Function at 0x18000840c
Capabilities:
Get user security identifier
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x80f0
call fcn.18001b110
sub rsp, rax
mov rax, qword [0x1800300d0]
xor rax, rsp
mov qword [rsp + 0x80e0], rax
mov rax, qword [rsp + 0x8150]
mov qword [rsp + 0x78], rcx
lea rcx, str.advapi32.dll
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x8158]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x8160]
mov rdi, r8
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r15d, r15d
cmp rax, r15
je 0x1800089f6
lea rdx, str.ConvertSidToStringSidW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
cmp rax, r15
je 0x1800089f6
lea rcx, str.netapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
cmp rax, r15
jne 0x1800084d2
lea rcx, str.netapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp rax, r15
je 0x1800089f6
lea rdx, str.NetLocalGroupAdd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
cmp rax, r15
je 0x1800089f6
lea rdx, str.NetLocalGroupGetInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
cmp rax, r15
je 0x1800089f6
lea rdx, str.NetApiBufferFree
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
cmp rax, r15
je 0x1800089f6
lea rdx, str.NetUserAdd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
cmp rax, r15
je 0x1800089f6
lea rdx, str.NetUserGetInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov r15, rax
cmp rax, rdx
je 0x1800089f6
lea rdx, str.NetLocalGroupAddMembers
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov qword [rsp + 0x90], rax
cmp rax, rcx
je 0x1800089f6
mov rdx, rdi
mov rdi, qword [rsp + 0x78]
mov word [rsp + 0xe0], cx
mov rcx, rdi
call fcn.18000cb74
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
mov qword [rsp + 0x48], rax
call fcn.18000cb74
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
mov qword [rsp + 0x68], rax
call fcn.18000cb74
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
mov rbx, rax
mov qword [rsp + 0x70], rax
call fcn.18000cb74
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
mov rdi, rax
call fcn.18000cb74
xor ecx, ecx
mov qword [rsp + 0x98], rax
mov byte [rsp + 0x40], cl
lea edx, [rcx + 1]
cmp rdi, rcx
je 0x1800086c5
cmp byte [rsp + 0x8168], cl
je 0x180008674
lea r8, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
call rbp
xor esi, esi
mov ebx, eax
mov eax, 0x8af
mov ecx, 0x563
cmp ebx, esi
je 0x180008637
cmp ebx, eax
je 0x18000863f
cmp ebx, ecx
jne 0x180008649
cmp ebx, eax
je 0x18000863f
cmp ebx, ecx
jne 0x180008667
cmp byte [rsp + 0x8170], sil
je 0x180008667
lea rdx, [0x18001d478]
lea rcx, [rsp + 0xe0]
mov r9d, ebx
mov r8d, 1
call qword [sym.imp.USER32.dll_wsprintfW]
cmp ebx, esi
mov rbx, qword [rsp + 0x70]
sete sil
jmp 0x1800086c8
mov r8d, edx
lea r9, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], rcx
call rsi
xor edx, edx
cmp eax, edx
jne 0x1800086a0
mov rcx, qword [rsp + 0x50]
cmp rcx, rdx
je 0x1800086c0
call r13
mov sil, byte [rsp + 0x40]
jmp 0x1800086c8
lea rdx, [0x18001d478]
lea rcx, [rsp + 0xe0]
mov r9d, eax
mov r8d, 6
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x180008699
mov sil, dl
jmp 0x1800086c8
mov sil, cl
lea rcx, [rsp + 0xe0]
call fcn.18000fc80
mov rbp, qword [rsp + 0x48]
xor ecx, ecx
cmp rax, rcx
jne 0x18000897a
mov rax, qword [rsp + 0x68]
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
lea eax, [rcx + 1]
mov qword [rsp + 0xa0], rbp
mov edx, eax
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rbx
mov dword [rsp + 0xb4], eax
mov dword [rsp + 0xc8], eax
mov qword [rsp + 0xd0], rcx
call r14
xor r14d, r14d
mov r9d, eax
cmp eax, r14d
jne 0x180008952
mov rdx, qword [rsp + 0xa0]
lea r9, [rsp + 0x48]
lea r8d, [r14 + 0x17]
xor ecx, ecx
mov qword [rsp + 0x48], r14
call r15
cmp eax, r14d
jne 0x180008932
cmp rdi, r14
je 0x1800087c2
mov rax, qword [rsp + 0x48]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rcx, qword [rax + 0x20]
mov rdx, rdi
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x50], rcx
xor ecx, ecx
call qword [rsp + 0x90]
cmp eax, r14d
je 0x1800087c2
cmp eax, 0x562
je 0x1800087c2
lea r8d, [r14 + 4]
lea rdx, [0x18001d478]
lea rcx, [rsp + 0xe0]
mov r9d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0xe0]
call fcn.18000fc80
cmp rax, r14
jne 0x180008923
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], r14
lea rdx, [rsp + 0x50]
mov rcx, qword [rcx + 0x20]
call r12
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xe0]
cmp rdx, r14
je 0x180008910
call fcn.18000fd64
cmp rdi, r14
je 0x180008903
mov r14d, 0x2000
mov rcx, r14
mov dword [rsp + 0x84], r14d
call fcn.18000fc9c
lea r9, [rsp + 0x84]
mov rdx, rdi
mov rbx, rax
lea rax, [rsp + 0x90]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40e0]
mov dword [rsp + 0x80], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
xor r14d, r14d
cmp eax, r14d
je 0x1800088f6
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov qword [rsp + 0x60], r14
call r12
cmp qword [rsp + 0x60], r14
je 0x1800088f6
lea rdx, [0x18001d474]
lea rcx, [rsp + 0xe0]
call fcn.18000fd38
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0xe0]
call fcn.18000fd38
lea rdx, [0x18001d474]
lea rcx, [rsp + 0xe0]
call fcn.18000fd38
lea rax, str.true
lea rdx, str.false
cmp sil, r14b
lea rcx, [rsp + 0xe0]
cmovne rdx, rax
call fcn.18000fd38
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call fcn.18000fc44
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180008923
lea rdx, [0x18001d44c]
mov r8d, 5
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x18000897d
call r13
jmp 0x18000897d
lea rdx, [0x18001d478]
lea rcx, [rsp + 0xe0]
mov r9d, eax
mov r8d, 3
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x18000897d
mov eax, dword [rsp + 0x88]
lea rdx, str._d__d__d
lea rcx, [rsp + 0xe0]
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x18000897d
xor r14d, r14d
mov rcx, rbp
call fcn.18000fc44
mov rcx, qword [rsp + 0x68]
call fcn.18000fc44
cmp rbx, r14
je 0x18000899c
mov rcx, rbx
call fcn.18000fc44
cmp rdi, r14
je 0x1800089a9
mov rcx, rdi
call fcn.18000fc44
mov rcx, qword [rsp + 0x98]
cmp rcx, r14
je 0x1800089bb
call fcn.18000fc44
lea rcx, [rsp + 0xe0]
call fcn.18000fc80
cmp rax, r14
je 0x1800089f6
lea rcx, [rsp + 0xe0]
call fcn.18000fc80
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0xe0]
mov r9, qword [rcx]
mov r8d, eax
call qword [r9 + 0x518]
jmp 0x1800089f8
xor eax, eax
mov rcx, qword [rsp + 0x80e0]
xor rcx, rsp
call fcn.18000fc60
mov rbx, qword [rsp + 0x8138]
add rsp, 0x80f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret