Function at 0x18001de50
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
imul r13d, ecx, 0x3d4
mov rbp, r8
mov rdi, rdx
mov r12d, ecx
mov ebx, ecx
cmp ecx, r13d
ja 0x18001df32
mov r14d, dword [rsp + 0xc0]
movzx esi, byte [rsp + 0xc0]
mov r15d, dword [rsp + 0xc0]
xor ecx, ecx
cmp ebx, 0x2772
ja 0x18001e6aa
je 0x18001dfa5
cmp ebx, 0x1c
je 0x18001df71
cmp ebx, 0x66
je 0x18001df61
cmp ebx, 0xad4
je 0x18001df54
cmp ebx, 0x158c
je 0x18001df11
cmp ebx, 0x2044
jne 0x18001e741
lea r9, [rsp + 0xd8]
mov r8d, r14d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call sub.ADVAPI32.dll_LsaOpenPolicy
cmp qword [rsp + 0xd8], 0
jne 0x18001e741
xor sil, sil
jmp 0x18001e741
mov rax, qword [rbp + 8]
mov r14d, ecx
mov qword [rsp + 0xd8], rcx
cmp qword [rbp], rax
jne 0x18001e741
mov byte [rsp + 0xc0], 0
mov eax, dword [rsp + 0xc0]
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x50], 0x30
jmp 0x18001e741
mov rax, qword [rdi]
cmp dword [rax], 9
je 0x18001e741
mov eax, ecx
jmp 0x18001df39
xorps xmm0, xmm0
mov rdx, rbp
mov rcx, rdi
mov sil, 1
movups xmmword [rsp + 0x40], xmm0
mov r15d, 1
call qword [rdi]
test al, al
je 0x18001df2a
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
jmp 0x18001e741
mov rax, qword [rdi + 8]
mov dword [rax + 0x338], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x33c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x340], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x344], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x348], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x34c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x350], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x354], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x358], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x35c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x360], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x364], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x368], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x36c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x370], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x374], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x378], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x37c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x380], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x384], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x388], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x38c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x390], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x394], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x398], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x39c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3a0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3a4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3a8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3ac], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3b0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3b4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3b8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3bc], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3c0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3c4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3c8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3cc], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3d0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3d4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3d8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3dc], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3e0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3e4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3e8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3ec], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3f0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3f4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3f8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x3fc], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x400], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x404], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x408], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x40c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x410], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x414], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x418], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x41c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x420], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x424], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x428], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x42c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x430], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x434], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x438], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x43c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x440], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x444], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x448], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x44c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x450], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x454], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x458], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x45c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x460], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x464], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x468], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x46c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x470], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x474], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x478], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x47c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x480], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x484], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x488], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x48c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x490], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x494], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x498], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x49c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4a0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4a4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4a8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4ac], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4b0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4b4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4b8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4bc], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4c0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4c4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4c8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4cc], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4d0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4d4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4d8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4dc], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4e0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4e4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4e8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4ec], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4f0], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4f4], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4f8], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x4fc], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x500], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x504], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x508], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x50c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x510], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x514], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x518], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x51c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x520], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x524], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x528], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x52c], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x530], 1
mov rax, qword [rdi + 8]
mov dword [rax + 0x534], 1
jmp 0x18001e741
cmp ebx, 0x2afc
je 0x18001e6e5
cmp ebx, 0x35b4
je 0x18001df32
cmp ebx, 0x4e7e
je 0x18001e6d8
cmp ebx, 0x758a
jne 0x18001e741
mov eax, 1
jmp 0x18001df39
mov rax, qword [rdi + 8]
mov qword [rax + 0x540], rcx
jmp 0x18001e741
test sil, sil
je 0x18001e739
mov rcx, qword [rsp + 0xd8]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov edx, r15d
call sub.ADVAPI32.dll_LsaLookupNames
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18001e71d
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18001e72c
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0xd8]
call sub.ADVAPI32.dll_LsaClose
mov byte [rsp + 0xc0], 1
imul eax, r12d, 0x62
add ebx, eax
cmp ebx, r13d
ja 0x18001df32
jmp 0x18001de9a