Function at 0x1400032f0
Capabilities:
Check os version
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov r13, r8
mov r10d, 1
xor r9d, r9d
mov r12, rdx
or edx, 0xffffffff
mov eax, ecx
or r8d, edx
mov word [r13], r9w
mov ebp, r10d
mov dword [rsp + 0xc0], r8d
mov dword [rsp + 0xc8], edx
cmp ecx, r10d
jle 0x140003674
lea r15d, [rdx + 3]
lea rsi, [r12 + 8]
lea r14, [r12 + 0x10]
nop
mov rcx, qword [rsi]
movzx eax, word [rcx]
add eax, 0xffffffd3
test eax, 0xfffffffd
je 0x14000338c
cmp edx, 0xffffffff
jne 0x140003373
mov edx, ebp
mov dword [rsp + 0xc8], edx
jmp 0x14000364e
cmp r8d, 0xffffffff
jne 0x1400036ac
mov r8d, ebp
mov dword [rsp + 0xc0], ebp
jmp 0x14000364e
cmp word [rcx + 2], 0
mov rdi, r10
je 0x14000364e
mov ebx, 2
nop
movzx ecx, word [rcx + rbx]
call fcn.14000c86c
add eax, 0xffffffbf
cmp eax, 0x16
ja case.0x1400033c9.66
lea r10, [0x140000000]
cdqe
mov ecx, dword [r10 + rax*4 + 0x38d4]
add rcx, r10
jmp rcx
mov byte [0x140058acc], 1
jmp case.0x1400033c9.66
mov byte [0x140058af0], 1
jmp case.0x1400033c9.66
mov byte [0x140058b12], 1
jmp case.0x1400033c9.66
mov rax, qword [r12]
movzx ecx, word [rax + 2]
call fcn.14000c86c
cmp eax, 0x50
jne 0x140003562
mov byte [0x140058b2a], 1
jmp case.0x1400033c9.66
mov byte [0x140058b13], 1
jmp case.0x1400033c9.66
mov byte [0x140058aca], 1
jmp case.0x1400033c9.66
movzx ecx, byte [0x140058ac9]
mov byte [0x140058b29], 1
mov rax, qword [rsi]
cmp word [rbx + rax], 0x4c
mov eax, 1
cmove ecx, eax
mov byte [0x140058ac9], cl
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, byte [0x140058b10]
mov r10d, 1
cmp al, 6
cmovae ecx, r10d
mov byte [0x140058b28], r10b
mov byte [0x140058b10], cl
jmp 0x140003548
mov byte [0x140058af1], 1
jmp case.0x1400033c9.66
cmp byte [0x140058b29], 0
je 0x1400036b6
mov byte [0x140058af3], 1
jmp case.0x1400033c9.66
mov byte [0x140058acd], 1
jmp case.0x1400033c9.66
mov byte [0x140058acb], 1
jmp case.0x1400033c9.66
mov byte [0x140035190], 0
mov byte [0x140035191], 0
jmp case.0x1400033c9.66
mov byte [0x140058af2], 1
mov byte [0x140058b10], 1
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae case.0x1400033c9.66
lea rcx, str._e_is_valid_only_on_Windows_Vista_and_higher._n_n
call fcn.14000adf8
xor al, al
jmp 0x1400038b6
mov byte [0x140058ac8], 1
jmp case.0x1400033c9.66
mov byte [0x140058ace], 1
jmp case.0x1400033c9.66
mov byte [0x140058b11], 1
jmp case.0x1400033c9.66
cmp byte [0x140058ace], 0
je 0x14000360d
mov byte [0x140058acf], 1
jmp case.0x1400033c9.66
mov byte [0x140058b28], 1
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb case.0x1400033c9.66
mov byte [0x140058b10], 1
jmp case.0x1400033c9.66
mov byte [0x140035190], 0
mov r10d, 1
mov rcx, qword [rsi]
inc rdi
lea rbx, [rdi + rdi]
cmp word [rcx + rbx], 0
jne 0x1400033a0
jmp 0x14000363c
mov rbx, qword [r14]
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x1400035f1
mov rax, qword [0x140058b50]
lea r9, [rsp + 0x50]
lea rcx, [0x140058b50]
mov rdi, qword [rax]
mov rdx, rdi
mov r8, qword [rdi + 8]
call fcn.140002550
mov rcx, qword [0x140058b58]
movabs rdx, 0xaaaaaaaaaaaaaa9
sub rdx, rcx
cmp rdx, 1
jb 0x1400038c7
inc rcx
mov qword [0x140058b58], rcx
mov qword [rdi + 8], rax
mov rdx, qword [rax + 8]
mov qword [rdx], rax
mov edx, 0x2c
mov rcx, rbx
call fcn.14000c904
xor r9d, r9d
mov rbx, rax
test rax, rax
je 0x1400035f4
add rbx, 2
mov word [rax], r9w
mov qword [rsp + 0x50], rbx
jne 0x140003573
jmp 0x1400035f4
xor r9d, r9d
inc ebp
inc r15d
add rsi, 8
add r14, 8
mov r10d, 1
add r12, 8
jmp 0x14000363f
cmp r15d, dword [rsp + 0xb0]
je 0x1400036c9
mov rax, qword [r14]
inc ebp
inc r15d
add rsi, 8
add r14, 8
mov r10d, 1
mov qword [0x140058b20], rax
add r12, 8
xor r9d, r9d
mov edx, dword [rsp + 0xc8]
mov r8d, dword [rsp + 0xc0]
inc ebp
inc r15d
add rsi, 8
add r14, 8
add r12, 8
cmp ebp, dword [rsp + 0xb0]
jl 0x140003350
mov r12, qword [rsp + 0xb8]
cmp qword [0x140058b20], 0
je 0x140003687
cmp byte [0x140058acd], 0
je 0x1400036ac
cmp byte [0x140058b2a], 0
je 0x1400036dc
cmp byte [0x140058ace], 0
jne 0x1400036dc
lea rcx, str.Full_token_option_requires_the_process_option_n_n
call fcn.14000adf8
xor al, al
jmp 0x1400038b6
call fcn.140005610
jmp 0x1400038b6
lea rcx, str._i_is_valid_only_with__l._n_n
call fcn.14000adf8
xor al, al
jmp 0x1400038b6
lea rcx, str.You_must_specify_an_object_type._n_n
call fcn.14000adf8
xor al, al
jmp 0x1400038b6
cmp byte [0x140058b12], 0
je 0x1400036f7
cmp byte [0x140058af0], 0
jne 0x1400036ac
cmp byte [0x140058ace], 0
jne 0x1400036ac
cmp r8d, 0xffffffff
jne 0x14000371b
cmp edx, r8d
jne 0x140003714
cmp byte [0x140058af0], 0
jne 0x140003714
cmp byte [0x140058acd], 0
je 0x1400036ac
mov ebp, edx
or edx, 0xffffffff
jmp 0x140003730
cmp edx, 0xffffffff
je 0x140003729
cmp byte [0x140058b29], 0
jne 0x1400036ac
mov ebp, dword [rsp + 0xc0]
movzx eax, byte [0x140058acd]
movzx ecx, byte [0x140058ace]
add ecx, eax
movzx eax, byte [0x140058af1]
add ecx, eax
movzx eax, byte [0x140058aca]
add ecx, eax
movzx eax, byte [0x140058af0]
add ecx, eax
movzx eax, byte [0x140058acc]
add ecx, eax
cmp ecx, 1
jg 0x1400036ac
cmp edx, 0xffffffff
je 0x14000387d
movsxd rax, edx
mov dword [0x140058ad8], r9d
mov qword [0x140058ad0], r9
lea rdi, [r12 + rax*8]
mov qword [rsp + 0x30], r9
mov qword [0x140058adc], 1
mov rax, qword [rdi]
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x44], r9d
mov qword [0x140058ae8], rax
mov rdx, qword [rdi]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x44]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x534
jne 0x1400037f4
mov rdx, qword [rdi]
lea rcx, str.Invalid_account_name:__s_n_n
call fcn.14000adf8
xor al, al
jmp 0x1400038b6
mov rax, qword [rdi]
mov ecx, dword [rsp + 0x44]
mov qword [0x140058b38], rax
call fcn.14000ac7c
mov ecx, dword [rsp + 0x40]
add rcx, rcx
mov rbx, rax
mov qword [0x140058b30], rax
call fcn.14000ac7c
mov rdx, qword [rdi]
lea r9, [rsp + 0x44]
mov rsi, rax
lea rax, [rsp + 0x48]
mov r8, rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov rcx, rsi
test eax, eax
jne 0x140003878
call fcn.14000ac3c
mov rdx, qword [rdi]
lea rcx, str.__Error_looking_up_account:__s:_n
call fcn.14000adf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140005190
xor al, al
jmp 0x1400038b6
call fcn.14000ac3c
cmp ebp, 0xffffffff
je 0x1400038a7
movsxd rax, ebp
mov rcx, qword [r12 + rax*8]
nop dword [rax]
movzx eax, word [rcx]
lea r13, [r13 + 2]
lea rcx, [rcx + 2]
mov word [r13 - 2], ax
test ax, ax
jne 0x140003890
jmp 0x1400038b4
cmp byte [0x140058aca], 0
jne 0x1400036ac
mov al, 1
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_T__too_long
call fcn.14001e100
int3