Function at 0x10001eb60
Capabilities:
Compare security identifiers
Get file version info

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x1f0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x100083138]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
lea rcx, [0x100083100]
mov rax, qword [0x100083100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
mov r12, qword [0x100084838]
xor r13d, r13d
mov ebp, r13d
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x78], r13d
lea rdx, [rsp + 0x90]
mov rcx, r12
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
lea r14d, [r13 + 1]
cmp eax, r13d
je 0x10001ec81
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
cmp rax, r13
je 0x10001ec81
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, r12
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, r13d
je 0x10001ec73
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rdx, [0x10000a120]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
cmp eax, r13d
je 0x10001ec73
mov rdx, qword [rsp + 0x88]
movzx eax, word [rdx + 0x14]
movzx ecx, word [rdx + 0x16]
movzx r9d, word [rdx + 0x10]
movzx r8d, word [rdx + 0x12]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [0x10000bd30]
lea rcx, [rsp + 0x68]
call fcn.100020218
mov ebp, r14d
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
cmp ebp, r13d
jne 0x10001eca7
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x10000bd30]
lea rcx, [rsp + 0x68]
call fcn.100020218
mov rbx, qword [rsp + 0x68]
lea rdx, [0x100002620]
mov ecx, r14d
call fcn.10001e014
call fcn.10001e954
mov r8, rbx
lea rdx, [0x100005918]
mov ecx, r14d
call fcn.10001e4c4
mov edi, 0x11c
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xc0]
call sub.msvcrt.dll_memset
mov dword [rsp + 0xc0], edi
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebp, 2
cmp eax, r13d
jne 0x10001ed25
mov dword [rsp + 0xc0], 0x114
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, r13d
je 0x10001eddd
cmp dword [rsp + 0xd0], ebp
jne 0x10001ed37
mov eax, dword [rsp + 0xcc]
jmp 0x10001ed3f
movzx eax, word [rsp + 0xcc]
lea rcx, [rsp + 0xd4]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xc8]
mov r8d, dword [rsp + 0xc4]
lea rdx, [0x100005940]
mov ecx, r14d
call fcn.10001e4c4
mov r8d, dword [rsp + 0xd0]
lea rax, [0x10000596c]
lea r9, [0x100005974]
cmp r8d, ebp
cmove r9, rax
lea rdx, [0x100005980]
mov ecx, r14d
call fcn.10001e4c4
movzx r9d, word [rsp + 0x1d6]
movzx r8d, word [rsp + 0x1d4]
lea rdx, [0x1000059b0]
mov ecx, r14d
call fcn.10001e4c4
movzx r9d, byte [rsp + 0x1da]
movzx r8d, word [rsp + 0x1d8]
lea rdx, [0x1000059e0]
mov ecx, r14d
call fcn.10001e4c4
lea rdx, [0x100005a20]
mov ecx, r14d
call fcn.10001e014
mov edi, r13d
mov qword [rsp + 0x70], r13
mov rsi, r13
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x80], r13
mov byte [rsp + 0xb8], r13b
mov byte [rsp + 0xb9], r13b
mov byte [rsp + 0xba], r13b
mov byte [rsp + 0xbb], r13b
mov byte [rsp + 0xbc], r13b
mov byte [rsp + 0xbd], 5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x70]
mov edx, 0x20008
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r13d
je 0x10001ef22
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
mov edx, r14d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10001ef22
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
cmp rax, r13
je 0x10001ef22
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x60]
mov r8, rsi
mov edx, r14d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, r13d
je 0x10001ef22
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, r14b
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r13d
je 0x10001ef22
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb edi, edi
neg edi
add edi, r14d
mov rcx, qword [rsp + 0x80]
cmp rcx, r13
je 0x10001ef35
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp rsi, r13
je 0x10001ef43
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x70]
cmp rcx, r13
je 0x10001ef53
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, r14d
je 0x10001ef7b
cmp edi, ebp
jne 0x10001ef6d
lea rdx, [0x100005a50]
mov ecx, r14d
call fcn.10001e014
jmp 0x10001ef7b
lea rdx, [0x100005aa0]
mov ecx, ebp
call fcn.10001e014
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
cmp rax, r13
je 0x10001efcf
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], rcx
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0xa0]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
cmp eax, r13d
je 0x10001efcf
mov eax, dword [rsp + 0xa8]
and eax, r14d
jne 0x10001efcf
lea rdx, [0x100005b50]
mov ecx, r14d
call fcn.10001e014
jmp 0x10001efdf
lea rdx, [0x100005b10]
mov ecx, r14d
call fcn.10001e014
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
cmp eax, r13d
jg 0x10001effc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.10006bd80
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret