Function at 0x1400a194c
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor esi, esi
lea rdi, [0x140106190]
mov r15, r9
mov r12, r8
mov r13, rdx
mov r14, rcx
test rcx, rcx
je 0x1400a1b27
test rdx, rdx
je 0x1400a1b27
test r8, r8
je 0x1400a1b27
test r9, r9
je 0x1400a1b27
and dword [rbp - 0x30], esi
lea r8d, [rsi + 0x28]
xor edx, edx
lea rcx, [rbp - 0x28]
call sub.msvcrt.dll_memset
and qword [rbp - 0x50], rsi
lea r9, [rbp - 0x50]
mov r8d, 0x800
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400a1ab3
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x50]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x48]
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400a1aa9
mov rcx, qword [rbp + 0x30]
mov eax, dword [rcx]
sub eax, 7
cmp eax, 1
jbe 0x1400a1a90
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1400a1a89
mov r8, qword [rbp + 0x30]
mov rdx, rax
mov ecx, ebx
mov r8, qword [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1400a1a6f
mov rsi, rdi
xor edi, edi
xor ebx, ebx
jmp 0x1400a1a77
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdi, [0x140106190]
jmp 0x1400a1a95
mov ebx, 0x8007000e
jmp 0x1400a1a80
mov ebx, 0x80004005
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
test ebx, ebx
jns 0x1400a1aed
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400a1b33
test byte [rcx + 0x1c], 2
je 0x1400a1b33
cmp byte [rcx + 0x19], 2
jb 0x1400a1b33
mov edx, 0x31
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e76f8]
mov r9, r14
call fcn.14000541c
jmp 0x1400a1b2c
mov r9, r15
mov r8, rsi
mov rdx, r12
mov rcx, r13
call fcn.1400a1ba4
mov ebx, eax
test eax, eax
jns 0x1400a1b2c
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400a1b33
test byte [rcx + 0x1c], 2
je 0x1400a1b33
cmp byte [rcx + 0x19], 2
jb 0x1400a1b33
mov edx, 0x32
mov dword [rsp + 0x20], eax
jmp 0x1400a1ad8
mov ebx, 0x80004003
mov rcx, qword [0x140106190]
test rsi, rsi
je 0x1400a1b48
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x140106190]
test ebx, ebx
jns 0x1400a1b79
cmp rcx, rdi
je 0x1400a1b79
test byte [rcx + 0x1c], 2
je 0x1400a1b79
cmp byte [rcx + 0x19], 2
jb 0x1400a1b79
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e76f8]
mov edx, 0x33
mov dword [rsp + 0x20], ebx
mov r9, r14
call fcn.14000541c
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret