Function at 0x1400be9e4
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor esi, esi
mov r15, r9
mov r12, r8
mov r13, rdx
mov r14, rcx
lea rdi, [0x140148ea8]
test rcx, rcx
je 0x1400bebbf
test rdx, rdx
je 0x1400bebbf
test r8, r8
je 0x1400bebbf
test r9, r9
je 0x1400bebbf
and dword [rbp - 0x30], esi
lea r8d, [rsi + 0x28]
lea rcx, [rbp - 0x28]
xor edx, edx
call sub.msvcrt.dll_memset
and qword [rbp - 0x50], rsi
lea r9, [rbp - 0x50]
lea rdx, [rbp - 0x30]
mov r8d, 0x800
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400beb4b
lea rcx, [rbp - 0x40]
mov rdx, r14
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x50]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x48]
lea r9, [rbp - 0x40]
lea r8d, [rsi + 1]
mov edx, 0x80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov ebx, eax
or ebx, 0x10000000
jl 0x1400beb41
mov rcx, qword [rbp + 0x30]
mov eax, dword [rcx]
sub eax, 7
cmp eax, 1
jbe 0x1400beb28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1400beb21
mov r8, qword [rbp + 0x30]
mov rdx, rax
mov ecx, ebx
mov r8, qword [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1400beb07
mov rsi, rdi
xor edi, edi
xor ebx, ebx
jmp 0x1400beb0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdi, [0x140148ea8]
jmp 0x1400beb2d
mov ebx, 0x8007000e
jmp 0x1400beb18
mov ebx, 0x80004005
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
test ebx, ebx
jns 0x1400beb85
mov rcx, qword [0x140148ea8]
cmp rcx, rdi
je 0x1400bebcb
test byte [rcx + 0x1c], 2
je 0x1400bebcb
cmp byte [rcx + 0x19], 2
jb 0x1400bebcb
mov edx, 0x31
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009100]
mov r9, r14
call fcn.140011da0
jmp 0x1400bebc4
mov r9, r15
mov r8, rsi
mov rdx, r12
mov rcx, r13
call fcn.1400bec34
mov ebx, eax
test eax, eax
jns 0x1400bebc4
mov rcx, qword [0x140148ea8]
cmp rcx, rdi
je 0x1400bebcb
test byte [rcx + 0x1c], 2
je 0x1400bebcb
cmp byte [rcx + 0x19], 2
jb 0x1400bebcb
mov edx, 0x32
mov dword [rsp + 0x20], eax
jmp 0x1400beb70
mov ebx, 0x80004003
mov rcx, qword [0x140148ea8]
test rsi, rsi
je 0x1400bebe0
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x140148ea8]
test ebx, ebx
jns 0x1400bec11
cmp rcx, rdi
je 0x1400bec11
test byte [rcx + 0x1c], 2
je 0x1400bec11
cmp byte [rcx + 0x19], 2
jb 0x1400bec11
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009100]
mov edx, 0x33
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.140011da0
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret