Function at 0x14000f760
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movaps xmmword [rsp + 0x180], xmm6
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x48], r8d
mov ebp, edx
mov rbx, rcx
mov sil, byte [rsp + 0x200]
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x178], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x108], 7
mov word [rsp + 0x10c], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r14, rax
test rbx, rbx
jne 0x140010666
lea r8, [rsp + 0x130]
mov rcx, r14
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14001069a
lea rbx, [rsp + 0x100]
mov rdx, qword [rsp + 0x130]
xor byte [rcx], al
add byte [rax], al
mov rcx, rbx
call fcn.14000cb00
mov byte [rbx + 0xc], 1
mov rbx, qword [rsp + 0x208]
test sil, sil
je 0x14000f859
mov byte [rsp + 0x10d], 1
test rbx, rbx
je 0x14000f8ea
xorps xmm0, xmm0
lea r14, [rsp + 0x130]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov dword [r14 + 0x40], 0
mov ecx, 0x44
mov rdx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
lea r15, [rsp + 0xa0]
mov rcx, r15
mov rdx, r14
mov r8d, 0x10000000
call fcn.140011380
lea r9, [rsp + 0x80]
mov dword [r9], 0x44
add dword [rax + rax], eax
add byte [rbp + rcx*4 - 0x4c], cl
and al, 0x30
add dword [rax], eax
add byte [rcx + 0x47], bh
xor edx, edx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rcx, r15
mov rdx, r14
mov r8d, 0x20000
call fcn.140011380
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm0
cmp ebp, 7
ja case.default.0x14000f92a
mov r13b, byte [rsp + 0x210]
mov eax, ebp
lea rcx, [0x140055cd8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
test r13b, r13b
je case.0x14000f92a.7
cmp byte [rsp + 0x10c], 0
je 0x140010eee
lea rcx, [rsp + 0xa0]
call fcn.140011610
test eax, eax
jne 0x14000fbb1
lea r14, [rsp + 0x130]
mov qword [r14], 0
add byte [rax - 0x75], cl
mov word [rax + rax], fs
add dword [rax], eax
add byte [rdx + 2], bh
mov r8, r14
call fcn.1400112b0
mov r14, qword [r14]
test eax, eax
jne 0x1400104b6
test r14, r14
je case.0x14000f92a.7
mov eax, dword [r14]
test eax, eax
je 0x14000fa56
lea rsi, [r14 + 0x10]
xor edi, edi
xorps xmm6, xmm6
lea rbx, [rsp + 0x130]
mov r12, qword [sym.imp.ADVAPI32.dll_CopySid]
lea r15, [rsp + 0xa0]
test byte [rsi], 0x20
jne 0x14000fa44
mov r8, qword [rsi - 8]
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
mov dword [rsp + 0x170], 0
add byte [rax], al
add byte [rax], al
add byte [rcx + 0x44], bh
mov rdx, rbx
call r12
cmp byte [rsp + 0x10c], 0
je 0x14000fa41
mov rdx, qword [rsp + 0xa8]
cmp rdx, qword [rsp + 0xb0]
jne 0x14000fa27
mov rcx, r15
mov r8, rbx
call fcn.140011090
jmp 0x14000fa41
mov r8d, 0x44
mov rcx, rdx
mov rdx, rbx
call sub.ntdll.dll_memcpy
add qword [rsp + 0xa8], 0x44
mov eax, dword [r14]
inc rdi
mov ecx, eax
add rsi, 0x10
cmp rdi, rcx
jb 0x14000f9bb
mov rcx, r14
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
mov r14, qword [rsp + 0x218]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0x4c]
test eax, eax
jne 0x14000fb98
cmp byte [rsp + 0x10c], 0
je 0x140010efa
lea rdx, [rsp + 0x130]
mov qword [rdx], 0
lea rcx, [rsp + 0xa0]
call fcn.140011710
test eax, eax
jne 0x140010f14
mov rcx, qword [rsp + 0x130]
lea r8, [rsp + 0x128]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x140010f0e
mov rdx, qword [rsp + 0x128]
lea rsi, [rsp + 0x120]
mov qword [rsi], 0
mov rcx, rsi
call fcn.14000cb00
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbx
mov rdi, rax
mov rsi, qword [rsi]
call rbx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0xf01ff
lea r9, [rsp + 0x118]
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140010f1b
mov rdx, qword [rsp + 0x118]
mov rcx, r14
call fcn.14000cb00
mov rsi, qword [rsp + 0x120]
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140010472
mov rsi, qword [rsp + 0x130]
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14000fbb3
call fcn.14000cc10
mov r8, qword [rsp + 0x1d8]
lea rdi, [rsp + 0x130]
mov rcx, rsi
mov rdx, rdi
mov r9, rax
call fcn.140001040
mov rcx, qword [rdi]
call fcn.140001c00
jmp 0x14000fbb3
cmp eax, 1
jne 0x140010f04
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.140011710
mov ebp, eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x1400101ba
mov rsi, qword [rsp + 0x80]
test rsi, rsi
jne 0x1400101d9
mov rsi, qword [rsp + 0x100]
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140010183
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14000fc28
mov rdx, qword [rsp + 0xf8]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14001080b
cmp esi, 0xb
add byte [rax], al
lea rsi, [rsp + 0xe8]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
add al, 0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14000fc68
mov rdx, qword [rsp + 0xe0]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x140010eac
lea rsi, [rsp + 0xd0]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14000fca8
mov rdx, qword [rsp + 0xc8]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x140010ecd
lea rsi, [rsp + 0xb8]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14000fcd2
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14001082c
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14002ef70
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0xa0]
call fcn.14002fca0
test r13b, r13b
je 0x14000fd96
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r14, [rsp + 0x130]
xor ecx, ecx
xor edx, edx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.140011040
test rbx, rbx
je 0x14000fd96
xorps xmm0, xmm0
lea r14, [rsp + 0x130]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov dword [r14 + 0x40], 0
mov ecx, 0x44
mov rdx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.140011040
mov ebp, 0x3f0
cmp byte [rsp + 0x10c], 0
je 0x14000fbb3
lea r14, [rsp + 0x130]
mov qword [r14], 0
mov rcx, qword [rsp + 0x100]
mov edx, 2
mov r8, r14
call fcn.1400112b0
mov r14, qword [r14]
test eax, eax
jne 0x1400104b6
test r14, r14
je 0x14000ff00
cmp dword [r14], 0
je 0x14000fef8
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rax, rdi
sub rax, rsi
sar rax, 2
movabs r13, 0xf0f0f0f0f0f0f0f1
imul r13, rax
xor ebp, ebp
xorps xmm6, xmm6
lea r12, [rsp + 0x130]
mov rax, rbp
shl rax, 4
test dword [r14 + rax + 0x10], 0xc0000020
jne 0x14000fe97
lea rbx, [r14 + rax]
add rbx, 8
cmp rdi, rsi
jne 0x14000fea8
mov r8, qword [rbx]
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
mov dword [rsp + 0x170], 0
mov ecx, 0x44
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov rdx, qword [rsp + 0xd8]
cmp rdx, qword [rsp + 0xe0]
jne 0x14000fedc
lea rcx, [rsp + 0xd0]
mov r8, r12
call fcn.140011090
inc rbp
mov eax, dword [r14]
cmp rbp, rax
jb 0x14000fe1a
jmp 0x14000fef8
mov r15d, 1
xor eax, eax
mov rdx, qword [rbx]
mov rcx, rax
shl rcx, 6
lea rcx, [rcx + rax*4]
add rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14000fe97
mov eax, r15d
inc r15d
cmp r13, rax
jbe 0x14000fe39
jmp 0x14000feb0
mov r8d, 0x44
mov rcx, rdx
mov rdx, r12
call sub.ntdll.dll_memcpy
add qword [rsp + 0xd8], 0x44
jmp 0x14000fe97
mov rcx, r14
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
cmp byte [rsp + 0x10c], 0
mov ebp, 0x3f0
je 0x14000fbb3
lea r14, [rsp + 0x130]
mov qword [r14], 0
mov rcx, qword [rsp + 0x100]
mov edx, 3
mov r8, r14
call fcn.1400112b0
mov r14, qword [r14]
test eax, eax
jne 0x1400104b6
test r14, r14
je case.0x14000f92a.7
cmp dword [r14], 0
je 0x14000fa56
mov r15, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
xor esi, esi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], r15
mov rdx, r15
cmp rbx, r15
jne 0x1400100a7
lea rax, [rsi + rsi*2]
lea rbp, [r14 + rax*4]
add rbp, 4
mov rbx, qword [rsp + 0xc0]
cmp rbx, qword [rsp + 0xc8]
jne case.0x1400260f8.33
mov r15, rbx
sub r15, qword [rsp + 0xb8]
sar r15, 3
lea r13, [r15 + 1]
mov rdi, r15
shr rdi, 1
movabs rcx, 0x1fffffffffffffff
mov rax, rcx
sub rax, rdi
add rdi, r15
cmp rdi, r13
cmovbe rdi, r13
cmp r15, rax
cmova rdi, rcx
cmp rdi, rcx
ja 0x140010511
lea rcx, [rdi*8]
cmp rdi, 0x200
mov qword [rsp + 0x58], rdx
jae 0x1400104e3
test rdi, rdi
je 0x140010536
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r12, rax
mov rax, qword [rbp]
mov qword [r12 + r15*8], rax
mov rdx, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov r8, rbx
sub r8, rdx
mov rcx, r12
call sub.ntdll.dll_memmove
cmp rbp, rbx
jne 0x140010516
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x140010066
mov rdx, qword [rsp + 0xc8]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14001084d
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov qword [rsp + 0xb8], r12
lea rax, [r12 + r13*8]
mov qword [rsp + 0xc0], rax
lea rax, [r12 + rdi*8]
mov qword [rsp + 0xc8], rax
mov r15, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
inc rsi
mov eax, dword [r14]
mov rbx, rdx
cmp rsi, rax
jb 0x14000ff71
jmp 0x14000fa56
mov qword [rsp + 0x130], 0
cmp qword [r15 + 0x18], 8
mov rdx, r15
jb 0x1400100c0
mov rdx, qword [r15]
lea rax, [rsi + rsi*2]
lea rdi, [r14 + rax*4]
add rdi, 4
xor ecx, ecx
lea r8, [rsp + 0x130]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [rdi + 4]
cmp eax, dword [rsp + 0x134]
jne 0x1400100f7
mov eax, dword [rdi]
cmp eax, dword [rsp + 0x130]
je 0x14001017b
mov rax, qword [rsp + 0x40]
mov rbx, rax
sub rbx, r15
mov rdx, rax
cmp rbx, 0x21
jb 0x14000ff7d
mov edx, 1
mov ebp, 2
mov qword [rsp + 0x130], 0
shl rdx, 5
cmp qword [r15 + rdx + 0x18], 8
jb 0x140010137
mov rdx, qword [r15 + rdx]
jmp 0x14001013a
add rdx, r15
xor ecx, ecx
lea r8, [rsp + 0x130]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [rdi + 4]
cmp eax, dword [rsp + 0x134]
jne 0x140010165
mov eax, dword [rdi]
cmp eax, dword [rsp + 0x130]
xor byte [rcx], al
add byte [rax], al
je 0x1400104a2
mov rax, rbx
sar rax, 5
add eax, 0xc5ffea89
cmp rax, rdx
jbe 0x1400104ac
jmp 0x140010119
mov rdx, rbx
jmp 0x140010090
invalid
invalid
invalid
invalid
lea rdi, [rsp + 0x100]
call fcn.14000cc10
mov r8, qword [rsp + 0x1d8]
mov rcx, rsi
mov rdx, rdi
mov r9, rax
call fcn.140001040
mov rcx, qword [rdi]
call fcn.140001c00
mov qword [rdi], 0
jmp 0x14000fbe8
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x140010f28
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000fbc1
mov rdi, qword [rsp + 0x88]
cmp rsi, rdi
invalid
je 0x14001022e
mov rbx, rsi
mov rax, qword [rbx + 0x18]
cmp rax, 8
jb 0x140010210
mov rcx, qword [rbx]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jae 0x140010f49
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 7
mov word [rbx], 0
add rbx, 0x20
cmp rbx, rdi
jne 0x1400101e9
mov rdx, qword [rsp + 0x90]
sub rdx, rsi
cmp rdx, 0x1000
jae 0x140010f70
mov rcx, rsi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000fbd2
mov edi, 0x44
lea r12, [rsp + 0x128]
mov dword [r12], edi
mov rsi, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea r14, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r14
mov r9, r12
call rsi
lea r15, [rsp + 0x60]
mov rcx, r15
xor edx, edx
mov r8, r14
call fcn.140011090
mov r14, qword [r15 + 8]
mov r15, qword [r15 + 0x10]
mov dword [r12], edi
lea r8, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 1
xor edx, edx
call rsi
cmp r14, r15
jne 0x140010f91
lea r12, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r12
mov rdx, r15
call fcn.140011090
mov r14, qword [r12 + 8]
mov r15, qword [r12 + 0x10]
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, r15
jne 0x140010fb5
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rdx, r15
call fcn.140011090
xor eax, eax
lea r14, [rsp + 0x130]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, r14
call fcn.14000c9e0
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, r14
call fcn.14002fe20
mov rax, qword [r14 + 0x18]
cmp rax, 8
jae 0x140010fd9
test r13b, r13b
je 0x140011020
mov edi, 0x44
lea r15, [rsp + 0x128]
mov dword [r15], edi
lea r12, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r12
mov r9, r15
call rsi
lea r14, [rsp + 0xa0]
mov rcx, r14
mov rdx, r12
call fcn.140011040
mov dword [r15], edi
lea r15, [rsp + 0x130]
lea r12, [rsp + 0x128]
mov ecx, 1
xor edx, edx
mov r8, r15
mov r9, r12
call rsi
mov rcx, r14
mov rdx, r15
call fcn.140011040
mov dword [r12], edi
lea r15, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 0x12
xor edx, edx
mov r8, r15
call rsi
mov rcx, r14
mov rdx, r15
call fcn.140011040
test rbx, rbx
je 0x140010460
xorps xmm0, xmm0
lea r14, [rsp + 0x130]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov dword [r14 + 0x40], 0
mov ecx, 0x44
mov rdx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
lea rcx, [rsp + 0xa0]
add byte [rax], al
mov rdx, r14
call fcn.140011040
lea rcx, [rsp + 0xa0]
call fcn.140011e40
jmp 0x14000fd96
call fcn.14000cc10
mov r8, qword [rsp + 0x1d8]
lea rdi, [rsp + 0x120]
mov rcx, rsi
mov rdx, rdi
mov r9, rax
call fcn.140001040
mov rcx, qword [rdi]
call fcn.140001c00
jmp 0x14000fb59
mov rbx, qword [rsp + 0x40]
jmp 0x14001017b
mov rdx, qword [rsp + 0x40]
jmp 0x14000ff7d
mov ebp, eax
test r14, r14
je 0x14000fbb3
mov rcx, r14
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x14000fbb3
mov rax, qword [rbp]
mov qword [rbx], rax
add qword [rsp + 0xc0], 8
add byte [rax], al
add byte [rax], cl
jmp 0x140010090
movabs rax, 0x1fffffffffffffff
add rax, 0xfffffffffffffffd
cmp rdi, rax
jae 0x140010511
add rcx, 0x27
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
add byte [rbp + rcx*4 + 0x60], cl
invalid
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x14001000d
call fcn.1400336d0
lea rcx, [r12 + r15*8]
add rcx, 8
mov r8, qword [rsp + 0xc0]
sub r8, rbx
mov rdx, rbx
call sub.ntdll.dll_memmove
jmp 0x14001003c
xor r12d, r12d
jmp 0x14001000d
mov esi, 0x44
lea r15, [rsp + 0x128]
mov dword [r15], esi
mov rdi, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea rbx, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, rbx
mov r9, r15
call rdi
lea r12, [rsp + 0x60]
mov rcx, r12
xor edx, edx
mov r8, rbx
call fcn.140011090
mov r14, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
mov dword [r15], esi
lea r8, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 1
xor edx, edx
call rdi
cmp r14, rbx
jne 0x14001086e
lea r15, [rsp + 0x60]
lea r8, [rsp + 0x130]
add dword [rax], eax
add byte [rcx + rcx*4 - 7], cl
mov rdx, rbx
call fcn.140011090
mov r14, qword [r15 + 8]
ja 0x1400105d1
mov rbx, qword [r15 + 0x10]
jmp 0x14001088d
mov esi, 0x44
lea r15, [rsp + 0x128]
mov dword [r15], esi
mov rbp, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea rbx, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, rbx
mov r9, r15
call rbp
lea r12, [rsp + 0x60]
mov rcx, r12
xor edx, edx
mov r8, rbx
call fcn.140011090
mov r14, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
mov dword [r15], esi
lea r8, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 1
xor edx, edx
call rbp
cmp r14, rbx
jne 0x1400109ed
add byte [rax], al
lea r15, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r15
mov rdx, rbx
call fcn.140011090
mov r14, qword [r15 + 8]
mov rbx, qword [r15 + 0x10]
jmp 0x140010a0c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
add byte [rbp + rcx*4 - 0x74], cl
and al, 0x30
add dword [rax], eax
add byte [rax - 0x77], cl
ror dword [rax - 0x77], 0xda
mov r8, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x14000f820
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp case.0x140018327.64
lahf
int1
invalid
invalid
mov ebp, 0xa0
jmp 0x14000fbd2
xor eax, eax
lea r14, [rsp + 0x130]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, r14
call fcn.14000c9e0
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, r14
call fcn.14002fe20
mov rax, qword [r14 + 0x18]
cmp rax, 8
jb 0x14001073e
mov rcx, qword [rsp + 0x130]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140010739
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001101a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
lea rcx, [rsp + 0xa0]
call fcn.14002fca0
test r13b, r13b
je 0x14000fd96
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r14, [rsp + 0x130]
mov ecx, 0x12
jmp 0x14000fd2f
mov edi, 0x44
lea r12, [rsp + 0x128]
mov dword [r12], edi
mov rsi, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea r14, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r14
mov r9, r12
call rsi
lea rbp, [rsp + 0x60]
mov rcx, rbp
xor edx, edx
mov r8, r14
call fcn.140011090
mov r15, qword [rbp + 8]
mov r14, qword [rbp + 0x10]
mov dword [r12], edi
lea r8, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 1
xor edx, edx
call rsi
cmp r15, r14
jne 0x140010a5e
lea r12, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r12
mov rdx, r14
call fcn.140011090
mov r15, qword [r12 + 8]
mov r14, qword [r12 + 0x10]
jmp 0x140010a7d
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14001101a
add rdx, 0x27
mov rcx, rax
jmp 0x14000fc0d
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14001101a
add rdx, 0x27
mov rcx, rax
jmp 0x14000fccd
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14001101a
add rdx, 0x27
mov rcx, rax
jmp 0x140010061
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, rbx
jne 0x1400108d8
lea r15, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r15
mov rdx, rbx
call fcn.140011090
mov r14, qword [r15 + 8]
mov rbx, qword [r15 + 0x10]
jmp 0x1400108f7
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, rbx
jne 0x140010937
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rdx, rbx
call fcn.140011090
jmp 0x140010956
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
xor eax, eax
lea rbx, [rsp + 0x130]
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, rbx
call fcn.14000c9e0
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, rbx
call fcn.14002fe20
mov rax, qword [rbx + 0x18]
cmp rax, 8
jb 0x14000fd96
mov rcx, qword [rsp + 0x130]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400109e3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001101a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000fd96
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, rbx
jne 0x140010ad1
lea r15, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r15
mov rdx, rbx
call fcn.140011090
mov r14, qword [r15 + 8]
mov rbx, qword [r15 + 0x10]
jmp 0x140010af0
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r15
call sub.ntdll.dll_memcpy
add r15, 0x44
mov qword [rsp + 0x68], r15
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r15, r14
jne 0x140010b37
lea r12, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r12
mov rdx, r14
call fcn.140011090
mov r15, qword [r12 + 8]
mov r14, qword [r12 + 0x10]
jmp 0x140010b56
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, rbx
jne 0x140010b9d
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rdx, rbx
call fcn.140011090
jmp 0x140010bbc
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r15
call sub.ntdll.dll_memcpy
add r15, 0x44
mov qword [rsp + 0x68], r15
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r15, r14
jne 0x140010d4e
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rdx, r14
call fcn.140011090
jmp 0x140010d6d
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
xor eax, eax
lea rbx, [rsp + 0x130]
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, rbx
call fcn.14000c9e0
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, rbx
call fcn.14002fe20
mov rax, qword [rbx + 0x18]
cmp rax, 8
jb 0x140010c4a
mov rcx, qword [rsp + 0x130]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140010c45
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001101a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
test r13b, r13b
je 0x14000fd96
mov esi, 0x44
lea r14, [rsp + 0x128]
mov dword [r14], esi
lea r15, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r15
mov r9, r14
call rbp
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov rdx, r15
call fcn.140011040
mov dword [r14], esi
lea r14, [rsp + 0x130]
lea r15, [rsp + 0x128]
mov ecx, 1
xor edx, edx
mov r8, r14
mov r9, r15
call rbp
mov rcx, rbx
mov rdx, r14
call fcn.140011040
mov dword [r15], esi
lea r14, [rsp + 0x130]
lea r15, [rsp + 0x128]
mov ecx, 0xb
xor edx, edx
mov r8, r14
mov r9, r15
call rbp
mov rcx, rbx
mov rdx, r14
call fcn.140011040
mov dword [r15], esi
lea r14, [rsp + 0x130]
lea r15, [rsp + 0x128]
mov ecx, 0x11
xor edx, edx
mov r8, r14
mov r9, r15
call rbp
mov rcx, rbx
mov rdx, r14
call fcn.140011040
mov dword [r15], esi
lea r14, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 0x12
xor edx, edx
mov r8, r14
call rbp
mov rcx, rbx
mov rdx, r14
call fcn.140011040
mov rcx, rbx
call fcn.140011610
mov rcx, rbx
jmp 0x140010468
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r15
call sub.ntdll.dll_memcpy
add r15, 0x44
mov qword [rsp + 0x68], r15
xor eax, eax
lea r14, [rsp + 0x130]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, r14
call fcn.14000c9e0
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, r14
call fcn.14002fe20
mov rax, qword [r14 + 0x18]
cmp rax, 8
jb 0x140010dfc
mov rcx, qword [rsp + 0x130]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140010df7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001101a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
test r13b, r13b
je 0x14000fd96
mov edi, 0x44
lea r15, [rsp + 0x128]
mov dword [r15], edi
lea r12, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r12
mov r9, r15
call rsi
lea r14, [rsp + 0xa0]
mov rcx, r14
mov rdx, r12
call fcn.140011040
mov dword [r15], edi
lea r15, [rsp + 0x130]
lea r12, [rsp + 0x128]
mov ecx, 1
xor edx, edx
mov r8, r15
mov r9, r12
call rsi
mov rcx, r14
mov rdx, r15
call fcn.140011040
mov dword [r12], edi
lea r15, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 0x12
xor edx, edx
mov r8, r15
call rsi
mov rcx, r14
mov rdx, r15
call fcn.140011040
mov rcx, r14
call fcn.140011610
mov rcx, r14
call fcn.140011e40
jmp 0x14000fd4a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14001101a
add rdx, 0x27
mov rcx, rax
jmp 0x14000fc4d
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14001101a
add rdx, 0x27
mov rcx, rax
jmp 0x14000fc8d
xor ecx, ecx
mov ebp, 0x3f0
jmp 0x14000fbb8
mov ebp, 0x3f0
jmp 0x14000fbb3
mov ebp, 0xa0
jmp 0x14000fbb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14000fb59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14000fb43
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14001101a
add rdx, 0x27
mov rcx, rax
jmp 0x1400101cf
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001101a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x14001020b
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, rax
cmp rsi, 0x20
jae 0x14001101a
add rdx, 0x27
mov rsi, rax
jmp 0x140010246
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
jmp 0x1400102e4
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.ntdll.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
jmp 0x140010326
mov rcx, qword [rsp + 0x130]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140011010
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001101a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x140010379
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rcx, [rsp + 0xa0]
call fcn.14002fca0
jmp 0x14000fd96