Function at 0x1000f2b70
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r13d, r8d
mov rbp, rdx
mov r14, rcx
lea rbx, [0x1000381e0]
mov qword [rsp + 0x48], rbx
lea rdi, [0x100038908]
mov qword [rsp + 0x50], rdi
lea rsi, [0x1000381c0]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], 0x563
mov r12d, 0xb
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x68], 0xff
xor r15d, r15d
mov word [rax - 0xe0], r15w
mov byte [rax - 0xde], r15b
mov byte [rax - 0xdd], 1
xor edx, edx
lea r8d, [r12 + 0x6d]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e8000
nop
mov qword [rsp + 0xf8], r15
lea rax, [0x10000d460]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x108], r15
lea rax, [0x10000d460]
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x44], 7
mov dword [rsp + 0x1d8], r15d
mov dword [rsp + 0x1e8], r15d
cmp rbp, r15
je 0x1000f3056
cmp word [rbp], r15w
je 0x1000f3056
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x1e8]
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov esi, dword [rsp + 0x1d8]
mov edi, dword [rsp + 0x1e8]
cmp r12d, r15d
jne 0x1000f2fb4
cmp edi, r15d
je 0x1000f2fb4
cmp esi, r15d
je 0x1000f2fb4
cmp eax, 0x534
jne 0x1000f2d7c
lea rax, [0x1000381e0]
mov qword [rsp + 0x48], rax
lea rax, [0x100038908]
mov qword [rsp + 0x50], rax
lea rax, [0x1000381c0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x57e
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [r15 + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov r9, rbp
lea r8, [0x100038a80]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e91dc
nop
lea rcx, [rsp + 0x120]
call fcn.1000e80ec
jmp 0x1000f30c3
cmp eax, 0x7a
je 0x1000f2e1d
lea rax, [0x1000381e0]
mov qword [rsp + 0x48], rax
lea rax, [0x100038908]
mov qword [rsp + 0x50], rax
lea rax, [0x1000381c0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x583
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], ebx
mov r9, rbp
lea r8, [0x100038b30]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e91dc
nop
lea rcx, [rsp + 0x120]
call fcn.1000e80ec
jmp 0x1000f30c3
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov qword [rsp + 0xf8], rax
cmp rax, r15
jne 0x1000f2e52
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov edx, dword [rsp + 0x1d8]
lea rdx, [rdx + rdx + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
mov qword [rsp + 0x108], rax
cmp rax, r15
jne 0x1000f2e90
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x100172be0]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1e8]
mov r8, rdi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp eax, r15d
jne 0x1000f2f7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [0x1000381e0]
mov qword [rsp + 0x48], rax
lea rax, [0x100038908]
mov qword [rsp + 0x50], rax
lea rax, [0x1000381c0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x595
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], ebx
mov r9, rbp
lea r8, [0x100038bf0]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e91dc
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rcx, [rsp + 0x120]
call fcn.1000e80ec
jmp 0x1000f30c3
mov r8d, r13d
mov rdx, rdi
mov rcx, r14
call fcn.1000f30e4
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rcx, [rsp + 0x120]
call fcn.1000e80ec
jmp 0x1000f30c3
lea rax, [0x1000381e0]
mov qword [rsp + 0x48], rax
lea rax, [0x100038908]
mov qword [rsp + 0x50], rax
lea rax, [0x1000381c0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x579
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r12d
mov r9, rbp
lea r8, [0x100038980]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e91dc
nop
lea rcx, [rsp + 0x120]
call fcn.1000e80ec
jmp 0x1000f30c3
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], 0x572
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, [0x100038940]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e93c0
nop
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret