Function at 0x140099184
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor esi, esi
lea rdi, [0x1400f3190]
mov r15, r9
mov r12, r8
mov r13, rdx
mov r14, rcx
test rcx, rcx
je 0x14009935c
test rdx, rdx
je 0x14009935c
test r8, r8
je 0x14009935c
test r9, r9
je 0x14009935c
xor edx, edx
lea r8d, [rsi + 0x30]
lea rcx, [rbp - 0x30]
call sub.msvcrt.dll_memset
and qword [rbp - 0x50], rsi
lea r9, [rbp - 0x50]
mov r8d, 0x800
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400992e8
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x50]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x48]
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400992de
mov rcx, qword [rbp + 0x30]
mov eax, dword [rcx]
sub eax, 7
cmp eax, 1
jbe 0x1400992c5
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1400992be
mov r8, qword [rbp + 0x30]
mov rdx, rax
mov ecx, ebx
mov r8, qword [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1400992a4
mov rsi, rdi
xor edi, edi
xor ebx, ebx
jmp 0x1400992ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdi, [0x1400f3190]
jmp 0x1400992ca
mov ebx, 0x8007000e
jmp 0x1400992b5
mov ebx, 0x80004005
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
test ebx, ebx
jns 0x140099322
mov rcx, qword [0x1400f3190]
cmp rcx, rdi
je 0x140099368
test byte [rcx + 0x1c], 2
je 0x140099368
cmp byte [rcx + 0x19], 2
jb 0x140099368
mov edx, 0x31
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400d8b18]
mov r9, r14
call fcn.14000562c
jmp 0x140099361
mov r9, r15
mov r8, rsi
mov rdx, r12
mov rcx, r13
call fcn.1400993d8
mov ebx, eax
test eax, eax
jns 0x140099361
mov rcx, qword [0x1400f3190]
cmp rcx, rdi
je 0x140099368
test byte [rcx + 0x1c], 2
je 0x140099368
cmp byte [rcx + 0x19], 2
jb 0x140099368
mov edx, 0x32
mov dword [rsp + 0x20], eax
jmp 0x14009930d
mov ebx, 0x80004003
mov rcx, qword [0x1400f3190]
test rsi, rsi
je 0x14009937d
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1400f3190]
test ebx, ebx
jns 0x1400993ae
cmp rcx, rdi
je 0x1400993ae
test byte [rcx + 0x1c], 2
je 0x1400993ae
cmp byte [rcx + 0x19], 2
jb 0x1400993ae
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400d8b18]
mov edx, 0x33
mov dword [rsp + 0x20], ebx
mov r9, r14
call fcn.14000562c
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret