Function at 0x4012c0
Capabilities:
Delete file
Get common file path
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x310
push ebx
mov bl, byte [esp + 0x318]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
test bl, bl
je 0x401388
push 0x4091bc
push str.Connecting_to__s...
call fcn.00401eac
push 0x4091bc
lea eax, [esp + 0x20]
push str._sADMIN_System32GETSIDSV.EXE
push eax
call fcn.00401edd
lea ecx, [esp + 0x28]
push ecx
push str.GETSIDSV
call fcn.00401180
add esp, 0x1c
test al, al
jne 0x40140a
call ebp
cmp eax, 5
je 0x401331
cmp eax, 0x52e
je 0x401331
cmp eax, 0x3e7
jne 0x401354
call fcn.00401240
test al, al
je 0x401354
lea edx, [esp + 0x14]
push edx
push str.GETSIDSV
call fcn.00401180
add esp, 8
test al, al
jne 0x40140a
call fcn.00401040
push 0x4091bc
push str._rCouldnt_access__s:_n
call fcn.00401eac
add esp, 8
call ebp
push eax
call fcn.00401000
add esp, 4
call fcn.00401200
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x310
ret
lea eax, [esp + 0x14]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._system32getsidsv.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.GETSIDSV
call fcn.00401180
add esp, 8
test al, al
jne 0x40140a
call fcn.00401040
push str._rCouldnt_retrieve_SID:_n
call fcn.00401eac
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401000
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x310
ret
call fcn.00401040
test bl, bl
je 0x401427
push 0x4091bc
push str._rStarting_psgetsid_service_on__s...
call fcn.00401eac
add esp, 8
jmp 0x401434
push str._rStarting_psgetsid_service...
call fcn.00401eac
add esp, 4
lea ecx, [esp + 0x14]
push str.__SystemRoot__System32GETSIDSV.EXE
push ecx
call fcn.00401edd
mov dl, bl
lea eax, [esp + 0x1c]
neg dl
sbb edx, edx
push eax
and edx, 0x4091bc
push str.GETSIDSV
mov edi, edx
push edi
call fcn.00401db0
add esp, 0x14
test eax, eax
jne 0x4014a0
call ebp
mov esi, eax
call fcn.00401040
test bl, bl
je 0x40148d
push 0x4091bc
push str._rCould_not_start_psgetsid_service_on__s:_n
call fcn.00401eac
add esp, 8
push esi
jmp 0x4015ed
push str._rCould_not_start_psgetsid_service._n
call fcn.00401eac
add esp, 4
push esi
jmp 0x4015ed
call fcn.00401040
push 0x4091bc
push str._rConnecting_with_psgetsid_service_on__s...
call fcn.00401eac
add esp, 8
mov eax, 0x4091bc
test bl, bl
jne 0x4014c5
mov eax, 0x408220
push eax
lea ecx, [esp + 0x220]
push str._spipegetsidsv
push ecx
call fcn.00401edd
add esp, 0xc
lea edx, [esp + 0x21c]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401537
call fcn.00401040
test bl, bl
je 0x401522
push 0x4091bc
push str._rError_establishing_communication_with_psgetsid_service_on__s:_n
call fcn.00401eac
add esp, 8
call ebp
push eax
jmp 0x4015ed
push str._rError_establishing_communication_with_psgetsid_service:_n
call fcn.00401eac
add esp, 4
call ebp
push eax
jmp 0x4015ed
call fcn.00401040
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x120]
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40157a
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x120]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4015ac
call fcn.00401040
test bl, bl
je 0x40159a
push 0x4091bc
push str._rError_communicating_with_psgetsid_service_on__s:_n
call fcn.00401eac
add esp, 8
call ebp
push eax
jmp 0x4015ed
push str._rError_communicating_with_psgetsid_service:_n
call fcn.00401eac
add esp, 4
call ebp
push eax
jmp 0x4015ed
mov eax, dword [esp + 0x118]
test eax, eax
je 0x40164c
call fcn.00401040
test bl, bl
je 0x4015d8
push 0x4091bc
push str._rError_getting_SID_for__s:_n
call fcn.00401eac
add esp, 8
jmp 0x4015e5
push str._rError_getting_system_SID:_n
call fcn.00401eac
add esp, 4
mov ecx, dword [esp + 0x118]
push ecx
call fcn.00401000
add esp, 4
push str.GETSIDSV
push edi
call fcn.00401e60
add esp, 8
test bl, bl
je 0x40161e
push 0x4091bc
lea edx, [esp + 0x18]
push str._sADMIN_System32GETSIDSV.EXE
push edx
call fcn.00401edd
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, bl
je 0x401632
call fcn.00401200
push 0x4080f0
call fcn.00401eac
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x310
ret
call fcn.00401040
test bl, bl
je 0x401667
push 0x4091bc
push str._rSID_for__s:_n
call fcn.00401eac
add esp, 8
lea ecx, [esp + 0x11c]
push ecx
push str._r_s_n_n
call fcn.00401eac
call fcn.00401040
push str.GETSIDSV
push edi
call fcn.00401e60
add esp, 0x10
test bl, bl
je 0x4016a7
push 0x4091bc
lea edx, [esp + 0x18]
push str._sADMIN_System32GETSIDSV.EXE
push edx
call fcn.00401edd
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, bl
je 0x4016bb
call fcn.00401200
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x310
ret