Function at 0x18001d3fc
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3f]
sub rsp, 0xa0
mov r12, qword [rbp + 0x77]
mov r15, rcx
mov rax, qword [rbp + 0x7f]
xor ecx, ecx
mov qword [rbp - 0x19], rcx
mov ebx, r9d
mov qword [rbp - 1], rcx
mov esi, ecx
mov dword [rbp + 0x5f], ecx
mov r13d, ecx
mov qword [rbp - 0x21], rcx
lea edi, [rcx + 1]
mov qword [rbp - 9], rcx
mov qword [rbp - 0x31], rcx
mov qword [rbp - 0x41], rcx
mov qword [rbp - 0x49], rcx
mov qword [rbp - 0x11], rcx
mov qword [rbp - 0x29], rcx
mov dword [rbp + 0x4f], ecx
mov qword [r12], rcx
mov dword [rax], ecx
cmp r9d, 2
je 0x18001d4a7
cmp ebx, 4
je 0x18001d48d
xor edx, edx
mov ecx, edi
mov r8d, 0x1c80
call fcn.180038d90
mov eax, 0xc000003e
jmp 0x18001da33
mov rcx, qword [rbp + 0x67]
lea r8, [rbp + 0x5f]
lea rdx, [rbp - 0x31]
call qword [sym.imp.SAMLIB.dll_SamGetMembersInAlias]
nop dword [rax + rax]
jmp 0x18001d4f5
mov rcx, qword [rbp + 0x67]
lea r9, [rbp + 0x5f]
lea r8, [rbp - 1]
lea rdx, [rbp - 0x19]
call qword [sym.imp.SAMLIB.dll_SamGetMembersInGroup]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
js 0x18001d936
mov edx, dword [rbp + 0x5f]
test edx, edx
je 0x18001d4f8
mov r8, qword [rbp - 0x19]
lea rax, [rbp - 9]
lea r9, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov rcx, r15
call qword [sym.imp.SAMLIB.dll_SamLookupIdsInDomain]
nop dword [rax + rax]
mov r14d, eax
test r14d, r14d
js 0x18001d936
cmp ebx, 2
jne 0x18001d60b
and qword [rbp + 0x77], rsi
lea r8, [rbp + 0x77]
lea edx, [rbx + 3]
mov rcx, r15
call qword [sym.imp.SAMLIB.dll_SamQueryInformationDomain]
nop dword [rax + rax]
xor r15d, r15d
mov ebx, r15d
cmp dword [rbp + 0x5f], r15d
jbe 0x18001d59f
mov rcx, qword [rbp - 0x21]
mov edx, ebx
add rdx, rdx
movzx r9d, word [rcx + rdx*8]
test r9w, r9w
je 0x18001d598
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x18001d585
movzx r10d, word [rax]
test r10w, r10w
je 0x18001d585
mov r8, qword [rax + 8]
test r8, r8
je 0x18001d585
mov eax, r9d
mov r9d, r10d
shr eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + rdx*8 + 8]
mov edx, edi
mov rcx, r12
shr r9d, 1
mov qword [rsp + 0x20], rax
call fcn.1800129f0
jmp 0x18001d598
mov rdx, qword [rcx + rdx*8 + 8]
mov r8d, r9d
shr r8d, 1
mov rcx, r12
call fcn.18000d4ec
add ebx, edi
cmp ebx, dword [rbp + 0x5f]
jb 0x18001d530
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, 8
mov rax, qword [rax + rdx*8]
test dword [rcx + rax], 0x800
jne 0x18001d5e4
mov r8, qword [r12]
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x77]
call fcn.18001d290
cmp eax, edi
jne 0x18001d5e4
mov rcx, qword [r12]
call fcn.1800119d0
mov qword [r12], r15
jmp 0x18001d5ea
mov rax, qword [rbp + 0x7f]
mov dword [rax], edi
mov rcx, qword [rbp + 0x77]
xor r12d, r12d
test rcx, rcx
je 0x18001d939
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
jmp 0x18001d939
mov r15, qword [rbp + 0x57]
lea rax, [rbp + 0x4f]
mov r8, qword [rbp + 0x6f]
lea r9, [rbp - 0x11]
mov qword [rsp + 0x28], rax
mov rdx, r15
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
call fcn.18005c17c
xor r12d, r12d
mov r14d, eax
test eax, eax
js 0x18001d7fd
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, 8
mov rax, qword [rax + rdx*8]
test dword [rcx + rax], 0x800
jne 0x18001d7fd
mov ebx, dword [rbp + 0x5f]
mov eax, dword [rbp + 0x4f]
cmp eax, ebx
jne 0x18001d810
mov r15d, r12d
test eax, eax
je 0x18001d7f4
mov esi, eax
mov rcx, qword [rbp - 0x29]
mov eax, r15d
cmp qword [rcx + rax*8], r13
je 0x18001d6dd
mov r12d, r13d
test ebx, ebx
je 0x18001d6dd
mov rcx, qword [rcx + rax*8]
test rcx, rcx
je 0x18001d6c2
mov rax, qword [rbp - 0x31]
mov edx, r12d
mov rdx, qword [rax + rdx*8]
test rdx, rdx
je 0x18001d6bf
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
mov ebx, dword [rbp + 0x5f]
test eax, eax
jne 0x18001d6d0
mov eax, r15d
add r12d, edi
cmp r12d, ebx
jae 0x18001d6dd
mov rcx, qword [rbp - 0x29]
jmp 0x18001d693
cmp r12d, ebx
jae 0x18001d6dd
add r15d, edi
cmp r15d, esi
jb 0x18001d67f
cmp r15d, dword [rbp + 0x4f]
mov r15, qword [rbp + 0x57]
mov rsi, qword [rbp - 0x49]
jae 0x18001d6ee
mov r13d, edi
xor r12d, r12d
mov rax, qword [rbp + 0x7f]
mov dword [rax], r13d
test r13d, r13d
je 0x18001d908
test ebx, ebx
je 0x18001d857
mov r8, qword [rbp - 0x31]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x41]
lea rax, [rbp - 0x39]
mov dword [rbp + 0x7f], r12d
mov edx, ebx
mov qword [rsp + 0x20], rax
mov rcx, r15
mov qword [rbp - 0x39], r12
call fcn.180062384
mov r13, qword [rbp - 0x39]
mov r14d, eax
test r13, r13
je 0x18001d848
mov ecx, ebx
shl ecx, 5
test ebx, ebx
je 0x18001d763
lea rdx, [r13 + 0xa]
mov r8d, ebx
movzx eax, word [rdx]
lea rdx, [rdx + 0x20]
add ecx, eax
sub r8, rdi
jne 0x18001d755
mov r15d, ecx
call fcn.180011ee0
mov rsi, rax
test rax, rax
je 0x18001d818
mov r8d, r15d
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r15d, ebx
shl r15, 5
add r15, rsi
mov eax, ebx
mov qword [rbp - 0x49], rax
test ebx, ebx
je 0x18001d837
mov r12, r13
lea rbx, [rsi + 0x18]
sub r12, rsi
mov r13d, eax
mov eax, dword [r12 + rbx - 0x18]
mov rcx, r15
mov dword [rbx - 0x18], eax
mov eax, dword [r12 + rbx]
mov dword [rbx], eax
movups xmm0, xmmword [r12 + rbx - 0x10]
movdqu xmmword [rbx - 0x10], xmm0
movzx r8d, word [r12 + rbx - 0x10]
mov rdx, qword [r12 + rbx - 8]
call sub.msvcrt.dll_memcpy
mov qword [rbx - 8], r15
movzx eax, word [r12 + rbx - 0xe]
lea rbx, [rbx + 0x20]
add r15, rax
sub r13, rdi
jne 0x18001d7a9
mov r13, qword [rbp - 0x39]
xor r12d, r12d
jmp 0x18001d837
mov r15, qword [rbp + 0x57]
jmp 0x18001d6f1
mov ebx, dword [rbp + 0x5f]
cmp r14d, 0xc0000017
je 0x18001d6f1
mov r14d, r12d
mov r13d, edi
jmp 0x18001d6f1
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x18001d831
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov qword [rbp - 0x41], r12
mov r14d, 0xc000009a
mov rcx, r13
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18001d84b
mov rsi, r12
test r14d, r14d
js 0x18001d908
mov ebx, dword [rbp + 0x5f]
mov qword [rbp - 0x49], r12
mov r15d, r12d
test ebx, ebx
je 0x18001d908
mov r12, qword [rbp + 0x77]
xor r13d, r13d
mov ebx, r15d
shl rbx, 5
mov r8d, r15d
mov eax, dword [rbx + rsi]
sub eax, 7
cmp eax, edi
jbe 0x18001da4f
cmp word [rbx + rsi + 8], r13w
jbe 0x18001da4f
mov rax, qword [rbp - 0x41]
mov edx, dword [rax]
test edx, edx
je 0x18001d90e
cmp dword [rsi], 5
je 0x18001d90e
mov r8, qword [rax + 8]
test r8, r8
je 0x18001d90e
movsxd rax, dword [rbx + rsi + 0x18]
cmp eax, 0xffffffff
je 0x18001d90e
cmp eax, edx
jae 0x18001d90e
lea rcx, [rax + rax*2]
mov rcx, qword [r8 + rcx*8 + 0x10]
call fcn.180013644
test eax, eax
je 0x18001d90e
movsxd rax, dword [rbx + rsi + 0x18]
mov edx, edi
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x41]
mov r8, qword [rax + 8]
movzx eax, word [rbx + rsi + 8]
shr eax, 1
mov dword [rsp + 0x28], eax
movzx r9d, word [r8 + rcx*8]
mov rax, qword [rbx + rsi + 0x10]
mov r8, qword [r8 + rcx*8 + 8]
mov rcx, r12
shr r9d, 1
mov qword [rsp + 0x20], rax
call fcn.1800129f0
jmp 0x18001d924
mov r13d, dword [rbp + 0x4f]
jmp 0x18001d939
movzx r8d, word [rbx + rsi + 8]
mov rcx, r12
mov rdx, qword [rbx + rsi + 0x10]
shr r8d, 1
call fcn.18000d4ec
test eax, eax
je 0x18001da8e
mov r14d, 0xc0000017
mov r13d, dword [rbp + 0x4f]
xor r12d, r12d
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x18001d94e
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x18001d963
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x18001d978
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x18001d98d
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x18001d9a2
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x18001d9b7
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test rsi, rsi
je 0x18001d9cb
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov r15, qword [rbp - 0x29]
test r15, r15
je 0x18001da0b
test r13d, r13d
je 0x18001d9fc
mov rbx, r15
mov esi, r13d
mov rcx, qword [rbx]
test rcx, rcx
je 0x18001d9f3
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
add rbx, 8
sub rsi, rdi
jne 0x18001d9df
mov rcx, r15
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
cmp qword [rbp - 0x11], r12
je 0x18001da30
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x11]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, r14d
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x31]
lea rdx, [rbp - 0x49]
mov rcx, qword [rcx + r8*8]
call fcn.1800131ec
test eax, eax
je 0x18001da8e
mov rbx, qword [rbp - 0x49]
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call fcn.18000d4ec
test rbx, rbx
je 0x18001da8a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov qword [rbp - 0x49], r13
add r15d, edi
cmp r15d, dword [rbp + 0x5f]
jb 0x18001d86d
jmp 0x18001d932