Function at 0x401990
Capabilities:
Accept command line arguments
Get user security identifier
Terminate process

Disassembly:
sub esp, 0x21c
push ebx
push esi
push edi
xor ebx, ebx
push str._nPsGetSid_v1.1___local_and_remote_account_machine_SID_displayer_n
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.00401eac
push str.Copyright__C__2000_Mark_Russinovich_n
call fcn.00401eac
push str.http:__www.sysinternals.com_n_n
call fcn.00401eac
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x4019ef
push str.PsGetSid_requires_Windows_NT_or_Windows_2000._n_n
call fcn.00401eac
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x21c
ret
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x20], 0x22
jne 0x401a39
lea edi, [esp + 0x21]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x21]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0x21], bl
lea ecx, [esp + 0x18]
push ecx
push 0x4097e0
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x401a59
mov byte [eax], bl
mov edx, dword [esp + 0x230]
mov eax, dword [esp + 0x22c]
push edx
push eax
call fcn.00401710
add esp, 8
test al, al
jne 0x401a7c
push 0xffffffffffffffff
call fcn.00402329
cmp byte [0x4093c4], bl
je 0x401ad0
cmp byte [0x4093c5], bl
jne 0x401ad0
push str.Password:
call fcn.00401eac
push 0x408608
call fcn.00402136
add esp, 8
xor esi, esi
call fcn.004064e6
cmp al, 0xd
je 0x401abd
mov byte [esi + 0x4095a0], al
inc esi
cmp esi, 0x103
jb 0x401aa5
push 0x4080f0
mov byte [esi + 0x4095a0], bl
call fcn.00401eac
add esp, 4
cmp byte [0x4092c0], bl
je 0x401bd7
lea ecx, [esp + 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
push ecx
mov cl, byte [0x4091bc]
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
neg cl
push edx
push ebx
sbb ecx, ecx
push eax
push ebx
and ecx, 0x4091bc
push 0x4092c0
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
jne 0x401bb2
mov edx, dword [esp + 0xc]
push edx
call fcn.004020c2
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call fcn.004020c2
add esp, 8
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
mov cl, byte [0x4091bc]
push edx
push eax
neg cl
lea eax, [esp + 0x18]
sbb ecx, ecx
push eax
push esi
and ecx, 0x4091bc
push 0x4092c0
push ecx
call edi
test eax, eax
je 0x401bb2
lea edx, [esp + 0x14]
lea eax, [esp + 0x124]
push edx
push eax
push esi
mov dword [esp + 0x20], 0x104
call fcn.00401050
push 0x4092c0
push 0x4091bc
push str.SID_for__s_s:_n
call fcn.00401eac
lea ecx, [esp + 0x13c]
push ecx
push str._s_n_n
call fcn.00401eac
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x21c
ret
push str.Error_quering_account:_n
call fcn.00401eac
add esp, 4
call ebx
push eax
call fcn.00401000
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x21c
ret
mov dl, byte [0x4091bc]
push edx
call fcn.004012c0
add esp, 4
neg al
pop edi
pop esi
sbb eax, eax
pop ebx
add esp, 0x21c
ret