Function at 0x14010258c
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r12d, r12d
mov word [rbp + 0x2b], 0x500
lea rax, [rbp + 0xf]
mov qword [rbp + 0x1f], r12
mov qword [r11 - 0x68], rax
mov r13, rcx
mov dword [r11 - 0x70], r12d
lea rcx, [rbp + 0x27]
mov dword [r11 - 0x78], r12d
lea r8d, [r12 + 4]
mov dword [r11 - 0x80], r12d
mov ebx, r12d
mov dword [rsp + 0x30], r12d
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov dl, 1
mov dword [rsp + 0x20], r12d
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0xf], r12
mov qword [rbp + 7], r12
mov dword [rbp + 0x27], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140102646
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14010262c
mov edi, 0x80004005
jmp 0x14010263a
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
jmp 0x140102735
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x27]
mov dword [rsp + 0x48], r12d
mov dl, 1
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
lea r8d, [r9 + 6]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14010261b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x1f]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14010261b
mov rcx, qword [rbp + 0x1f]
lea r8, [rbp + 0x17]
call fcn.140104bd8
mov edi, eax
test eax, eax
jns 0x1401026c4
mov ecx, eax
call fcn.14007ac40
mov rbx, qword [rbp + 0x17]
jmp 0x140102735
mov rbx, qword [rbp + 0x17]
mov r15d, r12d
mov esi, r12d
mov r14d, r12d
cmp dword [rbx], r12d
jbe 0x14010272c
mov rcx, qword [rbp + 0xf]
mov r12d, r14d
add r12, r12
mov rdx, qword [rbx + r12*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1401026fd
xor r12d, r12d
mov r15d, 1
mov esi, r12d
jmp 0x14010271b
mov rdx, qword [rbx + r12*8 + 8]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
xor r12d, r12d
test eax, eax
je 0x14010271b
mov r15d, r12d
lea esi, [r12 + 1]
inc r14d
cmp r14d, dword [rbx]
jb 0x1401026d6
test esi, esi
jne 0x140102731
test r15d, r15d
jne 0x140102731
mov esi, 1
mov dword [r13], esi
mov ecx, edi
call fcn.14007ace8
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x14010274f
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp + 7], r12
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140102762
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp + 0xf], r12
test rbx, rbx
je 0x14010277b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x14010278a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140388a50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret