Function at 0x1400f328c
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov rsi, r8
mov ebx, r12d
mov r14, rdx
mov rdi, rcx
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
lea r13d, [r12 + 1]
cmp rcx, r15
je 0x1400f32ef
test byte [rcx + 0x1c], r13b
je 0x1400f32ef
cmp byte [rcx + 0x19], 5
jb 0x1400f32ef
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x11]
lea r8, [0x140153f98]
call fcn.1400049d8
mov rcx, qword [0x14016f048]
or rbp, 0xffffffffffffffff
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x88], r12
cmp rcx, r15
je 0x1400f3331
test byte [rcx + 0x1c], r13b
je 0x1400f3331
cmp byte [rcx + 0x19], 5
jb 0x1400f3331
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x13]
mov r9, rdi
lea r8, [0x140153f98]
call fcn.1400058d8
mov rcx, qword [0x14016f048]
test r14, r14
jne 0x1400f337c
test rsi, rsi
jne 0x1400f337c
mov ebx, 0x80070057
cmp rcx, r15
je 0x1400f3644
test byte [rcx + 0x1c], r13b
je 0x1400f3644
cmp byte [rcx + 0x19], 2
jb 0x1400f3644
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x13]
lea r8, [0x140153f98]
call fcn.1400049d8
mov rcx, qword [0x14016f048]
jmp 0x1400f3644
mov eax, 3
mov qword [rsp + 0x30], r12
mov r8d, eax
mov dword [rsp + 0x28], 0x2200000
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov edx, 0x60000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f3406
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f3644
test byte [rcx + 0x1c], r13b
je 0x1400f3644
cmp byte [rcx + 0x19], 2
jb 0x1400f3644
lea edx, [rbp + 0x15]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140153f98]
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005938
jmp 0x1400f3370
test rsi, rsi
je 0x1400f3487
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8d, 0x80000004
mov edx, r13d
mov qword [rsp + 0x20], r12
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x1400f3487
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f3644
test byte [rcx + 0x1c], r13b
je 0x1400f3644
cmp byte [rcx + 0x19], 2
jb 0x1400f3644
mov rcx, qword [rcx + 0x10]
mov edx, 0x15
mov dword [rsp + 0x28], ebx
mov r9d, 0x80000004
mov qword [rsp + 0x20], rdi
call fcn.1400f2f64
jmp 0x1400f3370
test r14, r14
je 0x1400f36c6
lea rax, [rsp + 0x88]
mov r8d, r13d
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x98]
mov qword [rsp + 0x30], r12
mov edx, r13d
mov qword [rsp + 0x28], r12
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x1400f3509
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f3644
test byte [rcx + 0x1c], r13b
je 0x1400f3644
cmp byte [rcx + 0x19], 2
jb 0x1400f3644
mov edx, 0x16
jmp 0x1400f33ea
mov rcx, qword [rsp + 0x98]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400f36c6
mov rax, rsi
mov rcx, rbp
neg rax
sbb r15d, r15d
and r15d, 0x80000004
add r15d, r13d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
mov r8d, 3
mov rax, rsi
mov dword [rsp + 0x28], 0x2200000
neg rax
mov dword [rsp + 0x20], r8d
mov rcx, rdi
sbb edx, edx
xor r9d, r9d
and edx, 0x40000
add edx, 0xa0000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f35c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
cmp rcx, r15
je 0x1400f3644
test byte [rcx + 0x1c], r13b
je 0x1400f3644
cmp byte [rcx + 0x19], 2
jb 0x1400f3644
lea edx, [rbp + 0x18]
jmp 0x1400f33ea
mov qword [rsp + 0x30], r12
mov r9, r14
mov qword [rsp + 0x28], rsi
mov r8d, r15d
mov edx, r13d
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x1400f36bf
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x1400f363d
test byte [rcx + 0x1c], r13b
je 0x1400f363d
cmp byte [rcx + 0x19], 2
jb 0x1400f363d
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov dword [rsp + 0x28], ebx
mov r9d, r15d
mov qword [rsp + 0x20], rdi
call fcn.1400f2f64
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x1400f3669
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x14016f048]
mov qword [rsp + 0x88], r12
cmp rbp, 0xffffffffffffffff
je 0x1400f367f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f36a5
test byte [rcx + 0x1c], r13b
je 0x1400f36a5
cmp byte [rcx + 0x19], 5
jb 0x1400f36a5
mov rcx, qword [rcx + 0x10]
lea r8, [0x140153f98]
mov edx, 0x1a
call fcn.1400049d8
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r15, [0x14016f048]
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f3644
test byte [rcx + 0x1c], r13b
je 0x1400f3644
cmp byte [rcx + 0x19], 5
jb 0x1400f3644
mov rcx, qword [rcx + 0x10]
lea r8, [0x140153f98]
mov edx, 0x19
mov r9, rdi
call fcn.1400058d8
jmp 0x1400f3370