Function at 0x1400d4f20
Capabilities:
Compare security identifiers
Get disk information
Get token membership
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4b8
mov rdi, qword [0x14022c040]
mov r9d, 0xffffffff
mov r8d, 0x104
mov rax, qword [rdi]
mov qword [rsp + 0x4a8], rax
xor eax, eax
lea rsi, [rsp + 0x90]
mov rbx, rcx
mov r12, rdx
mov qword [rsp + 0x60], 0
mov rdx, rcx
mov rcx, rsi
mov qword [rsp + 0x68], 0
call fcn.1400d25c0
test eax, eax
js 0x1400d5130
xor r9d, r9d
mov r8d, 0x104
mov edx, eax
mov rcx, rsi
call fcn.1400d3b90
test eax, eax
js 0x1400d513e
cmp word [0x140255f00], 0
lea rbp, [0x140255f00]
je 0x1400d50f0
mov rdx, rbp
mov rcx, rsi
mov ebp, 1
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x1400d4ff8
mov rax, qword [rsp + 0x4a8]
sub rax, qword [rdi]
jne 0x1400d54c2
mov eax, ebp
add rsp, 0x4b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x60]
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov r8d, 5
mov edx, 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x1400d50d0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400d50d0
mov rsi, qword [sym.imp.ADVAPI32.dll_IsValidSid]
call rsi
test eax, eax
je 0x1400d50d0
mov rbp, qword [0x140255ef0]
test rbp, rbp
je 0x1400d532c
mov rcx, rbp
call rsi
test eax, eax
jne 0x1400d5310
mov rcx, qword [rsp + 0x60]
mov rbp, qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
mov edx, 0x1a
call rbp
test eax, eax
jne 0x1400d52d8
test r12, r12
je 0x1400d50d0
mov rcx, qword [rsp + 0x60]
mov edx, 1
call rbp
test eax, eax
je 0x1400d51d0
mov rcx, rbx
call fcn.1400db190
test eax, eax
jne 0x1400d5157
mov r8, rbx
lea rdx, str._s_is_on_a_file_system_that_does_not_record_ownership_n
mov rcx, r12
call fcn.14008fc00
nop dword [rax]
xor ebp, ebp
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400d4fca
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400d4fca
mov r8d, 0x104
mov rdx, rbp
lea rcx, str.HOME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x103
jbe 0x1400d4fb6
lea rdx, str.::N_A::
mov rcx, rbp
call sub.msvcrt.dll_wcscpy
jmp 0x1400d4fb6
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400d5148
xor ebp, ebp
jmp 0x1400d4fca
call rbx
xor ebp, ebp
mov dword [rax], 0x26
jmp 0x1400d4fca
lea rbp, [rsp + 0x2a0]
mov r9d, eax
mov r8d, 0x104
mov rdx, rbx
mov rcx, rbp
call fcn.1400d25c0
test eax, eax
jle 0x1400d50ba
lea rax, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x38], 0
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1400d50ba
test byte [rsp + 0x88], 8
je 0x1400d50ba
nop dword [rax]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea r15, str._inconvertible_
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov r14, r15
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call fcn.1400d01d0
mov rbp, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x80]
test eax, eax
mov r13, qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
cmovne r14, rbp
call r13
mov r8, r15
test eax, eax
je 0x1400d5244
mov r8, qword [rsp + 0x80]
mov r15, qword [0x140255ef0]
lea rax, [0x140205a2c]
mov r9, rax
test r15, r15
je 0x1400d5280
mov qword [rsp + 0x40], r8
mov rcx, r15
xor r15d, r15d
call rsi
mov r8, qword [rsp + 0x40]
mov edx, eax
lea rax, [0x140205a33]
test edx, edx
mov r9, rax
jne 0x1400d53a6
mov qword [rsp + 0x30], rax
lea rdx, str._s_is_owned_by:_n_t_s___s__nbut_the_current_user_is:_n_t_s___s__n
mov rcx, r12
mov qword [rsp + 0x28], r9
mov r9, r14
mov qword [rsp + 0x20], r8
mov r8, rbx
call fcn.14008fc00
mov rcx, rbp
call fcn.1400eaf30
mov rcx, qword [rsp + 0x80]
mov rbx, qword [sym.imp.KERNEL32.dll_LocalFree]
call rbx
mov rcx, r15
call fcn.1400eaf30
mov rcx, qword [rsp + 0x88]
call rbx
jmp 0x1400d50d0
xor ecx, ecx
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x5c]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400d5091
mov eax, dword [rsp + 0x5c]
test eax, eax
je 0x1400d5091
mov ebp, 1
jmp 0x1400d50d2
mov rdx, qword [0x140255ef0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1400d5076
jmp 0x1400d52fe
mov dword [rsp + 0x80], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x88]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400d5396
lea r14, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x20], r14
mov rbp, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, 1
call rbp
test eax, eax
je 0x1400d540c
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140255ef0], 0
jmp 0x1400d5076
mov rcx, qword [0x140255ef0]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x48], r8
lea rsi, str._inconvertible_
call fcn.1400d01d0
mov r15, qword [rsp + 0x78]
mov r9, rsi
lea rdx, [rsp + 0x88]
test eax, eax
mov rcx, qword [0x140255ef0]
cmovne r9, r15
mov qword [rsp + 0x40], r9
call r13
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov edx, eax
mov rax, rsi
test edx, edx
je 0x1400d5280
mov rax, qword [rsp + 0x88]
jmp 0x1400d5280
mov ecx, dword [rsp + 0x80]
call fcn.1400bd0a0
mov qword [rsp + 0x20], r14
mov edx, 1
mov r9d, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov r13, rax
mov r8, rax
call rbp
test eax, eax
jne 0x1400d5464
mov rcx, r13
call fcn.1400eaf30
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140255ef0], 0
jmp 0x1400d5076
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov dword [rsp + 0x80], eax
call fcn.1400bd0a0
mov r8, qword [r13]
mov ecx, dword [rsp + 0x80]
mov rbp, rax
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1400d54c7
mov rcx, r13
call fcn.1400eaf30
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140255ef0], rbp
test rbp, rbp
je 0x1400d5076
jmp 0x1400d5069
call fcn.1401d96b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_copy_SID___ld_
mov r14d, eax
mov rax, qword [str.PF__]
cmp dword [rax], 0
je 0x1400d54eb
call fcn.1401d81b8
mov rcx, rax
mov edx, r14d
call fcn.1400b6bf0
mov rcx, rbp
call fcn.1400eaf30
jmp 0x1400d543e