Function at 0x140001530
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
push rbp
push r14
lea rbp, [r11 - 0x5f]
sub rsp, 0xd8
mov rax, qword [0x14000d010]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [r11 + 0x18], rbx
mov rax, rdx
mov qword [r11 - 0x18], rsi
xor r9d, r9d
mov qword [r11 - 0x20], rdi
xor r8d, r8d
mov qword [r11 - 0x28], r12
mov r12, rcx
mov qword [rcx], 0xffffffffffffffff
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x40], rcx
mov rcx, rax
mov qword [r11 - 0x30], r13
xor r13d, r13d
mov qword [rsp + 0x38], r13
mov ebx, r13d
mov dword [rsp + 0x30], r13d
mov edi, r13d
mov qword [rsp + 0x28], r13
mov esi, r13d
lea edx, [r13 + 4]
mov dword [rsp + 0x20], r13d
mov dword [rbp + 7], 1
mov qword [rbp - 0x19], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x11], 0xffffffffffffffff
mov qword [rbp + 0xf], r13
mov qword [rbp - 9], rbx
mov qword [rbp - 1], r13
mov qword [rbp - 0x29], r13
call qword [sym.imp.ADVAPI32.dll_CreateRestrictedToken]
mov r14d, eax
test eax, eax
je 0x140001817
mov rcx, qword [rbp - 0x11]
mov edx, 0x2000
call fcn.140001470
mov r14d, eax
test eax, eax
je 0x140001817
mov rdx, qword [rbp - 0x11]
lea r8d, [r13 + 1]
lea rcx, [rbp + 0xf]
mov qword [rsp + 0xb0], r15
call fcn.140006430
mov rdi, qword [rbp + 0xf]
mov r14d, eax
not r14d
shr r14d, 0x1f
test r14d, r14d
je 0x140001801
mov rax, qword [rdi]
lea r9d, [r13 + 8]
mov rcx, qword [rbp - 0x11]
lea r8, [rbp - 0x19]
lea edx, [r13 + 4]
mov qword [rbp - 0x19], rax
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov r14d, eax
test eax, eax
je 0x14000180f
mov rdx, qword [rbp - 0x11]
lea r8d, [r13 + 6]
lea rcx, [rbp - 9]
call fcn.140006430
mov r14d, eax
not r14d
shr r14d, 0x1f
test r14d, r14d
je 0x1400017e8
lea rax, [rbp - 1]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea r8d, [r13 + 0x20]
mov dword [rsp + 0x48], r13d
lea rcx, [0x14000d058]
mov dword [rsp + 0x40], r13d
mov dl, 2
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov rbx, qword [rbp - 9]
mov r14d, eax
test eax, eax
je 0x14000180f
mov rax, qword [rbx]
mov rcx, qword [rdi]
movzx r15d, word [rax + 2]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
add r15d, 0xc
add r15d, eax
mov ecx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x1400016f9
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400017f1
mov qword [rbp - 0x21], rsi
mov edx, r15d
mov rax, qword [rbx]
mov rcx, rsi
movzx r8d, byte [rax]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov r14d, eax
test eax, eax
je 0x140001806
mov rax, qword [rbx]
mov r8d, 0x10000000
mov r9, qword [rdi]
mov rcx, qword [rbp - 0x21]
movzx edx, byte [rax]
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
mov r14d, eax
test eax, eax
je 0x140001806
mov rcx, qword [rbx]
lea r8, [rbp - 0x29]
xor edx, edx
mov r14d, r13d
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1400017ad
nop word [rax + rax]
mov rdx, qword [rbp - 0x29]
mov rcx, qword [rbp - 1]
add rdx, 8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140001796
mov r9, qword [rbp - 0x29]
xor r8d, r8d
mov rax, qword [rbx]
movzx ecx, word [r9 + 2]
movzx edx, byte [rax]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_AddAce]
mov rcx, qword [rbx]
lea r8, [rbp - 0x29]
inc r14d
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x140001760
mov rcx, qword [rbp - 0x11]
lea r9d, [r15 + 8]
lea r8, [rbp - 0x21]
mov edx, 6
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov r14d, eax
test eax, eax
je 0x140001806
mov rcx, qword [rbp - 0x11]
lea r8, [rbp + 7]
mov r9d, 4
lea edx, [r9 + 0x14]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov r14d, eax
jmp 0x1400017ec
mov rbx, qword [rbp - 9]
test r14d, r14d
je 0x140001801
mov rax, qword [rbp - 0x11]
mov qword [r12], rax
mov qword [rbp - 0x11], 0xffffffffffffffff
test rsi, rsi
je 0x14000180f
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rbp - 1]
mov r12, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xd0]
test rcx, rcx
je 0x14000183a
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp - 1], r13
mov r13, qword [rsp + 0xb8]
test rbx, rbx
je 0x140001865
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x140001865
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x100]
test rdi, rdi
je 0x140001890
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x140001890
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x11]
mov rdi, qword [rsp + 0xc8]
cmp rcx, 0xffffffffffffffff
je 0x1400018a8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140007430
add rsp, 0xd8
pop r14
pop rbp
ret