Function at 0x104095b0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10470a20
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x11d0bb24
mov dword [ebp - 0x288], 0x11d0bb24
mov byte [ebp - 0x284], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x11d0bb40], 0
mov dword [ebp - 4], 0
jne 0x10409a8b
cmp dword [0x11d0bb44], 0
jne 0x10409978
mov eax, dword [0x11d0bb3c]
test eax, eax
jne 0x1040963a
push 0x10467e60
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x11d0bb3c], eax
test eax, eax
je 0x10409a82
mov ecx, dword [0x11d0bb70]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test ecx, ecx
jne 0x10409667
push 0x10467e80
push eax
call esi
mov ecx, eax
mov dword [0x11d0bb70], ecx
test ecx, ecx
je 0x10409a82
mov eax, dword [0x11d0bb3c]
cmp dword [0x11d0bb74], 0
jne 0x1040968b
push 0x10467ea0
push eax
call esi
mov dword [0x11d0bb74], eax
test eax, eax
je 0x10409a82
mov ecx, dword [0x11d0bb70]
lea eax, [ebp - 0x278]
mov dword [ebp - 0x270], 0
push eax
lea eax, [ebp - 0x270]
mov dword [ebp - 0x278], 0
push eax
push 5
push 0xffffffffffffffff
push 0
call ecx
test eax, eax
jne 0x104096d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10467eb0
call fcn.102fb670
add esp, 8
mov byte [ebp - 0x269], 0
jmp 0x10409a92
mov esi, dword [ebp - 0x270]
cmp word [esi], 0
jne 0x104096f8
push esi
call dword [0x11d0bb74]
mov byte [ebp - 0x269], 0
jmp 0x10409a92
push 0xa0
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.10425c00
push 0x50
lea eax, [ebp - 0x60]
mov dword [ebp - 0x27c], 0x50
push 0
push eax
call fcn.10425c00
add esp, 0x18
mov dword [ebp - 0x280], 7
lea eax, [ebp - 0x280]
mov dword [ebp - 0x278], 0x50
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push dword [ebp - 0x270]
mov esi, eax
call dword [0x11d0bb74]
mov dword [ebp - 0x270], 0
test esi, esi
jne 0x1040979e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10467ed0
call fcn.102fb670
add esp, 8
mov byte [ebp - 0x269], 0
jmp 0x10409a92
push 0x11d0bb48
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x104097d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10467f00
call fcn.102fb670
add esp, 8
mov byte [ebp - 0x269], 0
jmp 0x10409a92
movaps xmm0, xmmword [0x10f164f0]
lea eax, [ebp - 0x60]
push 0x78
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x150]
push 0
push eax
mov dword [ebp - 0x2c8], 0x1fffff
mov dword [ebp - 0x2c4], 2
mov dword [ebp - 0x2c0], 0
movups xmmword [ebp - 0x2bc], xmm0
mov dword [ebp - 0x274], 0
call fcn.10425c00
push dword [0x11d0bb48]
lea eax, [ebp - 0x150]
push 0x10467f30
push 0x3c
push eax
call fcn.100086c0
add esp, 0x1c
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x150]
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x10409876
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10467f50
call fcn.102fb670
add esp, 8
mov byte [ebp - 0x269], 0
jmp 0x10409a92
mov eax, dword [ebp - 0x274]
movaps xmm0, xmmword [0x10f164f0]
push 0x11d0bb4c
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push 2
mov dword [ebp - 0x2a8], 0x1fffff
mov dword [ebp - 0x2a4], 2
mov dword [ebp - 0x2a0], 0
movups xmmword [ebp - 0x29c], xmm0
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
push dword [ebp - 0x274]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x274], 0
test esi, esi
je 0x104098fa
push esi
push 0x10467f80
call fcn.102fb670
add esp, 8
mov byte [ebp - 0x269], 0
jmp 0x10409a92
push 0x78
lea eax, [ebp - 0x1c8]
push 0
push eax
call fcn.10425c00
push dword [0x11d0bb48]
lea eax, [ebp - 0x1c8]
push 0x10467fa0
push 0x3c
push eax
call fcn.100086c0
add esp, 0x1c
lea eax, [ebp - 0x1c8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateBoundaryDescriptorW]
push 0x50
mov dword [0x11d0bb44], eax
lea eax, [ebp - 0x60]
push 0
push eax
mov dword [ebp - 0x27c], 0x50
call fcn.10425c00
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0x11
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea eax, [ebp - 0x60]
push eax
push 0x11d0bb44
call dword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
push 0x78
lea eax, [ebp - 0xd8]
push 0
push eax
call fcn.10425c00
push dword [0x11d0bb48]
lea eax, [ebp - 0xd8]
push 0x10467fc0
push 0x3c
push eax
call fcn.100086c0
add esp, 0x1c
mov dword [0x11d0bb58], 0
xorps xmm0, xmm0
mov dword [0x11d0bb6c], 0
movq qword [0x11d0bb50], xmm0
movups xmmword [0x11d0bb5c], xmm0
push 1
push 0x11d0bb5c
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push dword [0x11d0bb4c]
push 1
push 0x11d0bb5c
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0xd8]
mov dword [0x11d0bb50], 0xc
push eax
push dword [0x11d0bb44]
mov dword [0x11d0bb54], 0x11d0bb5c
push 0x11d0bb50
mov dword [0x11d0bb58], 0
call dword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
mov dword [0x11d0bb40], eax
test eax, eax
jne 0x10409a8b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x10409a51
push eax
push 0x10467fe0
call fcn.102fb670
add esp, 8
mov byte [ebp - 0x269], 0
jmp 0x10409a92
lea eax, [ebp - 0xd8]
push eax
push dword [0x11d0bb44]
call dword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
mov dword [0x11d0bb40], eax
test eax, eax
jne 0x10409a8b
call esi
cmp eax, 0x34
je 0x10409a8b
push eax
push 0x10468010
call fcn.102fb670
add esp, 8
mov byte [ebp - 0x269], 0
jmp 0x10409a92
mov byte [ebp - 0x269], 1
push 0x11d0bb24
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp - 0x269]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret