x78]
push str._d__d
push eax
call ebx
add esp, 0x10
jmp 0x1000641e
push dword [esp + 0x34]
push eax
push 2
lea eax, [esp + 0x7c]
push str._d__d__d
push eax
call ebx
add esp, 0x14
push 2
pop ebx
push ebx
push dword [esp + 0x44]
call fcn.1000cf4a
push ebx
push dword [esp + 0x30]
call fcn.1000cf4a
add esp, 0x10
test edi, edi
je 0x10006445
push ebx
push edi
call fcn.1000cf4a
pop ecx
pop ecx
test esi, esi
je 0x10006452
push ebx
push esi
call fcn.1000cf4a
pop ecx
pop ecx
mov eax, dword [esp + 0x48]
test eax, eax
je 0x10006463
push ebx
push eax
call fcn.1000cf4a
pop ecx
pop ecx
lea eax, [esp + 0x70]
push eax
call fcn.10014ace
pop ecx
test eax, eax
je 0x10006492
lea eax, [esp + 0x70]
push eax
call fcn.10014ace
mov edx, dword [esp + 0x50]
pop ecx
push eax
lea eax, [esp + 0x74]
mov ecx, dword [edx]
push eax
push edx
call dword [ecx + 0x28c]
jmp 0x10006494
xor eax, eax
mov ecx, dword [esp + 0x8070]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000cf58
add esp, 0x8064
ret 0x24