Function at 0x1000a4eec
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
xor ebx, ebx
mov r13, r8
mov r12, rcx
and dword [rsp + 0x68], ebx
mov byte [r8], bl
mov rsi, rdx
lea r8d, [rbx + 0x28]
lea rcx, [rsp + 0x70]
xor edx, edx
call sub.msvcrt.dll_memset
and qword [rsp + 0x48], rbx
and qword [rsp + 0x40], rbx
and dword [rsp + 0x140], ebx
and dword [rsp + 0x138], ebx
and qword [rsp + 0xa0], rbx
lea r8d, [rbx + 0x40]
lea rcx, [rsp + 0xa8]
xor edx, edx
xor ebp, ebp
xor r14d, r14d
mov dword [rsp + 0x148], 8
xor edi, edi
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [rsp + 0x50], 0x44
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
test rsi, rsi
je 0x1000a4fa5
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov qword [rsp + 0x60], rsi
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x58]
not rcx
dec rcx
add cx, cx
mov word [rsp + 0x58], cx
mov word [rsp + 0x5a], cx
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov rcx, rdi
call sub.ADVAPI32.dll_LsaOpenPolicy
mov edi, eax
test eax, eax
jns 0x1000a4fe9
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a503a
test byte [rcx + 0x1c], 1
je 0x1000a503a
cmp byte [rcx + 0x19], 2
jb 0x1000a503a
mov edx, 0x12
jmp 0x1000a5027
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
mov edx, 5
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
mov edi, eax
test eax, eax
jns 0x1000a5054
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a503a
test byte [rcx + 0x1c], 1
je 0x1000a503a
cmp byte [rcx + 0x19], 2
jb 0x1000a503a
mov edx, 0x13
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003988]
mov r9d, edi
call fcn.10001c878
mov ecx, edi
call sub.ADVAPI32.dll_LsaNtStatusToWinError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000a52c1
mov rcx, qword [rsp + 0x40]
cmp qword [rcx + 0x10], rbx
je 0x1000a5288
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1000a5288
lea rax, [rsp + 0x148]
lea r9, [rsp + 0x140]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x138]
mov rdx, r12
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1000a5103
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1000a5103
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a52c1
test byte [rcx + 0x1c], 1
je 0x1000a52c1
cmp byte [rcx + 0x19], 2
jb 0x1000a52c1
mov edx, 0x15
jmp 0x1000a51df
mov ecx, dword [rsp + 0x140]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbp, rax
test rax, rax
je 0x1000a5142
mov r8d, dword [rsp + 0x140]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov ecx, dword [rsp + 0x138]
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r14, rax
test rax, rax
jne 0x1000a514c
mov ebx, 0x8007000e
jmp 0x1000a52c1
mov r8d, dword [rsp + 0x138]
xor edx, edx
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x148]
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x140]
mov rdx, r12
mov r8, rbp
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1000a51fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a52c1
test byte [rcx + 0x1c], 1
je 0x1000a52c1
cmp byte [rcx + 0x19], 2
jb 0x1000a52c1
mov edx, 0x16
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003988]
mov r9, r12
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
jmp 0x1000a52c1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetWindowsAccountDomainSid]
test eax, eax
jne 0x1000a5266
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a52c1
test byte [rcx + 0x1c], 1
je 0x1000a52c1
cmp byte [rcx + 0x19], 2
jb 0x1000a52c1
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003988]
mov edx, 0x17
mov r9d, ebx
call fcn.10001c878
jmp 0x1000a52c1
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
sete al
mov byte [r13], al
jmp 0x1000a52c1
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a52bc
test byte [rcx + 0x1c], 1
je 0x1000a52bc
cmp byte [rcx + 0x19], 2
jb 0x1000a52bc
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003988]
mov edx, 0x14
call fcn.10001c854
mov ebx, 0x8000ffff
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1000a52d0
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000a52df
call sub.ADVAPI32.dll_LsaClose
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
add rsp, 0xf0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret