Function at 0x403ce0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x118], 0
movsx eax, byte [esi]
push eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x128], 0
call fcn.00407add
add esp, 4
cmp eax, 0x53
jne 0x403f09
cmp byte [esi + 1], 0x2d
jne 0x403f09
cmp byte [esi + 2], 0x31
jne 0x403f09
push esi
call fcn.00403900
add esp, 4
mov dword [ebp - 0x120], eax
test eax, eax
jne 0x403d8a
push str.Error:_The_SID_specified_is_not_a_valid_SID._n_n
call fcn.00405eea
add eax, 0x40
push eax
call fcn.0040622f
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push 0
lea ecx, [ebp - 0x11c]
push ecx
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
jne 0x403eff
push dword [ebp - 0x11c]
call fcn.004050ec
push dword [ebp - 0x10c]
mov dword [ebp - 0x124], eax
call fcn.004050ec
add esp, 8
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x124]
push dword [ebp - 0x120]
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x403eff
push esi
push edi
push str.Account_for__s_s:_n
call fcn.00405193
mov eax, dword [ebp - 0x114]
add esp, 0xc
dec eax
cmp eax, 9
ja case.0x403e2d.8
jmp dword [eax*4 + 0x40403c]
push str.User
jmp 0x403e78
push str.Group
jmp 0x403e78
push str.Domain
jmp 0x403e78
push str.Alias
jmp 0x403e78
push str.Well_Known_Group
jmp 0x403e78
push str.Deleted_Account
jmp 0x403e78
push str.Invalid
jmp 0x403e78
push str.Computer
jmp 0x403e78
push str.Label
jmp 0x403e78
push str.Unknown
call fcn.00405193
add esp, 4
push 0x41ec44
call fcn.00405193
mov eax, dword [ebp - 0x124]
add esp, 4
cmp byte [eax], 0
je 0x403ecc
push eax
push dword [ebp - 0x110]
push str._s_s_n
call fcn.00405193
add esp, 0xc
push 0x41e9cc
call fcn.00405193
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x110]
push 0x41ec50
call fcn.00405193
add esp, 8
push 0x41e9cc
call fcn.00405193
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
push str.Error_querying_SID:_n
jmp 0x404009
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
lea eax, [ebp - 0x118]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
jne 0x404004
push dword [ebp - 0x118]
call fcn.004050ec
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
call fcn.004050ec
add esp, 8
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push eax
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x110]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x404004
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
call fcn.00403bb0
push 0x5c
push esi
call fcn.00407b10
add esp, 0x14
push esi
test eax, eax
je 0x403fca
push str.SID_for__s:_n
call fcn.00405193
add esp, 8
jmp 0x403fdd
push dword [ebp - 0x120]
push str.SID_for__s_s:_n
call fcn.00405193
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push str._s_n_n
call fcn.00405193
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
push str.Error_querying_account:_n
call fcn.00405eea
add eax, 0x40
push eax
call fcn.0040622f
add esp, 8
call ebx
push eax
call fcn.00402d90
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
or eax, 0xffffffff
pop edi
pop esi
pop ebx
call fcn.00405755
mov esp, ebp
pop ebp
ret