Function at 0x14000cff0
Capabilities:
Compare security identifiers

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r15d, r15d
xor eax, eax
mov qword [rbp + 0x40], r15
mov rdi, rcx
mov dword [rbp + 0x38], r15d
mov esi, r15d
mov dword [rbp + 0x30], r15d
mov r14d, r15d
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], eax
mov qword [rbp + 0x48], r15
test rcx, rcx
je 0x14000d3b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x40]
lea edx, [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000d3b4
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r15 + 2]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14000d083
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000d3b4
mov ecx, dword [rbp + 0x38]
lea rdx, [0x1401ae572]
mov qword [rsp + 0x68], rbx
call fcn.14002ec60
mov rcx, qword [rbp + 0x40]
mov rbx, rax
test rax, rax
je 0x14000d0fa
mov r9d, dword [rbp + 0x38]
lea rax, [rbp + 0x38]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000d0ee
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14000d113
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14000d113
mov rcx, rbx
call fcn.14002ec58
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x68]
xor al, al
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rbp + 0x38]
lea rdx, [0x1401ae572]
mov qword [rsp + 0x60], r12
call fcn.14002ec60
mov r12, rax
test rax, rax
jne 0x14000d134
mov rcx, rbx
jmp 0x14000d18d
mov r9d, dword [rbp + 0x38]
lea rax, [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
mov r8, r12
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000d182
xor r9d, r9d
lea rax, [rbp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 + 7]
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x14000d1a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14000d1a3
mov rcx, rbx
call fcn.14002ec58
mov rcx, r12
call fcn.14002ec58
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14000d23c
mov ecx, dword [rbp + 0x38]
lea rdx, [0x1401ae572]
mov qword [rsp + 0x58], r13
call fcn.14002ec60
mov r13, rax
test rax, rax
jne 0x14000d1cf
mov rcx, rbx
call fcn.14002ec58
mov rcx, r12
jmp 0x14000d27d
mov r9d, dword [rbp + 0x38]
lea rax, [rbp + 0x38]
mov r8, r13
mov qword [rsp + 0x20], rax
mov edx, 7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
je 0x14000d26a
lea r9, [rbp + 0x30]
mov rcx, r13
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x14000d26a
mov rcx, qword [rbp - 0x40]
test rcx, rcx
jne 0x14000d252
mov rcx, rbx
call fcn.14002ec58
mov rcx, r12
call fcn.14002ec58
mov rcx, r13
call fcn.14002ec58
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r9d, 2
lea rdx, [rbp - 0x38]
lea r8d, [r9 + 0xa]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x14000d290
mov rcx, rbx
call fcn.14002ec58
mov rcx, r12
call fcn.14002ec58
mov rcx, r13
call fcn.14002ec58
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14000d237
cmp dword [rbp - 0x38], esi
jbe 0x14000d372
nop dword [rax]
mov rcx, qword [rbp - 0x40]
lea r8, [rbp + 0x48]
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x14000d365
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000d365
cmp byte [rcx], 1
jne 0x14000d316
mov rdx, qword [r12]
add rcx, 8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp + 0x48]
test eax, eax
je 0x14000d2e5
or r14d, dword [rcx + 4]
xor edi, edi
cmp dword [rbx], edi
jbe 0x14000d316
nop dword [rax + rax]
mov edx, edi
add rcx, 8
add rdx, rdx
mov rdx, qword [rbx + rdx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp + 0x48]
test eax, eax
je 0x14000d310
or r14d, dword [rcx + 4]
inc edi
cmp edi, dword [rbx]
jb 0x14000d2f0
cmp byte [rcx], 0
jne 0x14000d365
mov rdx, qword [r12]
add rcx, 8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp + 0x48]
test eax, eax
je 0x14000d334
or esi, dword [rcx + 4]
xor edi, edi
cmp dword [rbx], edi
jbe 0x14000d365
nop word [rax + rax]
mov edx, edi
add rcx, 8
add rdx, rdx
mov rdx, qword [rbx + rdx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp + 0x48]
test eax, eax
je 0x14000d35f
or esi, dword [rcx + 4]
inc edi
cmp edi, dword [rbx]
jb 0x14000d340
inc r15d
cmp r15d, dword [rbp - 0x38]
jb 0x14000d2a0
mov rcx, rbx
call fcn.14002ec58
mov rcx, r12
call fcn.14002ec58
mov rcx, r13
call fcn.14002ec58
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and esi, 0x1201b6
cmp esi, 0x1201b6
jne 0x14000d28c
test esi, r14d
jne 0x14000d28c
jmp 0x14000d235
xor al, al
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret