Function at 0x140002ba0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, qword [0x140058b60]
xor esi, esi
mov rdi, r8
mov r13, rdx
mov r14, rcx
mov r12d, esi
mov r15d, esi
test rbx, rbx
je 0x140002bfe
nop dword [rax]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140002d2f
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140002be0
lea rax, [rbp - 0x10]
lea r8, [rbp + 0x48]
xor r9d, r9d
xor edx, edx
mov rcx, r14
mov dword [rbp + 0x48], esi
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x10], esi
call fcn.140003da0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140002c68
mov ecx, dword [rbp + 0x48]
add rcx, rcx
call fcn.14000ac7c
mov ecx, dword [rbp - 0x10]
add rcx, rcx
mov r12, rax
call fcn.14000ac7c
lea r8, [rbp + 0x48]
mov rdx, r12
mov r15, rax
lea rax, [rbp - 0x10]
mov rcx, r14
mov r9, r15
mov qword [rsp + 0x20], rax
call fcn.140003da0
test al, al
jne 0x140002ce9
lea rax, [rbp - 8]
lea r9, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov rdx, r14
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140002d55
mov ecx, dword [rbp + 0x48]
add rcx, rcx
call fcn.14000ac7c
mov ecx, dword [rbp - 0x10]
add rcx, rcx
mov r12, rax
call fcn.14000ac7c
lea r9, [rbp + 0x48]
mov r8, r12
mov r15, rax
lea rax, [rbp - 8]
mov rdx, r14
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test al, al
je 0x140002d55
mov eax, dword [rbp - 0x10]
mov ecx, dword [rbp + 0x48]
add eax, 2
add ecx, eax
add rcx, rcx
call fcn.14000ac7c
lea rcx, [0x1400260e0]
lea r9, [0x14002605c]
mov qword [r13], rax
cmp word [r15], si
lea rdx, str._s_s_s
cmovne r9, rcx
mov r8, r15
mov rcx, rax
mov qword [rsp + 0x20], r12
call fcn.14000aecc
jmp 0x140002d84
mov rcx, qword [rbx]
call fcn.14000c88c
mov qword [r13], rax
test rdi, rdi
je 0x140002e54
mov rcx, qword [rbx + 0x10]
call fcn.14000c88c
mov qword [rdi], rax
jmp 0x140002e54
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, r14
mov dword [rbp + 0x48], esi
call fcn.140003930
mov ecx, dword [rbp + 0x48]
add rcx, rcx
call fcn.14000ac7c
lea r8, [rbp + 0x48]
mov rcx, r14
mov rdx, rax
mov qword [r13], rax
call fcn.140003930
lea r8, [rbp - 0xc]
xor edx, edx
mov rcx, r14
mov dword [rbp - 0xc], esi
call fcn.140003930
mov eax, dword [rbp - 0xc]
test eax, eax
je 0x140002dc8
mov ecx, eax
add rcx, rcx
call fcn.14000ac7c
lea r8, [rbp - 0xc]
mov rcx, r14
mov rdx, rax
mov rsi, rax
call fcn.140003930
test rdi, rdi
je 0x140002dc8
mov rcx, rsi
call fcn.14000c88c
mov qword [rdi], rax
mov ecx, 0x20
call fcn.14000ac7c
mov rcx, r14
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
call fcn.14000ac7c
mov rcx, r14
mov rbx, rax
mov qword [rdi + 8], rax
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov r8, r14
mov rdx, rbx
mov ecx, eax
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov rcx, qword [r13]
call fcn.14000c88c
mov rcx, rsi
mov qword [rdi], rax
call fcn.14000c88c
mov qword [rdi + 0x10], rax
mov rax, qword [0x140058b60]
mov qword [0x140058b60], rdi
mov qword [rdi + 0x18], rax
test r12, r12
je 0x140002e3a
mov rcx, r12
call fcn.14000ac3c
test r15, r15
je 0x140002e47
mov rcx, r15
call fcn.14000ac3c
test rsi, rsi
je 0x140002e54
mov rcx, rsi
call fcn.14000ac3c
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret