Function at 0x140262358
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, r8
mov r14, rdx
mov r15, rcx
and dword [rbp - 0x55], 0
and dword [rbp - 0x59], 0
lea rax, [rbp - 0x31]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x55]
xor r8d, r8d
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
nop dword [rax + rax]
test eax, eax
jne 0x1402626da
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x7a
je 0x14026243c
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x140262428
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], r15
mov dword [rbp - 0x51], ebx
lea rcx, str.Failed_to_query_sid___first_call_to_LookupAccountName_failed_with_unexpected_error_code
mov qword [rbp - 0x61], rcx
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044f728]
mov rcx, rax
call fcn.14000f6ac
test ebx, ebx
jle 0x140262435
movzx ebx, bx
or ebx, 0x80070000
mov eax, ebx
jmp 0x14026270c
mov eax, dword [rbp - 0x55]
test eax, eax
je 0x1402626a6
cmp dword [rbp - 0x59], 0
je 0x1402626a6
mov byte [rbp - 0x69], 0
mov ebx, eax
mov rsi, qword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, rsi
sub rcx, rdx
cmp rax, rcx
jae 0x14026246e
add rax, rdx
jmp 0x1402624a1
jbe 0x1402624a5
mov rax, qword [rdi + 0x10]
sub rax, rdx
cmp rbx, rax
jbe 0x14026248d
lea r8, [rbp - 0x69]
mov rdx, rbx
mov rcx, rdi
call fcn.140094134
jmp 0x1402624a5
sub rbx, rcx
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rbx + rsi]
mov qword [rdi + 8], rax
mov edx, dword [rbp - 0x59]
lea rcx, [rbp - 0x29]
call fcn.1400ab794
nop
lea rax, [rbp - 0x31]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x29]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x55]
mov r8, qword [rdi]
mov rdx, r14
mov rcx, r15
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140262561
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x14026254b
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x41], r15
mov dword [rbp - 0x51], ebx
lea rcx, str.Failed_to_query_sid___second_call_to_LookupAccountName_failed.
mov qword [rbp - 0x49], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044f728]
mov rcx, rax
call fcn.14000f6ac
test ebx, ebx
jle 0x1402625fd
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1402625fd
and qword [rbp - 0x39], 0
lea rax, [rbp - 0x39]
mov qword [rbp - 0x11], rax
and qword [rbp - 9], 0
mov byte [rbp - 1], 1
lea rdx, [rbp - 9]
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
sete bl
lea rcx, [rbp - 0x11]
call fcn.14008b780
test bl, bl
je 0x14026260b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x1402625e6
mov dword [rbp - 0x51], ebx
lea rcx, str.Failed_to_query_sid___converting_sid_to_string_failed
mov qword [rbp - 0x61], rcx
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
lea rdx, [0x14044f770]
mov rcx, rax
call fcn.14000615c
test ebx, ebx
jle 0x1402625f3
movzx ebx, bx
or ebx, 0x80070000
lea rcx, [rbp - 0x39]
call fcn.1400f362c
nop
lea rcx, [rbp - 0x29]
call fcn.1400f6764
jmp 0x140262435
mov r8, qword [rbp - 0x21]
mov rdx, qword [rbp - 0x29]
lea rcx, [rbp + 7]
call fcn.1402507c4
call fcn.140091ae4
cmp dword [rax], 5
jbe 0x140262682
mov rcx, qword [rbp - 0x39]
mov qword [rbp - 0x61], rcx
mov qword [rbp - 0x41], r14
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rcx, qword [rbp + 7]
mov qword [rbp - 0x49], rcx
lea rcx, str.Sid_successfully_retrieved
mov qword [rbp - 0x51], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044f80b]
mov rcx, rax
call fcn.140001860
lea rcx, [rbp + 7]
call fcn.14007a7c0
nop
lea rcx, [rbp - 0x39]
call fcn.1400f362c
nop
lea rcx, [rbp - 0x29]
call fcn.1400f6764
mov eax, 0x7a
jmp 0x14026270c
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x1402626d3
lea rcx, str.Failed_to_query_sid___sid_or_domain_size_is_0
mov qword [rbp - 0x61], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044e856]
mov rcx, rax
call fcn.140005f40
mov eax, 0x80070452
jmp 0x14026270c
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x140262707
lea rcx, str.Failed_to_query_sid___calling_LookupAccountName_for_the_first_time_should_return_false
mov qword [rbp - 0x61], rcx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044e856]
mov rcx, rax
call fcn.140005f40
mov eax, 0x80004005
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret