Function at 0x140001bd0
Capabilities:
Compare security identifiers
Get token membership
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x14005b1f0]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r13d, r13d
lea rdx, [rbp - 0x39]
mov rdi, rcx
mov dword [rbp - 0x51], r13d
mov rcx, qword [rcx + 0x20]
mov r12d, r13d
mov dword [rbp - 0x59], r13d
mov r15d, r13d
mov dword [rbp - 0x4d], r13d
mov r14d, r13d
mov qword [rbp - 0x49], r13
mov esi, r13d
mov qword [rbp - 0x41], r13
or ebx, 0xffffffff
mov dword [rbp - 0x55], r13d
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_GetNamedPipeClientProcessId]
test eax, eax
je 0x140001ec7
mov r8d, dword [rbp - 0x39]
xor edx, edx
mov ecx, 0x440
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140001ec7
lea r8, [rbp - 0x49]
mov rcx, rax
lea edx, [rbx + 0xb]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
je 0x140001ec7
mov rcx, qword [rbp - 0x49]
lea r8, [rbp - 0x41]
lea edx, [rbx + 3]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateToken]
test eax, eax
je 0x140001ec7
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x59]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rbx + 2]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
cmp eax, 1
je 0x140001ed3
mov ecx, dword [rbp - 0x59]
call fcn.14001b724
mov rsi, rax
test rax, rax
je 0x140001ed3
mov r9d, dword [rbp - 0x59]
lea rax, [rbp - 0x59]
mov rcx, qword [rbp - 0x49]
lea edx, [rbx + 2]
mov r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
je 0x140001ed3
mov rcx, qword [rsi]
lea edx, [rbx + 0x17]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsWellKnownSid]
test eax, eax
je 0x140001d13
mov dword [rdi + 0x40048], 4
mov ebx, r13d
jmp 0x140001ed3
lea rax, [rbp - 0x35]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x4d]
lea rax, [rbp - 0x51]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rdx, str.NT_SERVICESSHD
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x534
jne 0x140001ddf
lea rcx, str.Cannot_look_up_SSHD_account__its_likely_not_installed
call fcn.140003a10
mov rcx, qword [rsi]
mov edx, 0x18
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsWellKnownSid]
test eax, eax
jne 0x140001eb8
mov rcx, qword [rsi]
lea edx, [rax + 0x17]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsWellKnownSid]
test eax, eax
jne 0x140001eb8
lea r9, [rbp - 0x31]
mov dword [rbp - 0x31], 0x44
lea r8, [rbp - 0x29]
xor edx, edx
lea ecx, [rax + 0x1a]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
je 0x140001ed3
mov rcx, qword [rbp - 0x41]
lea r8, [rbp - 0x55]
lea rdx, [rbp - 0x29]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
test eax, eax
je 0x140001ed3
mov ebx, r13d
cmp dword [rbp - 0x55], r13d
je 0x140001eac
mov dword [rdi + 0x40048], 2
jmp 0x140001ed3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0x140001e03
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.LookupAccountNameW_on_SSHD_account_failed_with__d
call fcn.140003950
jmp 0x140001ed3
mov ecx, dword [rbp - 0x4d]
call fcn.14001b724
mov r15, rax
test rax, rax
je 0x140001ed3
mov eax, dword [rbp - 0x51]
lea ecx, [rax + rax]
call fcn.14001b724
mov r12, rax
test rax, rax
je 0x140001ed3
lea rax, [rbp - 0x35]
mov r8, r15
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x4d]
lea rax, [rbp - 0x51]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rdx, str.NT_SERVICESSHD
mov qword [rsp + 0x20], r12
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
test eax, eax
je 0x140001ed3
mov rcx, qword [rsi]
mov rdx, r15
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x140001e7e
mov dword [rdi + 0x40048], 3
mov ebx, r13d
jmp 0x140001ed3
mov rcx, qword [rbp - 0x41]
lea r8, [rbp - 0x55]
mov rdx, r15
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
test eax, eax
je 0x140001ed3
cmp dword [rbp - 0x55], r13d
je 0x140001d5d
mov dword [rdi + 0x40048], 3
mov ebx, r13d
jmp 0x140001ed3
mov dword [rdi + 0x40048], 1
jmp 0x140001ed3
mov dword [rdi + 0x40048], 5
mov ebx, r13d
jmp 0x140001ed3
lea rcx, str.cannot_retrieve_client_impersonation_token
call fcn.140003950
movsxd rax, dword [rdi + 0x40048]
cmp eax, 5
ja case.default.0x140001ef0
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1fd0]
add rcx, rdx
jmp rcx
lea rdx, str.unknown
jmp 0x140001f2f
lea rdx, str.restricted_user
jmp 0x140001f2f
lea rdx, str.administrator
jmp 0x140001f2f
lea rdx, str.sshd_service
jmp 0x140001f2f
lea rdx, str.system
jmp 0x140001f2f
lea rdx, str.service
jmp 0x140001f2f
lea rdx, str.unexpected
lea rcx, str.client_type:__s
call fcn.1400039b0
test r15, r15
je 0x140001f48
mov rcx, r15
call fcn.14001b710
test r12, r12
je 0x140001f55
mov rcx, r12
call fcn.14001b710
test rsi, rsi
je 0x140001f62
mov rcx, rsi
call fcn.14001b710
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x140001f71
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebx, ebx
jne 0x140001f83
mov rcx, qword [rbp - 0x41]
mov qword [rdi + 0x28], rcx
mov qword [rdi + 0x30], r14
jmp 0x140001fa0
test r14, r14
je 0x140001f91
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x140001fa0
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140014060
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret