Function at 0x10001db98
Capabilities:
Compare security identifiers
Get file version info

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x1f0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x100081138]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
lea rcx, [0x100081100]
mov rax, qword [0x100081100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
mov r12, qword [0x100082860]
xor r13d, r13d
mov ebp, r13d
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x78], r13d
lea rdx, [rsp + 0x90]
mov rcx, r12
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
lea r14d, [r13 + 1]
cmp eax, r13d
je 0x10001dcb9
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
cmp rax, r13
je 0x10001dcb9
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, r12
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, r13d
je 0x10001dcab
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rdx, [0x100001f38]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
cmp eax, r13d
je 0x10001dcab
mov rdx, qword [rsp + 0x88]
movzx eax, word [rdx + 0x14]
movzx ecx, word [rdx + 0x16]
movzx r9d, word [rdx + 0x10]
movzx r8d, word [rdx + 0x12]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [0x10000b5c8]
lea rcx, [rsp + 0x68]
call fcn.10001ef50
mov ebp, r14d
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
cmp ebp, r13d
jne 0x10001dcdf
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x10000b5c8]
lea rcx, [rsp + 0x68]
call fcn.10001ef50
mov rbx, qword [rsp + 0x68]
lea rdx, [0x1000064c0]
mov ecx, r14d
call fcn.10001d2d8
call fcn.10001d9d8
mov r8, rbx
lea rdx, [0x1000088a8]
mov ecx, r14d
call fcn.10001d66c
mov edi, 0x11c
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xc0]
call sub.msvcrt.dll_memset
mov dword [rsp + 0xc0], edi
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebp, 2
cmp eax, r13d
jne 0x10001dd5d
mov dword [rsp + 0xc0], 0x114
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, r13d
je 0x10001de15
cmp dword [rsp + 0xd0], ebp
jne 0x10001dd6f
mov eax, dword [rsp + 0xcc]
jmp 0x10001dd77
movzx eax, word [rsp + 0xcc]
lea rcx, [rsp + 0xd4]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xc8]
mov r8d, dword [rsp + 0xc4]
lea rdx, [0x1000088d0]
mov ecx, r14d
call fcn.10001d66c
mov r8d, dword [rsp + 0xd0]
lea rax, [0x1000088fc]
lea r9, [0x100008904]
cmp r8d, ebp
cmove r9, rax
lea rdx, [0x100008910]
mov ecx, r14d
call fcn.10001d66c
movzx r9d, word [rsp + 0x1d6]
movzx r8d, word [rsp + 0x1d4]
lea rdx, [0x100008940]
mov ecx, r14d
call fcn.10001d66c
movzx r9d, byte [rsp + 0x1da]
movzx r8d, word [rsp + 0x1d8]
lea rdx, [0x100008970]
mov ecx, r14d
call fcn.10001d66c
lea rdx, [0x1000089b0]
mov ecx, r14d
call fcn.10001d2d8
mov edi, r13d
mov qword [rsp + 0x70], r13
mov rsi, r13
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x80], r13
mov byte [rsp + 0xb8], r13b
mov byte [rsp + 0xb9], r13b
mov byte [rsp + 0xba], r13b
mov byte [rsp + 0xbb], r13b
mov byte [rsp + 0xbc], r13b
mov byte [rsp + 0xbd], 5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x70]
mov edx, 0x20008
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r13d
je 0x10001df5a
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
mov edx, r14d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10001df5a
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
cmp rax, r13
je 0x10001df5a
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x60]
mov r8, rsi
mov edx, r14d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, r13d
je 0x10001df5a
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, r14b
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r13d
je 0x10001df5a
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb edi, edi
neg edi
add edi, r14d
mov rcx, qword [rsp + 0x80]
cmp rcx, r13
je 0x10001df6d
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp rsi, r13
je 0x10001df7b
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x70]
cmp rcx, r13
je 0x10001df8b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, r14d
je 0x10001dfb3
cmp edi, ebp
jne 0x10001dfa5
lea rdx, [0x1000089e0]
mov ecx, r14d
call fcn.10001d2d8
jmp 0x10001dfb3
lea rdx, [0x100008a30]
mov ecx, ebp
call fcn.10001d2d8
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
cmp rax, r13
je 0x10001e007
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], rcx
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0xa0]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
cmp eax, r13d
je 0x10001e007
mov eax, dword [rsp + 0xa8]
and eax, r14d
jne 0x10001e007
lea rdx, [0x100008ae0]
mov ecx, r14d
call fcn.10001d2d8
jmp 0x10001e017
lea rdx, [0x100008aa0]
mov ecx, r14d
call fcn.10001d2d8
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r13d
jg 0x10001e033
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.10005cbe0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret