Function at 0x140013b10
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
push rbp
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14d, edx
mov r15, rcx
cmp rcx, 0x1000
jb 0x140013f62
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x140013f62
mov r8d, dword [rcx]
xor edx, edx
mov qword [r11 + 0x18], rbx
mov ecx, 0x400
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r12
mov qword [r11 - 0x38], r13
xor r13d, r13d
mov edi, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
jne 0x140013be8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1400a1fd0], 4
mov ebx, eax
jbe 0x140013ba8
mov edx, dword [r15]
lea rcx, str.Unable_to_open_process_with_PID_u__error_u_n
mov r8d, eax
call fcn.140001d30
mov ecx, ebx
call fcn.14001ee80
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xa0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001250
add rsp, 0xc0
pop r15
pop r14
pop rbp
ret
lea r8, [rbp - 1]
mov edx, 8
mov rcx, r12
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140013f22
mov ecx, r14d
mov qword [rsp + 0xb8], rsi
mov rsi, r13
sub ecx, 1
je 0x140013c58
sub ecx, 1
je 0x140013c58
cmp ecx, 8
je 0x140013c3b
mov edx, r14d
lea rcx, str.Token_class_not_implemented:__d_n
call fcn.140001d30
mov ebx, 0xfffffff4
jmp 0x140013f0e
mov ebx, 0x38
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
lea edx, [rbx - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov rcx, qword [rbp - 1]
lea rax, [rbp - 0x19]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8, rsi
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140013cfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x7a
jne 0x140013cf6
mov ecx, r14d
mov edi, r13d
sub ecx, 1
je 0x140013c99
cmp ecx, 1
jne 0x140013cce
mov ebx, dword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140013cc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ebx, dword [rbp - 0x19]
test edi, edi
jne 0x140013ef2
mov rcx, qword [rbp - 1]
lea rax, [rbp - 0x19]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8, rsi
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140013cfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x140013ef2
sub r14d, 1
je 0x140013e5b
sub r14d, 1
je 0x140013d2d
cmp r14d, 8
jne 0x140013ef2
lea rdx, [rsi + 8]
mov r8d, r14d
lea rcx, [r15 + 0x10]
call sym.NetMonitor.exe_nocrt_memcpy
jmp 0x140013ef2
lea rax, [rbp - 0x11]
mov byte [r15 + 0x18], r13b
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 7]
mov dword [rsp + 0x48], r13d
xor r9d, r9d
mov dword [rsp + 0x40], r13d
mov dl, 1
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], r13d
mov dword [rbp + 7], r13d
mov word [rbp + 0xb], 0x500
mov qword [rbp - 0x11], r13
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140013d85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rbp - 9], r13
test edi, edi
jne 0x140013e34
lea rax, [rbp - 9]
mov dword [rbp + 0xf], r13d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0xf]
mov dword [rsp + 0x48], r13d
xor r9d, r9d
mov dword [rsp + 0x40], r13d
xor r8d, r8d
mov dword [rsp + 0x38], r13d
mov dl, 1
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov word [rbp + 0x13], 0x200
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140013de4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jne 0x140013e34
mov ebx, r13d
cmp dword [rsi], r13d
jbe 0x140013e34
nop dword [rax]
mov rdx, qword [rbp - 0x11]
mov r14d, ebx
add r14, r14
mov rcx, qword [rsi + r14*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140013e2f
mov rdx, qword [rbp - 9]
mov rcx, qword [rsi + r14*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140013e2f
test dword [rsi + r14*8 + 0x10], 0xc0000000
jne 0x140013e2f
inc ebx
cmp ebx, dword [rsi]
jb 0x140013df0
jmp 0x140013e34
mov byte [r15 + 0x18], 1
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140013e43
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140013ef2
call qword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x140013ef2
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov r14d, eax
test eax, eax
je 0x140013eba
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r14d
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [r15 + 8], rax
mov rdx, rax
mov r8, qword [rsi]
mov ecx, r14d
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x140013eac
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x140013ef2
lea edi, [rax + 0x7b]
jmp 0x140013ebf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
je 0x140013ef2
jmp 0x140013ebf
mov edi, pe_nt_image_headers64
mov edx, dword [r15]
lea rcx, str.Error_retrieving_SID_of_process_PID_u:__u_n
mov r8d, edi
call fcn.140001d30
mov rbx, qword [r15 + 8]
test rbx, rbx
je 0x140013ef2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [r15 + 8], r13
mov ebx, r13d
test rsi, rsi
je 0x140013f0e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0xb8]
jmp 0x140013f2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x140013f52
cmp dword [0x1400a1fd0], r13d
je 0x140013f49
mov edx, dword [r15]
lea rcx, str.Unable_to_query_token_information_for_PID_u__error_u_n
mov r8d, edi
call fcn.140001d30
mov ecx, edi
call fcn.14001ee80
mov ebx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140013baf
mov eax, 0xfffffffa
jmp 0x140013bcf