Function at 0x14001d9f8
Capabilities:
Compare security identifiers

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r14
mov rax, qword [0x1400db348]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov r14, rdx
mov rbx, rcx
xor edi, edi
lea rcx, [rbp + 8]
xor edx, edx
mov qword [rbp + 8], rdi
call fcn.14000cc28
lea r8, [rbp + 8]
mov edx, 0x88
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
je 0x14003a108
mov rcx, qword [rbp + 8]
lea rax, [rbp]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rdi + 6]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
jne 0x14003a143
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x14003a114
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov r9d, dword [rbp]
add r9d, 0xc
add r9d, eax
mov eax, r9d
mov dword [rbp], r9d
lea rcx, [r9 + 0xf]
cmp rcx, rax
ja 0x14001dacb
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002e360
sub rsp, rcx
lea rax, [rbp]
mov rcx, qword [rbp + 8]
mov edx, 6
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x14003a108
cmp qword [rsi], rdi
je 0x14003a143
mov rbx, qword [rsi]
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
add ax, 8
add word [rbx + 2], ax
mov ebx, edi
xor edx, edx
mov rcx, qword [rsi]
lea r8, [rbp + 0x10]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
nop dword [rax + rax]
test eax, eax
je 0x14001dbaa
mov rdx, qword [rbp + 0x10]
mov rcx, r14
add rdx, 8
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
jne 0x14001db67
inc ebx
mov edx, ebx
jmp 0x14001db2f
mov eax, edi
mov edi, eax
mov rcx, qword [rbp + 8]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x14001db85
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14002a8b0
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov r14, qword [rbp + 0x48]
lea rsp, [rbp + 0x20]
pop rbp
ret
mov rcx, qword [rsi]
mov r9, r14
mov edx, 2
mov r8d, 0x10000000
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAccessAllowedAce]
nop dword [rax + rax]
test eax, eax
je 0x14003a122
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidAcl]
nop dword [rax + rax]
mov rax, qword [rsi]
mov r8, rsi
mov rcx, qword [rbp + 8]
mov edx, 6
movzx r9d, word [rax + 2]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
nop dword [rax + rax]
test eax, eax
jne 0x14001db6b
jmp 0x14003a122
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14003a148
movzx eax, ax
or eax, 0x80070000
jmp 0x14003a148
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14001db69
movzx eax, ax
or eax, 0x80070000
jmp 0x14001db69
mov eax, 0x80004005
mov edi, eax
jmp 0x14001db67