Function at 0x18000116c
Capabilities:
Get user security identifier

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x4090
call fcn.18001b110
sub rsp, rax
mov rax, qword [0x1800300d0]
xor rax, rsp
mov qword [rsp + 0x4080], rax
mov rbp, qword [rsp + 0x4118]
neg r9b
mov eax, 0x80000000
sbb r12d, r12d
xor r15d, r15d
mov r14, r8
and r12d, 3
cmp byte [rsp + 0x40f0], r15b
mov edi, r15d
cmovne edi, eax
mov r13, rcx
cmp byte [rsp + 0x40f8], r15b
je 0x1800011d3
bts edi, 0x1e
cmp byte [rsp + 0x4100], r15b
je 0x1800011e1
bts edi, 0x1d
cmp byte [rsp + 0x4108], r15b
je 0x1800011ef
bts edi, 0x1c
cmp dword [rsp + 0x4110], 3
mov qword [rsp + 0x60], r15
jne 0x1800012c3
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
cmp rax, r15
je 0x1800013a9
mov rdx, rbp
mov rcx, r13
call fcn.18000cb74
lea rdx, str.ConvertStringSidToSidW
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x1800012b6
lea rdx, [rsp + 0x60]
mov rcx, rbp
call rax
cmp eax, r15d
jne 0x1800012b6
mov ebx, 0x2000
mov ecx, 0x40
mov rdx, rbx
mov dword [rsp + 0x6c], ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea rcx, [rsp + 0x74]
lea r9, [rsp + 0x6c]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x68]
mov rdx, rbp
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x80]
mov r8, rax
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp eax, r15d
jne 0x1800012b6
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x60], r15
mov rcx, rbp
call fcn.18000fc44
jmp 0x1800013a9
cmp dword [rsp + 0x4110], 5
mov byte [rsp + 0x74], r15b
mov byte [rsp + 0x75], r15b
mov byte [rsp + 0x76], r15b
mov byte [rsp + 0x77], r15b
mov byte [rsp + 0x78], r15b
mov byte [rsp + 0x79], 1
mov r8d, r15d
jne 0x180001329
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x74]
mov r8d, 6
mov byte [rsp + 0x6c], r15b
mov byte [rsp + 0x6d], r15b
mov byte [rsp + 0x6e], r15b
mov byte [rsp + 0x6f], r15b
mov byte [rsp + 0x70], r15b
mov byte [rsp + 0x71], 2
call fcn.18000f910
mov r8d, 0x223
jmp 0x18000136c
cmp dword [rsp + 0x4110], 1
jne 0x18000136c
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x74]
mov r8d, 6
mov byte [rsp + 0x6c], r15b
mov byte [rsp + 0x6d], r15b
mov byte [rsp + 0x6e], r15b
mov byte [rsp + 0x6f], r15b
mov byte [rsp + 0x70], r15b
mov byte [rsp + 0x71], 5
call fcn.18000f910
mov r8d, 0xb
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0x74]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dl, 1
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r15d
je 0x180001414
cmp qword [rsp + 0x60], r15
je 0x180001414
mov rdx, r14
mov rcx, r13
call fcn.18000cb74
mov r8, qword [rsp + 0x60]
lea edx, [r12 + 1]
mov rcx, rax
mov r9d, edi
mov dword [rsp + 0x28], 3
mov rbx, rax
mov dword [rsp + 0x20], 1
call section..text
cmp eax, r15d
mov rcx, rbx
sete dil
call fcn.18000fc44
cmp dword [rsp + 0x4110], 3
mov rcx, qword [rsp + 0x60]
jne 0x180001409
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000140f
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, dil
jmp 0x180001416
xor al, al
mov rcx, qword [rsp + 0x4080]
xor rcx, rsp
call fcn.18000fc60
add rsp, 0x4090
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret