Function at 0x14017cce0
Capabilities:
Get user security identifier
Manipulate user privileges

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x138
mov rax, qword [0x1408fa960]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x58], 0
mov r8d, reloc.msi.dll_MsiGetDatabaseState
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.140223e30
lea r9, [rsp + 0x58]
mov r8d, 0x810
lea rdx, [rsp + 0xd8]
xor ecx, ecx
call sub.ADVAPI32.dll_LsaOpenPolicy
mov rcx, qword [rsp + 0x140]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140]
cmp dword [rax], 0
jne 0x14017d042
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x148]
call fcn.14000c690
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x140]
add rax, 0x28
mov rcx, rax
call fcn.1400165c0
movzx eax, al
test eax, eax
je 0x14017cdbd
mov qword [rsp + 0x70], 0
jmp 0x14017cdd6
mov rax, qword [rsp + 0x140]
add rax, 0x28
mov rcx, rax
call fcn.14000c690
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x14017ce21
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14017cf3d
mov eax, dword [rsp + 0x40]
mov ecx, eax
call fcn.140222dcc
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.140223e30
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0xa0], rax
mov eax, 2
mov rcx, qword [rsp + 0xa0]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140222dcc
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x148]
call fcn.14000c690
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x140]
add rax, 0x28
mov rcx, rax
call fcn.1400165c0
movzx eax, al
test eax, eax
je 0x14017ced3
mov qword [rsp + 0x78], 0
jmp 0x14017ceec
mov rax, qword [rsp + 0x140]
add rax, 0x28
mov rcx, rax
call fcn.14000c690
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x14017cf3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x140]
mov dword [rcx], eax
jmp 0x14017cf4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x140]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140]
cmp dword [rax], 0
jne 0x14017d004
mov r8, qword [rsp + 0x150]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x140]
call fcn.140180260
movzx eax, byte [rsp + 0x158]
test eax, eax
je 0x14017cfb0
mov r9d, 1
lea r8, [rsp + 0x80]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, qword [rsp + 0x140]
mov dword [rcx], eax
jmp 0x14017cfdc
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x80]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call sub.ADVAPI32.dll_LsaRemoveAccountRights
mov rcx, qword [rsp + 0x140]
mov dword [rcx], eax
cmp qword [rsp + 0x88], 0
je 0x14017d004
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb8]
call fcn.140222778
mov rcx, qword [rsp + 0x58]
call sub.ADVAPI32.dll_LsaClose
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xc0], rax
mov rcx, qword [rsp + 0xc0]
call fcn.140222778
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140222778
mov rax, qword [rsp + 0x140]
cmp dword [rax], 0
je 0x14017d0b0
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov rcx, qword [rsp + 0x140]
mov dword [rcx], eax
mov rax, qword [rsp + 0x140]
mov edx, dword [rax]
lea rcx, [rsp + 0x108]
call fcn.1400f1950
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x140]
add rax, 8
mov rdx, qword [rsp + 0xd0]
mov rcx, rax
call fcn.14001e7a0
lea rcx, [rsp + 0x108]
call fcn.14000a800
mov rax, qword [rsp + 0x140]
cmp dword [rax], 0
jne 0x14017d0c7
mov dword [rsp + 0x50], 1
jmp 0x14017d0cf
mov dword [rsp + 0x50], 0
movzx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.140222a60
add rsp, 0x138
ret