Function at 0x140037750
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1401d2670]
xor rax, rsp
mov qword [rbp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
lea r12, vtable.ATL::CAccessToken.0
mov qword [rbp - 0x18], r12
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rbp - 0x20]
mov edx, 8
lea r8d, [rdx - 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x140037cf6
mov rax, qword [rbp - 0x18]
lea rcx, [rbp - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x14005b496.0]
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x60], xmm0
lea r14, vtable.ATL::CTokenGroups.0
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov dword [rbp + 0x28], SafeArrayAccessData
mov dword [rbp + 0x48], 0
mov dword [rbp + 0x4c], 0xa
movdqa xmmword [rbp + 0x50], xmm0
movss xmm1, dword [0x14016aa8c]
movss dword [rbp + 0x2c], xmm1
movss xmm0, dword [0x14016aa88]
movss dword [rbp + 0x30], xmm0
movss xmm1, dword [0x14016aa90]
movss dword [rbp + 0x34], xmm1
mov qword [rbp + 0x38], 0x26
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x60], 0
mov byte [rbp + 0x68], 1
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x18]
call fcn.140037360
test al, al
je 0x140037ced
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x48], esi
xor edi, edi
mov qword [rsp + 0x38], rdi
xor r13d, r13d
mov qword [rsp + 0x40], r13
cmp qword [rbp + 0x20], r13
je 0x140037b74
xor eax, eax
mov r14d, dword [rbp + 0x28]
test r14d, r14d
je 0x140037a0b
mov r15, qword [rbp + 0x18]
nop dword [rax + rax]
cmp qword [r15 + rax*8], 0
jne 0x1400378e3
inc eax
cmp eax, r14d
jb 0x1400378d0
jmp 0x140037a0b
mov rbx, qword [r15 + rax*8]
nop word [rax + rax]
mov qword [rsp + 0x58], rbx
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x140037906
mov rbx, rax
jmp 0x140037923
xor edx, edx
mov eax, dword [rbx + 0x88]
div r14d
inc edx
xor ebx, ebx
cmp edx, r14d
jae 0x140037923
mov rbx, qword [r15 + rdx*8]
test rbx, rbx
je 0x140037911
cmp rdi, r13
jb 0x1400379e2
lea r12, [rdi + 1]
cmp r12, r13
jbe 0x1400379e2
lfence
test rsi, rsi
jne 0x14003796c
lea edx, [rsi + 0x78]
mov rcx, r12
call fcn.1401160a4
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140037d17
mov r13, r12
mov qword [rsp + 0x40], r12
mov rdi, qword [rsp + 0x38]
jmp 0x1400379da
mov rdx, qword [rsp + 0x40]
mov rcx, rdx
shr rcx, 1
mov rax, r12
sub rax, rdx
cmp rax, rcx
cmovbe rax, rcx
add rax, rdx
mov r13, r12
cmp r12, rax
cmovb r13, rax
mov edx, 0x78
mov rcx, r13
call fcn.1401160a4
mov rsi, rax
test rax, rax
je 0x140037d17
mov rdi, qword [rsp + 0x38]
imul r8, rdi, 0x78
mov r14, qword [rsp + 0x30]
test r8, r8
je 0x1400379c8
mov rdx, r14
mov rcx, rax
call fcn.140137fe0
mov rcx, r14
call fcn.140115f98
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r13
mov r15, qword [rbp + 0x18]
mov r14d, dword [rbp + 0x28]
imul rcx, rdi, 0x78
add rcx, rsi
mov rdx, qword [rsp + 0x58]
call fcn.140036690
inc rdi
mov qword [rsp + 0x38], rdi
test rbx, rbx
jne 0x1400378f0
lea r12, vtable.ATL::CAccessToken.0
xor r14d, r14d
test rdi, rdi
je 0x140037b6d
lea r15, vtable.ATL::CSid.0
nop
mov dword [rsp + 0x20], 0x220
mov r9d, 0x20
lea r8d, [r9 - 0x1e]
lea rdx, [0x14016a8dc]
lea rcx, [rsp + 0x60]
call fcn.1400364c0
nop
cmp r14, rdi
jae 0x140037ce2
mov rax, rsi
inc r14
add rsi, 0x78
lea rbx, [rax + 8]
test rbx, rbx
je 0x140037aa3
cmp byte [rax + 0x4c], 0
je 0x140037aa3
lfence
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140037aa3
cmp byte [rbp - 0x54], 0
je 0x140037aa3
lea rcx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140037aa3
lfence
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne bl
jmp 0x140037aa5
xor bl, bl
mov qword [rsp + 0x60], r15
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037ad4
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005b496.0]
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037afe
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005b496.0]
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037b28
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005b496.0]
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037b52
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005b496.0]
test bl, bl
jne 0x140037c34
mov rdi, qword [rsp + 0x38]
cmp r14, rdi
jb 0x140037a20
mov rsi, qword [rsp + 0x30]
lea r14, vtable.ATL::CTokenGroups.0
test rsi, rsi
je 0x140037ba5
test rdi, rdi
je 0x140037b9c
mov rbx, rsi
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14005b496.0]
add rbx, 0x78
sub rdi, 1
jne 0x140037b81
mov rcx, rsi
call fcn.140115f98
nop
mov qword [rbp + 0x10], r14
mov rcx, qword [rbp + 0x60]
call fcn.140115f98
lea rcx, [rbp + 0x18]
call fcn.1400367f0
nop
mov qword [rbp - 0x18], r12
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
test rdx, rdx
je 0x140037be4
test rcx, rcx
je 0x140037bdc
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 8], 0
test rcx, rcx
je 0x140037bf7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x10], 0
mov edx, 8
mov rcx, qword [rbp]
call fcn.140144a10
xor al, al
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1401449b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x140037c74
mov rbx, rsi
mov rdi, qword [rsp + 0x38]
nop word [rax + rax]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14005b496.0]
add rbx, 0x78
sub rdi, 1
jne 0x140037c50
mov rcx, rsi
call fcn.140115f98
nop
lea rax, vtable.ATL::CTokenGroups.0
mov qword [rbp + 0x10], rax
mov rcx, qword [rbp + 0x60]
call fcn.140115f98
lea rcx, [rbp + 0x18]
call fcn.1400367f0
nop
mov qword [rbp - 0x18], r12
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
test rdx, rdx
je 0x140037cba
test rcx, rcx
je 0x140037cb2
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 8], 0
test rcx, rcx
je 0x140037ccd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x10], 0
mov edx, 8
mov rcx, qword [rbp]
call fcn.140144a10
mov al, 1
jmp 0x140037c07
mov ecx, 0x80070057
call fcn.140036ed0
nop
lea rcx, [rbp + 0x10]
call fcn.1400369a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x80070000
mov dword [rsp + 0x50], eax
lea rdx, [0x1401cd580]
lea rcx, [rsp + 0x50]
call fcn.140137f0c
nop
mov ecx, 0x8007000e
call fcn.140036ed0
int3