Function at 0x1400f2868
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov rsi, r8
mov ebx, r12d
mov r14, rdx
mov rdi, rcx
mov rcx, qword [0x14016d090]
lea r15, [0x14016d090]
lea r13d, [r12 + 1]
cmp rcx, r15
je 0x1400f28cb
test byte [rcx + 0x1c], r13b
je 0x1400f28cb
cmp byte [rcx + 0x19], 5
jb 0x1400f28cb
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x11]
lea r8, [0x140152fc8]
call fcn.140004968
mov rcx, qword [0x14016d090]
or rbp, 0xffffffffffffffff
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x88], r12
cmp rcx, r15
je 0x1400f290d
test byte [rcx + 0x1c], r13b
je 0x1400f290d
cmp byte [rcx + 0x19], 5
jb 0x1400f290d
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x13]
mov r9, rdi
lea r8, [0x140152fc8]
call fcn.140005868
mov rcx, qword [0x14016d090]
test r14, r14
jne 0x1400f2958
test rsi, rsi
jne 0x1400f2958
mov ebx, 0x80070057
cmp rcx, r15
je 0x1400f2c20
test byte [rcx + 0x1c], r13b
je 0x1400f2c20
cmp byte [rcx + 0x19], 2
jb 0x1400f2c20
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x13]
lea r8, [0x140152fc8]
call fcn.140004968
mov rcx, qword [0x14016d090]
jmp 0x1400f2c20
mov eax, 3
mov qword [rsp + 0x30], r12
mov r8d, eax
mov dword [rsp + 0x28], 0x2200000
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov edx, 0x60000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f29e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x1400f2c20
test byte [rcx + 0x1c], r13b
je 0x1400f2c20
cmp byte [rcx + 0x19], 2
jb 0x1400f2c20
lea edx, [rbp + 0x15]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140152fc8]
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.1400058c8
jmp 0x1400f294c
test rsi, rsi
je 0x1400f2a63
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8d, 0x80000004
mov edx, r13d
mov qword [rsp + 0x20], r12
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x1400f2a63
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x1400f2c20
test byte [rcx + 0x1c], r13b
je 0x1400f2c20
cmp byte [rcx + 0x19], 2
jb 0x1400f2c20
mov rcx, qword [rcx + 0x10]
mov edx, 0x15
mov dword [rsp + 0x28], ebx
mov r9d, 0x80000004
mov qword [rsp + 0x20], rdi
call fcn.1400f2540
jmp 0x1400f294c
test r14, r14
je 0x1400f2ca2
lea rax, [rsp + 0x88]
mov r8d, r13d
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x98]
mov qword [rsp + 0x30], r12
mov edx, r13d
mov qword [rsp + 0x28], r12
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x1400f2ae5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x1400f2c20
test byte [rcx + 0x1c], r13b
je 0x1400f2c20
cmp byte [rcx + 0x19], 2
jb 0x1400f2c20
mov edx, 0x16
jmp 0x1400f29c6
mov rcx, qword [rsp + 0x98]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400f2ca2
mov rax, rsi
mov rcx, rbp
neg rax
sbb r15d, r15d
and r15d, 0x80000004
add r15d, r13d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
mov r8d, 3
mov rax, rsi
mov dword [rsp + 0x28], 0x2200000
neg rax
mov dword [rsp + 0x20], r8d
mov rcx, rdi
sbb edx, edx
xor r9d, r9d
and edx, 0x40000
add edx, 0xa0000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f2ba2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016d090]
lea r15, [0x14016d090]
cmp rcx, r15
je 0x1400f2c20
test byte [rcx + 0x1c], r13b
je 0x1400f2c20
cmp byte [rcx + 0x19], 2
jb 0x1400f2c20
lea edx, [rbp + 0x18]
jmp 0x1400f29c6
mov qword [rsp + 0x30], r12
mov r9, r14
mov qword [rsp + 0x28], rsi
mov r8d, r15d
mov edx, r13d
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x1400f2c9b
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400f2c19
test byte [rcx + 0x1c], r13b
je 0x1400f2c19
cmp byte [rcx + 0x19], 2
jb 0x1400f2c19
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov dword [rsp + 0x28], ebx
mov r9d, r15d
mov qword [rsp + 0x20], rdi
call fcn.1400f2540
mov rcx, qword [0x14016d090]
lea r15, [0x14016d090]
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x1400f2c45
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x14016d090]
mov qword [rsp + 0x88], r12
cmp rbp, 0xffffffffffffffff
je 0x1400f2c5b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x1400f2c81
test byte [rcx + 0x1c], r13b
je 0x1400f2c81
cmp byte [rcx + 0x19], 5
jb 0x1400f2c81
mov rcx, qword [rcx + 0x10]
lea r8, [0x140152fc8]
mov edx, 0x1a
call fcn.140004968
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r15, [0x14016d090]
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x1400f2c20
test byte [rcx + 0x1c], r13b
je 0x1400f2c20
cmp byte [rcx + 0x19], 5
jb 0x1400f2c20
mov rcx, qword [rcx + 0x10]
lea r8, [0x140152fc8]
mov edx, 0x19
mov r9, rdi
call fcn.140005868
jmp 0x1400f294c