Function at 0x1000e46cc
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x168
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r14b, r9b
mov r15d, r8d
mov rbx, rdx
mov r13, rcx
mov rbp, qword [rsp + 0x1d0]
mov qword [rsp + 0x38], rbp
lea rsi, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000e4753
test byte [rcx + 0x1c], 1
je 0x1000e4753
cmp byte [rcx + 0x19], 5
jb 0x1000e4753
movzx eax, r9b
mov edx, 0x18
mov dword [rsp + 0x20], eax
mov r9d, r8d
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.10003be4c
xor r12d, r12d
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0xd0]
call fcn.1000e3524
nop
mov dword [rbp], r12d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov edi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000e47b3
test byte [rcx + 0x1c], 2
je 0x1000e47b3
cmp byte [rcx + 0x19], 4
jb 0x1000e47b3
lea edx, [r12 + 0x19]
mov r9d, eax
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rcx, qword [0x100153eb8]
cmp edi, 1
jne 0x1000e49bf
mov edi, r12d
mov rdx, qword [rsp + 0x30]
cmp rdx, r12
setne dil
cmp rcx, rsi
je 0x1000e4800
test byte [rcx + 0x1c], 2
je 0x1000e4800
cmp byte [rcx + 0x19], 4
jb 0x1000e4800
mov edx, 0x1a
mov r9d, edi
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x100153eb8]
cmp edi, 1
jne 0x1000e49bf
lea rcx, [rsp + 0xd0]
call fcn.1000e35b8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x50]
call fcn.1000e3524
nop
mov esi, r12d
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 8]
cmp eax, r12d
jbe 0x1000e494d
mov rax, qword [r13]
mov edx, esi
mov rcx, r13
call qword [rax + 0x20]
mov r12, rax
lea rbx, [rax + 8]
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x1000e48d3
mov ecx, dword [rbx + 0x50]
mov dword [rsp + 0xa0], ecx
lea rdx, [rbx + 0x58]
lea rcx, [rsp + 0xa8]
call fcn.100035ef8
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0xb0]
call fcn.100035ef8
lea rdx, [rbx + 0x68]
lea rcx, [rsp + 0xb8]
call fcn.100035ef8
mov r11b, byte [rbx + 0x4c]
mov byte [rsp + 0x9c], r11b
test r11b, r11b
je 0x1000e48d3
add rbx, 8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov r8, rbx
lea rdx, [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1000e4933
mov ebp, dword [r12 + 0x80]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
mov bl, al
mov r12b, byte [r12 + 0x84]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1000e491e
test bl, bl
jne 0x1000e491e
cmp ebp, r15d
jne 0x1000e491e
mov al, r14b
and al, r12b
cmp al, r14b
je 0x1000e49a7
inc esi
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 8]
cmp esi, eax
jae 0x1000e4948
jmp 0x1000e4847
call fcn.10004f74c
mov byte [rsp + 0x9c], 0
mov ecx, eax
call fcn.100036284
int3
mov rbp, qword [rsp + 0x38]
mov r9b, r14b
mov r8d, r15d
lea rdx, [rsp + 0xd0]
mov rcx, r13
call fcn.10003a384
movzx edi, al
mov rcx, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rcx, rsi
je 0x1000e499d
test byte [rcx + 0x1c], 2
je 0x1000e499d
cmp byte [rcx + 0x19], 4
jb 0x1000e499d
mov edx, 0x1b
mov r9d, edi
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
cmp edi, 1
jne 0x1000e49ae
mov dword [rbp], edi
jmp 0x1000e49ae
lea rsi, [0x100153eb8]
lea rcx, [rsp + 0x50]
call fcn.100039f38
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000e49e9
test byte [rcx + 0x1c], 1
je 0x1000e49e9
cmp byte [rcx + 0x19], 5
jb 0x1000e49e9
mov edx, 0x1c
mov r9d, edi
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
nop
lea rcx, [rsp + 0xd0]
call fcn.100039f38
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10011be80
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret