Function at 0x1402469b0
Capabilities:
Get user security identifier

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, r8
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov dword [rbp - 0x65], r12d
mov dword [rbp - 0x69], r12d
lea rax, [rbp - 0x41]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x65]
xor r8d, r8d
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140246d43
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x7a
je 0x140246a95
call fcn.1400a4e1c
cmp dword [rax], 3
jbe 0x140246a81
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x61], ebx
lea rcx, str.Failed_to_query_sid___first_call_to_LookupAccountName_failed_with_unexpected_error_code
mov qword [rbp - 0x71], rcx
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1403f2e5e]
mov rcx, rax
call fcn.14000e518
test ebx, ebx
jle 0x140246a8e
movzx ebx, bx
or ebx, 0x80070000
mov eax, ebx
jmp 0x140246d75
mov eax, dword [rbp - 0x65]
test eax, eax
je 0x140246d0f
cmp dword [rbp - 0x69], r12d
je 0x140246d0f
mov byte [rbp - 0x79], r12b
mov ebx, eax
mov rsi, qword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, rsi
sub rcx, rdx
cmp rax, rcx
jae 0x140246ac7
add rax, rdx
jmp 0x140246afa
jbe 0x140246afe
mov rax, qword [rdi + 0x10]
sub rax, rdx
cmp rbx, rax
jbe 0x140246ae6
lea r8, [rbp - 0x79]
mov rdx, rbx
mov rcx, rdi
call fcn.140085758
jmp 0x140246afe
sub rbx, rcx
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rbx + rsi]
mov qword [rdi + 8], rax
mov edx, dword [rbp - 0x69]
lea rcx, [rbp - 0x39]
call fcn.140094660
nop
lea rax, [rbp - 0x41]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x65]
mov r8, qword [rdi]
mov rdx, r14
mov rcx, r15
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140246bba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.1400a4e1c
cmp dword [rax], 3
jbe 0x140246ba4
mov qword [rbp - 0x71], r14
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x61], ebx
lea rcx, str.Failed_to_query_sid___second_call_to_LookupAccountName_failed.
mov qword [rbp - 0x59], rcx
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1403f2e5e]
mov rcx, rax
call fcn.14000e518
test ebx, ebx
jle 0x140246c54
movzx ebx, bx
or ebx, 0x80070000
jmp 0x140246c54
mov qword [rbp - 0x49], r12
lea rax, [rbp - 0x49]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], r12
mov byte [rbp - 0x11], 1
lea rdx, [rbp - 0x19]
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
sete bl
lea rcx, [rbp - 0x21]
call fcn.1400afde0
test bl, bl
je 0x140246c62
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.1400a4e1c
cmp dword [rax], 3
jbe 0x140246c3d
mov dword [rbp - 0x61], ebx
lea rcx, str.Failed_to_query_sid___converting_sid_to_string_failed
mov qword [rbp - 0x71], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
lea rdx, [0x1403f2f01]
mov rcx, rax
call fcn.1400061e0
test ebx, ebx
jle 0x140246c4a
movzx ebx, bx
or ebx, 0x80070000
lea rcx, [rbp - 0x49]
call fcn.140102f84
nop
lea rcx, [rbp - 0x39]
call fcn.140106354
jmp 0x140246a8e
movdqa xmm0, xmmword [0x1403600d0]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r12w
mov r8, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x39]
lea rcx, [rbp - 9]
call fcn.14006dc6c
call fcn.1400a4e1c
cmp dword [rax], 5
jbe 0x140246ceb
mov rcx, qword [rbp - 0x49]
mov qword [rbp - 0x71], rcx
mov qword [rbp - 0x51], r14
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
mov qword [rbp - 0x59], rcx
lea rcx, str.Sid_successfully_retrieved
mov qword [rbp - 0x61], rcx
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1403f2f30]
mov rcx, rax
call fcn.140001770
lea rcx, [rbp - 9]
call fcn.14007a7c0
nop
lea rcx, [rbp - 0x49]
call fcn.140102f84
nop
lea rcx, [rbp - 0x39]
call fcn.140106354
mov eax, 0x7a
jmp 0x140246d75
call fcn.1400a4e1c
cmp dword [rax], 3
jbe 0x140246d3c
lea rcx, str.Failed_to_query_sid___sid_or_domain_size_is_0
mov qword [rbp - 0x71], rcx
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1403f25c8]
mov rcx, rax
call fcn.140005fc4
mov eax, 0x80070452
jmp 0x140246d75
call fcn.1400a4e1c
cmp dword [rax], 3
jbe 0x140246d70
lea rcx, str.Failed_to_query_sid___calling_LookupAccountName_for_the_first_time_should_return_false
mov qword [rbp - 0x71], rcx
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1403f25c8]
mov rcx, rax
call fcn.140005fc4
mov eax, 0x80004005
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140123570
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret