Function at 0x1400a1adc
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor esi, esi
lea rdi, [0x140106190]
mov r15, r9
mov r12, r8
mov r13, rdx
mov r14, rcx
test rcx, rcx
je 0x1400a1cb4
test rdx, rdx
je 0x1400a1cb4
test r8, r8
je 0x1400a1cb4
test r9, r9
je 0x1400a1cb4
xor edx, edx
lea r8d, [rsi + 0x30]
lea rcx, [rbp - 0x30]
call sub.msvcrt.dll_memset
and qword [rbp - 0x50], rsi
lea r9, [rbp - 0x50]
mov r8d, 0x800
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400a1c40
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x50]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x48]
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400a1c36
mov rcx, qword [rbp + 0x30]
mov eax, dword [rcx]
sub eax, 7
cmp eax, 1
jbe 0x1400a1c1d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1400a1c16
mov r8, qword [rbp + 0x30]
mov rdx, rax
mov ecx, ebx
mov r8, qword [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1400a1bfc
mov rsi, rdi
xor edi, edi
xor ebx, ebx
jmp 0x1400a1c04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdi, [0x140106190]
jmp 0x1400a1c22
mov ebx, 0x8007000e
jmp 0x1400a1c0d
mov ebx, 0x80004005
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
test ebx, ebx
jns 0x1400a1c7a
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400a1cc0
test byte [rcx + 0x1c], 2
je 0x1400a1cc0
cmp byte [rcx + 0x19], 2
jb 0x1400a1cc0
mov edx, 0x31
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e6de8]
mov r9, r14
call fcn.140005344
jmp 0x1400a1cb9
mov r9, r15
mov r8, rsi
mov rdx, r12
mov rcx, r13
call fcn.1400a1d2c
mov ebx, eax
test eax, eax
jns 0x1400a1cb9
mov rcx, qword [0x140106190]
cmp rcx, rdi
je 0x1400a1cc0
test byte [rcx + 0x1c], 2
je 0x1400a1cc0
cmp byte [rcx + 0x19], 2
jb 0x1400a1cc0
mov edx, 0x32
mov dword [rsp + 0x20], eax
jmp 0x1400a1c65
mov ebx, 0x80004003
mov rcx, qword [0x140106190]
test rsi, rsi
je 0x1400a1cd5
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x140106190]
test ebx, ebx
jns 0x1400a1d06
cmp rcx, rdi
je 0x1400a1d06
test byte [rcx + 0x1c], 2
je 0x1400a1d06
cmp byte [rcx + 0x19], 2
jb 0x1400a1d06
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e6de8]
mov edx, 0x33
mov dword [rsp + 0x20], ebx
mov r9, r14
call fcn.140005344
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret