Function at 0x140009630
Capabilities:
Get user security identifier

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x18], rdx
mov rdx, rcx
mov dword [rbp + 0x28], 0
mov dword [rbp + 0x24], 0
lea r8, [0x1400354d8]
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x38], rdx
call fcn.140004520
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x10]
mov rdi, qword [rbp + 0x18]
mov r8, rdi
call fcn.14000c830
lea rsi, [rbp - 0x30]
mov rcx, rdi
mov rdx, rsi
call fcn.140004990
mov rcx, rsi
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov edx, dword [0x14003ceb4]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp edx, 0xa
setl bl
xor bl, al
mov ebx, 0x6c17b9e2
mov eax, 0x5d4c34f0
cmovne eax, ebx
cmp ecx, 0xffffffff
sete byte [rbp + 0x2e]
mov edi, 0x5d4c34f0
cmovne ebx, eax
cmp edx, 0xa
setl byte [rbp + 0x2f]
cmovge ebx, eax
mov eax, 0x96a35fd2
mov esi, 0xa57c99fb
nop dword [rax]
cmp eax, 0x5d4c34ef
jle 0x140009720
cmp eax, 0x5d4c34f0
je 0x140009732
cmp eax, 0x6c17b9e2
jne 0x140009700
jmp 0x14000975b
cmp eax, 0x96a35fd2
je 0x140009739
cmp eax, 0xa57c99fb
jne 0x140009700
mov eax, ebx
jmp 0x140009700
mov eax, 0xa57c99fb
jmp 0x140009700
movzx edx, byte [rbp + 0x2e]
movzx eax, byte [rbp + 0x2f]
mov ecx, edx
xor cl, al
test al, al
mov eax, 0x5d4c34f0
cmovne eax, esi
test dl, dl
cmove eax, edi
test cl, cl
cmovne eax, esi
jmp 0x140009700
lea rcx, [rbp - 0x10]
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov ecx, dword [0x14003ceb4]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete dl
sete byte [rbp + 0x2e]
mov edi, 0x6c17b9e2
mov esi, 0x5d4c34f0
mov ebx, 0x5d4c34f0
cmove ebx, edi
cmp ecx, 0xa
setl byte [rbp + 0x2f]
setl cl
cmovge ebx, esi
xor cl, dl
cmovne ebx, edi
mov ecx, 0x96a35fd2
mov edi, 0xa57c99fb
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x5d4c34ef
jle 0x1400097e0
cmp ecx, 0x5d4c34f0
je 0x1400097f4
cmp ecx, 0x6c17b9e2
jne 0x1400097c0
jmp 0x14000981d
cmp ecx, 0x96a35fd2
je 0x1400097fb
cmp ecx, 0xa57c99fb
jne 0x1400097c0
mov ecx, ebx
jmp 0x1400097c0
mov ecx, 0xa57c99fb
jmp 0x1400097c0
movzx edx, byte [rbp + 0x2e]
movzx ecx, byte [rbp + 0x2f]
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x5d4c34f0
cmovne ecx, edi
test dl, dl
cmove ecx, esi
test al, al
cmovne ecx, edi
jmp 0x1400097c0
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp + 0x2f]
cmp ecx, 0xa
setl byte [rbp - 0x10]
mov eax, 0x92849ca1
mov esi, 0x9dbee1ec
mov edi, 0x68a758c4
mov ebx, 0x8233e087
nop word cs:[rax + rax]
nop
cmp eax, 0x9dbee1eb
jg 0x1400098a0
cmp eax, 0x8233e087
je 0x140009901
cmp eax, 0x92849ca1
jne 0x140009860
movzx ecx, byte [rbp + 0x2f]
movzx eax, byte [rbp - 0x10]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0x68a758c4
cmovne eax, esi
test cl, cl
cmove eax, edi
test dl, dl
cmovne eax, esi
jmp 0x140009860
cmp eax, 0x9dbee1ec
je 0x1400098be
cmp eax, 0x68a758c4
jne 0x140009860
mov rcx, qword [rbp + 0x18]
call fcn.140010b00
mov eax, 0x9dbee1ec
jmp 0x140009860
mov rcx, qword [rbp + 0x18]
call fcn.140010b00
mov qword [rbp - 0x30], rax
mov eax, dword [0x14003cea8]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x68a758c4
cmove eax, ebx
cmp dword [0x14003ceac], 0xa
cmovge eax, edi
setl dl
xor dl, cl
cmovne eax, ebx
jmp 0x140009860
mov rdx, qword [rbp - 0x30]
lea rax, [rbp + 0x14]
mov qword [rsp + 0x30], rax
lea r15, [rbp + 0x24]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x28]
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140009942
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140009a38
mov eax, dword [0x14003cf48]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
cmp dword [0x14003cf4c], 0xa
setl al
mov edx, eax
and dl, cl
xor al, cl
or al, dl
nop word [rax + rax]
test al, al
je 0x140009970
mov eax, dword [rbp + 0x28]
xor edi, edi
cmp rax, 1
sbb rdi, rdi
or rdi, rax
mov rcx, rdi
call fcn.14001772c
mov r12, rax
mov byte [rax], 0
lea rcx, [rax + 1]
add rdi, 0xffffffffffffffff
xor edx, edx
mov r8, rdi
call fcn.140019790
mov edi, dword [rbp + 0x24]
lea rbx, [rbp - 0x30]
mov rcx, rbx
call fcn.140010d80
movaps xmm0, xmmword [0x14002f060]
movups xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], 0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.140011050
mov eax, dword [0x14003cf50]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
cmp dword [0x14003cf54], 0xa
setl cl
test cl, al
jne 0x140009a02
xor cl, al
jne 0x140009a02
nop dword [rax]
jmp 0x140009a00
mov eax, dword [0x14003cf48]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
cmp dword [0x14003cf4c], 0xa
setl cl
test cl, al
mov rsi, qword [rbp + 0x18]
mov qword [rbp - 0x40], r12
jne 0x140009a3f
xor cl, al
je 0x140009b8b
jmp 0x140009a3f
xor esi, esi
jmp 0x140009e7c
lea rcx, [rbp - 0x30]
call fcn.140011420
mov ecx, dword [0x14003cea8]
mov edx, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete byte [rbp + 0x2e]
cmp edx, 0xa
setl byte [rbp + 0x2f]
mov rdi, rax
mov ecx, 0x92849ca1
mov r13d, 0x9dbee1ec
mov r14d, 0x8233e087
cmp ecx, 0x9dbee1eb
jg 0x140009ac0
cmp ecx, 0x8233e087
je 0x140009b31
cmp ecx, 0x92849ca1
jne 0x140009a80
movzx eax, byte [rbp + 0x2e]
movzx ecx, byte [rbp + 0x2f]
mov edx, eax
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r13d
test cl, cl
mov ecx, edx
cmovne ecx, r13d
test al, al
cmove ecx, edx
jmp 0x140009a80
cmp ecx, 0x9dbee1ec
je 0x140009adf
cmp ecx, 0x68a758c4
jne 0x140009a80
mov rcx, rsi
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140009a80
mov rcx, rsi
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov edx, dword [0x14003ceac]
lea esi, [rcx - 1]
imul esi, ecx
mov ecx, esi
xor ecx, 0xfffffffe
test ecx, esi
sete r8b
cmp edx, 0xa
setl bl
xor bl, r8b
mov ebx, 0x68a758c4
cmovne ebx, r14d
test ecx, esi
mov rsi, qword [rbp + 0x18]
mov ecx, ebx
cmove ecx, r14d
cmp edx, 0xa
mov qword [rbp - 0x10], rax
cmovge ecx, ebx
jmp 0x140009a80
mov rdx, qword [rbp - 0x10]
lea rax, [rbp + 0x14]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x28]
xor ecx, ecx
mov r8, r12
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov r13d, eax
mov eax, dword [0x14003cf48]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x14003cf4c], 0xa
setl cl
test cl, al
jne 0x140009cb2
xor cl, al
jne 0x140009cb2
lea rcx, [rbp - 0x30]
call fcn.140011420
mov ecx, dword [0x14003cea8]
mov edx, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete byte [rbp + 0x2e]
cmp edx, 0xa
setl byte [rbp + 0x2f]
mov rdi, rax
mov ecx, 0x92849ca1
mov r14d, 0x9dbee1ec
mov r12d, 0x8233e087
jmp 0x140009c20
mov rcx, rsi
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov edx, dword [0x14003ceac]
lea esi, [rcx - 1]
imul esi, ecx
mov ecx, esi
xor ecx, 0xfffffffe
test ecx, esi
sete r8b
cmp edx, 0xa
setl bl
xor bl, r8b
mov ebx, 0x68a758c4
cmovne ebx, r12d
test ecx, esi
mov rsi, qword [rbp + 0x18]
mov ecx, ebx
cmove ecx, r12d
cmp edx, 0xa
mov qword [rbp - 0x10], rax
cmovge ecx, ebx
nop dword [rax + rax]
cmp ecx, 0x9dbee1eb
jg 0x140009c60
cmp ecx, 0x8233e087
je 0x140009c83
cmp ecx, 0x92849ca1
jne 0x140009c20
movzx eax, byte [rbp + 0x2e]
movzx ecx, byte [rbp + 0x2f]
mov edx, eax
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r14d
test cl, cl
mov ecx, edx
cmovne ecx, r14d
test al, al
cmove ecx, edx
jmp 0x140009c20
cmp ecx, 0x9dbee1ec
je 0x140009bce
cmp ecx, 0x68a758c4
jne 0x140009c20
mov rcx, rsi
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140009c20
mov rdx, qword [rbp - 0x10]
lea rax, [rbp + 0x14]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x28]
xor ecx, ecx
mov r12, qword [rbp - 0x40]
mov r8, r12
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
jmp 0x140009a3f
lea r14, [rbp - 0x30]
mov r12d, 0x6c17b9e2
mov r15d, 0x5d4c34f0
mov edi, 0xa57c99fb
nop word [rax + rax]
mov rcx, r14
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov esi, dword [0x14003ceb4]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete bl
cmp esi, 0xa
setl cl
xor cl, bl
mov ecx, 0x5d4c34f0
cmovne ecx, r12d
test eax, edx
sete byte [rbp + 0x2f]
mov eax, ecx
cmove eax, r12d
cmp esi, 0xa
setl byte [rbp - 0x10]
cmovge eax, ecx
mov ecx, 0x96a35fd2
cmp ecx, 0x5d4c34ef
jle 0x140009d40
cmp ecx, 0x5d4c34f0
je 0x140009d54
cmp ecx, 0x6c17b9e2
jne 0x140009d20
jmp 0x140009d80
cmp ecx, 0x96a35fd2
je 0x140009d5b
cmp ecx, 0xa57c99fb
jne 0x140009d20
mov ecx, eax
jmp 0x140009d20
mov ecx, 0xa57c99fb
jmp 0x140009d20
movzx edx, byte [rbp + 0x2f]
movzx ecx, byte [rbp - 0x10]
mov ebx, ecx
xor bl, dl
test cl, cl
mov ecx, 0x5d4c34f0
cmovne ecx, edi
test dl, dl
cmove ecx, r15d
test bl, bl
cmovne ecx, edi
jmp 0x140009d20
mov eax, dword [0x14003cf48]
mov ecx, dword [0x14003cf4c]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete dl
setne al
cmp ecx, 0xa
setl bl
cmp ecx, 9
setg cl
cmp bl, dl
jne 0x140009e6f
or cl, al
je 0x140009e6f
mov rcx, r14
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov ecx, dword [0x14003ceb4]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp - 0x10]
sete dl
mov eax, 0x5d4c34f0
cmove eax, r12d
cmp ecx, 0xa
setl byte [rbp - 0x30]
setl cl
cmovge eax, r15d
xor cl, dl
cmovne eax, r12d
mov ecx, 0x96a35fd2
nop word cs:[rax + rax]
nop
cmp ecx, 0x5d4c34ef
jg 0x140009e30
cmp ecx, 0x96a35fd2
je 0x140009e45
cmp ecx, 0xa57c99fb
jne 0x140009e10
mov ecx, eax
jmp 0x140009e10
cmp ecx, 0x5d4c34f0
je 0x140009e68
cmp ecx, 0x6c17b9e2
jne 0x140009e10
jmp 0x140009cd0
movzx edx, byte [rbp - 0x10]
movzx ecx, byte [rbp - 0x30]
mov ebx, ecx
xor bl, dl
test cl, cl
mov ecx, 0x5d4c34f0
cmovne ecx, edi
test dl, dl
cmove ecx, r15d
test bl, bl
cmovne ecx, edi
jmp 0x140009e10
mov ecx, 0xa57c99fb
jmp 0x140009e10
xor eax, eax
test r13d, r13d
mov rsi, qword [rbp - 0x40]
cmove rsi, rax
mov rcx, qword [rbp - 0x38]
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov ecx, dword [0x14003ceb4]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete dl
sete byte [rbp - 0x10]
mov edi, 0x6c17b9e2
mov r8d, 0x5d4c34f0
mov ebx, 0x5d4c34f0
cmove ebx, edi
cmp ecx, 0xa
setl byte [rbp - 0x30]
setl cl
cmovge ebx, r8d
xor cl, dl
cmovne ebx, edi
mov ecx, 0x96a35fd2
mov edi, 0xa57c99fb
nop word cs:[rax + rax]
nop
cmp ecx, 0x5d4c34ef
jle 0x140009f00
cmp ecx, 0x5d4c34f0
je 0x140009f14
cmp ecx, 0x6c17b9e2
jne 0x140009ee0
jmp 0x140009f3e
cmp ecx, 0x96a35fd2
je 0x140009f1b
cmp ecx, 0xa57c99fb
jne 0x140009ee0
mov ecx, ebx
jmp 0x140009ee0
mov ecx, 0xa57c99fb
jmp 0x140009ee0
movzx eax, byte [rbp - 0x10]
movzx ecx, byte [rbp - 0x30]
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0x5d4c34f0
cmovne ecx, edi
test al, al
cmove ecx, r8d
test dl, dl
cmovne ecx, edi
jmp 0x140009ee0
mov rcx, qword [rbp + 0x18]
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov ecx, dword [0x14003ceb4]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete dl
sete byte [rbp - 0x10]
mov edi, 0x6c17b9e2
mov r8d, 0x5d4c34f0
mov ebx, 0x5d4c34f0
cmove ebx, edi
cmp ecx, 0xa
setl byte [rbp - 0x30]
setl cl
cmovge ebx, r8d
xor cl, dl
cmovne ebx, edi
mov ecx, 0x96a35fd2
mov edi, 0xa57c99fb
nop dword [rax + rax]
cmp ecx, 0x5d4c34ef
jle 0x140009fc0
cmp ecx, 0x5d4c34f0
je 0x140009fd4
cmp ecx, 0x6c17b9e2
jne 0x140009fa0
jmp 0x140009ffe
cmp ecx, 0x96a35fd2
je 0x140009fdb
cmp ecx, 0xa57c99fb
jne 0x140009fa0
mov ecx, ebx
jmp 0x140009fa0
mov ecx, 0xa57c99fb
jmp 0x140009fa0
movzx edx, byte [rbp - 0x10]
movzx ecx, byte [rbp - 0x30]
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x5d4c34f0
cmovne ecx, edi
test dl, dl
cmove ecx, r8d
test al, al
cmovne ecx, edi
jmp 0x140009fa0
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret