Function at 0x1000f279c
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r13d, r8d
mov rbp, rdx
mov r14, rcx
lea rbx, [0x100038090]
mov qword [rsp + 0x48], rbx
lea rdi, [0x1000387b8]
mov qword [rsp + 0x50], rdi
lea rsi, [0x100038070]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], 0x563
mov r12d, 0xb
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x68], 0xff
xor r15d, r15d
mov word [rax - 0xe0], r15w
mov byte [rax - 0xde], r15b
mov byte [rax - 0xdd], 1
xor edx, edx
lea r8d, [r12 + 0x6d]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e7c38
nop
mov qword [rsp + 0xf8], r15
lea rax, [0x1000391a8]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x108], r15
lea rax, [0x1000391a8]
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x44], 7
mov dword [rsp + 0x1d8], r15d
mov dword [rsp + 0x1e8], r15d
cmp rbp, r15
je 0x1000f2c82
cmp word [rbp], r15w
je 0x1000f2c82
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x1e8]
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov esi, dword [rsp + 0x1d8]
mov edi, dword [rsp + 0x1e8]
cmp r12d, r15d
jne 0x1000f2be0
cmp edi, r15d
je 0x1000f2be0
cmp esi, r15d
je 0x1000f2be0
cmp eax, 0x534
jne 0x1000f29a8
lea rax, [0x100038090]
mov qword [rsp + 0x48], rax
lea rax, [0x1000387b8]
mov qword [rsp + 0x50], rax
lea rax, [0x100038070]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x57e
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [r15 + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov r9, rbp
lea r8, [0x100038930]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e8e14
nop
lea rcx, [rsp + 0x120]
call fcn.1000e7d24
jmp 0x1000f2cef
cmp eax, 0x7a
je 0x1000f2a49
lea rax, [0x100038090]
mov qword [rsp + 0x48], rax
lea rax, [0x1000387b8]
mov qword [rsp + 0x50], rax
lea rax, [0x100038070]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x583
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], ebx
mov r9, rbp
lea r8, [0x1000389e0]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e8e14
nop
lea rcx, [rsp + 0x120]
call fcn.1000e7d24
jmp 0x1000f2cef
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov qword [rsp + 0xf8], rax
cmp rax, r15
jne 0x1000f2a7e
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x100172740]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
mov edx, dword [rsp + 0x1d8]
lea rdx, [rdx + rdx + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
mov qword [rsp + 0x108], rax
cmp rax, r15
jne 0x1000f2abc
mov dword [rsp + 0x40], 0x8007000e
lea rdx, [0x100172740]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1e8]
mov r8, rdi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp eax, r15d
jne 0x1000f2bab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [0x100038090]
mov qword [rsp + 0x48], rax
lea rax, [0x1000387b8]
mov qword [rsp + 0x50], rax
lea rax, [0x100038070]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x595
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], ebx
mov r9, rbp
lea r8, [0x100038aa0]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e8e14
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rcx, [rsp + 0x120]
call fcn.1000e7d24
jmp 0x1000f2cef
mov r8d, r13d
mov rdx, rdi
mov rcx, r14
call fcn.1000f2d10
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rcx, [rsp + 0x120]
call fcn.1000e7d24
jmp 0x1000f2cef
lea rax, [0x100038090]
mov qword [rsp + 0x48], rax
lea rax, [0x1000387b8]
mov qword [rsp + 0x50], rax
lea rax, [0x100038070]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x579
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r12d
mov r9, rbp
lea r8, [0x100038830]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e8e14
nop
lea rcx, [rsp + 0x120]
call fcn.1000e7d24
jmp 0x1000f2cef
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], 0x572
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea r9, [0x1000387f0]
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x120]
call fcn.1000e8ff8
nop
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret