Function at 0x1400a9b44
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor esi, esi
lea rdi, [0x14014dd40]
mov r15, r9
mov r12, r8
mov r13, rdx
mov r14, rcx
test rcx, rcx
je 0x1400a9d1f
test rdx, rdx
je 0x1400a9d1f
test r8, r8
je 0x1400a9d1f
test r9, r9
je 0x1400a9d1f
and dword [rbp - 0x30], esi
lea r8d, [rsi + 0x28]
xor edx, edx
lea rcx, [rbp - 0x28]
call sub.msvcrt.dll_memset
and qword [rbp - 0x50], rsi
lea r9, [rbp - 0x50]
mov r8d, 0x800
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400a9cab
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x50]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x48]
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400a9ca1
mov rcx, qword [rbp + 0x30]
mov eax, dword [rcx]
sub eax, 7
cmp eax, 1
jbe 0x1400a9c88
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1400a9c81
mov r8, qword [rbp + 0x30]
mov rdx, rax
mov ecx, ebx
mov r8, qword [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1400a9c67
mov rsi, rdi
xor edi, edi
xor ebx, ebx
jmp 0x1400a9c6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdi, [0x14014dd40]
jmp 0x1400a9c8d
mov ebx, 0x8007000e
jmp 0x1400a9c78
mov ebx, 0x80004005
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
test ebx, ebx
jns 0x1400a9ce5
mov rcx, qword [0x14014dd40]
cmp rcx, rdi
je 0x1400a9d2b
test byte [rcx + 0x1c], 2
je 0x1400a9d2b
cmp byte [rcx + 0x19], 2
jb 0x1400a9d2b
mov edx, 0x31
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x140127178]
mov r9, r14
call fcn.1400056b0
jmp 0x1400a9d24
mov r9, r15
mov r8, rsi
mov rdx, r12
mov rcx, r13
call fcn.1400a9d9c
mov ebx, eax
test eax, eax
jns 0x1400a9d24
mov rcx, qword [0x14014dd40]
cmp rcx, rdi
je 0x1400a9d2b
test byte [rcx + 0x1c], 2
je 0x1400a9d2b
cmp byte [rcx + 0x19], 2
jb 0x1400a9d2b
mov edx, 0x32
mov dword [rsp + 0x20], eax
jmp 0x1400a9cd0
mov ebx, 0x80004003
mov rcx, qword [0x14014dd40]
test rsi, rsi
je 0x1400a9d40
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14014dd40]
test ebx, ebx
jns 0x1400a9d71
cmp rcx, rdi
je 0x1400a9d71
test byte [rcx + 0x1c], 2
je 0x1400a9d71
cmp byte [rcx + 0x19], 2
jb 0x1400a9d71
mov rcx, qword [rcx + 0x10]
lea r8, [0x140127178]
mov edx, 0x33
mov dword [rsp + 0x20], ebx
mov r9, r14
call fcn.1400056b0
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret