Function at 0x4097e2
Capabilities:
Get user security identifier

Disassembly:
push 0x1cc
mov eax, 0x4cd65d
call fcn.0044daf4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x140], ebx
lea edi, [ebp - 0x13c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push eax
push 0x800
lea eax, [ebp - 0x140]
push eax
push ebx
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov edi, dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x4098c5
lea eax, [ebp - 0x128]
push eax
call fcn.00404d9c
lea eax, [ebp - 0x128]
push str.LsaOpenPolicy___failed._Return_code:
push eax
mov dword [ebp - 4], ebx
call fcn.00405e4c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x128]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x128]
call fcn.00404d5e
mov ecx, dword [ebp - 0x6c]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.00405528
push 1
xor edi, edi
lea esi, [ebp - 0x68]
call fcn.00401198
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.00404e06
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 0xd8], vtable.std::ios_base.0
call fcn.00445c6f
pop ecx
jmp 0x409a1e
push dword [ebp - 0x70]
lea esi, [ebp - 0x4c]
call fcn.00401874
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
inc eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 4
call fcn.0040a6f1
mov dword [ebp - 4], 3
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x4c]
jae 0x409905
mov eax, esi
cmp dword [ebp - 0x38], 8
mov ecx, dword [ebp - 0x3c]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x4c]
jae 0x409917
lea ecx, [ebp - 0x4c]
mov esi, dword [ebp - 0x5c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push ecx
push esi
call fcn.00447440
mov eax, dword [ebp - 0x70]
add eax, eax
mov word [ebp - 0x8c], ax
add eax, 2
add esp, 0xc
mov word [ebp - 0x8a], ax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x8c]
push eax
push 1
push 0x80000000
push dword [ebp - 0x7c]
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call dword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
push eax
call edi
push dword [ebp - 0x7c]
mov dword [ebp - 0x74], eax
call dword [sym.imp.ADVAPI32.dll_LsaClose]
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x409a26
lea eax, [ebp - 0x128]
push eax
call fcn.00404d9c
lea eax, [ebp - 0x128]
push str.Failed_to_close_policy_object._Return_code:
push eax
mov byte [ebp - 4], 6
call fcn.00405e4c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x128]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x128]
call fcn.00404d5e
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x6c]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x30]
call fcn.00405528
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401198
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 3
call fcn.00404e06
mov dword [ebp - 0xd8], vtable.std::ios_base.0
lea eax, [ebp - 0xd8]
push eax
call fcn.00445c6f
pop ecx
lea esi, [ebp - 0x5c]
call fcn.0041a6ce
push 1
xor edi, edi
lea esi, [ebp - 0x4c]
call fcn.00401198
xor eax, eax
call fcn.0044db50
ret
mov esi, dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
cmp dword [ebp - 0x80], ebx
je 0x409a91
push dword [ebp - 0x80]
call esi
push eax
call edi
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x80], ebx
cmp eax, ebx
je 0x409a91
push dword [ebp - 0x78]
call esi
lea eax, [ebp - 0x128]
push eax
call fcn.00404d9c
lea eax, [ebp - 0x128]
push str.Failed_to_free_the_domain_list._Return_code:
push eax
mov byte [ebp - 4], 8
call fcn.00405e4c
pop ecx
pop ecx
push dword [ebp - 0x70]
lea eax, [ebp - 0x128]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x128]
call fcn.00404d5e
mov byte [ebp - 4], 9
jmp 0x4099ca
cmp dword [ebp - 0x74], ebx
je 0x409b3d
lea eax, [ebp - 0x128]
push eax
call fcn.00404d9c
cmp dword [ebp - 0x74], 0x515
jne 0x409b00
lea eax, [ebp - 0x128]
push str.Local_user
push eax
mov byte [ebp - 4], 0xa
call fcn.00405e4c
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004060a0
add esp, 0xc
lea eax, [ebp - 0x128]
push str._not_found
push eax
call fcn.00405e4c
pop ecx
pop ecx
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x128]
call fcn.00404d5e
mov byte [ebp - 4], 0xb
jmp 0x4099ca
lea eax, [ebp - 0x128]
push str.LsaLookupNames2_failed._Return_code:
push eax
mov byte [ebp - 4], 0xc
call fcn.00405e4c
pop ecx
pop ecx
push dword [ebp - 0x74]
lea eax, [ebp - 0x128]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x128]
call fcn.00404d5e
mov byte [ebp - 4], 0xd
jmp 0x4099ca
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 4]
push eax
mov dword [ebp - 0x70], eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x409bc8
push dword [ebp - 0x78]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x128]
push eax
call fcn.00404d9c
lea eax, [ebp - 0x128]
push str.The_security_descriptor_retrived_for
push eax
mov byte [ebp - 4], 0xe
call fcn.00405e4c
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004060a0
add esp, 0xc
lea eax, [ebp - 0x128]
push str._is_not_valid:
push eax
call fcn.00405e4c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x128]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x128]
call fcn.00404d5e
mov byte [ebp - 4], 0xf
jmp 0x4099ca
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push eax
mov dword [ebp - 0x84], eax
call fcn.00448631
pop ecx
mov dword [ebp - 0x74], eax
cmp eax, ebx
jne 0x409c5d
push dword [ebp - 0x78]
call esi
lea eax, [ebp - 0x1d8]
push eax
call fcn.00404d9c
lea eax, [ebp - 0x1d8]
push str.Memory_allocation_for_SID_buffer_failed
push eax
mov byte [ebp - 4], 0x10
call fcn.00405e4c
pop ecx
pop ecx
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x1d8]
call fcn.00404d5e
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x6c]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x30]
call fcn.00405528
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401198
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], 3
call fcn.00404e06
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
lea eax, [ebp - 0x188]
jmp 0x409a03
push dword [ebp - 0x70]
push eax
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
jne 0x409cce
push dword [ebp - 0x74]
call fcn.004477a1
pop ecx
push dword [ebp - 0x78]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x128]
push eax
call fcn.00404d9c
lea eax, [ebp - 0x128]
push str.Error_copying_security_descriptor:
push eax
mov byte [ebp - 4], 0x12
call fcn.00405e4c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x128]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x128]
call fcn.00404d5e
mov byte [ebp - 4], 0x13
jmp 0x4099ca
push dword [ebp - 0x78]
call esi
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x409d2c
push dword [ebp - 0x74]
call fcn.004477a1
pop ecx
lea eax, [ebp - 0x1d8]
push eax
call fcn.00404d9c
lea eax, [ebp - 0x1d8]
push str.Failed_to_free_the_SID_object._Return_code:
push eax
mov byte [ebp - 4], 0x14
call fcn.00405e4c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x1d8]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x1d8]
call fcn.00404d5e
mov byte [ebp - 4], 0x15
jmp 0x409c1f
lea esi, [ebp - 0x5c]
call fcn.0041a6ce
push 1
xor edi, edi
lea esi, [ebp - 0x4c]
call fcn.00401198
mov eax, dword [ebp - 0x74]
jmp 0x409a20