Function at 0x1001090bc
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rbp, r8
mov r13, rdx
mov edi, r15d
mov rsi, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
lea r14, [0x100002fb0]
lea ebx, [r15 + 1]
cmp rcx, rax
je 0x100109125
test byte [rcx + 0x1c], bl
je 0x100109125
cmp byte [rcx + 0x19], 5
jb 0x100109125
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x10]
mov r8, r14
call fcn.10001c7b8
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
or r12, 0xffffffffffffffff
mov qword [rsp + 0x98], r15
mov qword [rsp + 0x88], r15
cmp rcx, rax
je 0x10010916b
test byte [rcx + 0x1c], bl
je 0x10010916b
cmp byte [rcx + 0x19], 5
jb 0x10010916b
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x13]
mov r9, rsi
mov r8, r14
call fcn.10001da24
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp r13, r15
jne 0x10010922b
cmp rbp, r15
jne 0x10010922b
mov edi, 0x80070057
cmp rcx, rax
je 0x1001091aa
test byte [rcx + 0x1c], bl
je 0x1001091aa
cmp byte [rcx + 0x19], 2
jb 0x1001091aa
mov rcx, qword [rcx + 0x10]
mov edx, 0x13
mov r8, r14
call fcn.10001c7b8
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
mov rax, qword [rsp + 0x88]
cmp rax, r15
je 0x1001091d6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
mov qword [rsp + 0x88], r15
cmp r12, 0xffffffffffffffff
je 0x1001091ec
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x100109211
test byte [rcx + 0x1c], bl
je 0x100109211
cmp byte [rcx + 0x19], 5
jb 0x100109211
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fb0]
mov edx, 0x1a
call fcn.10001c7b8
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 3
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov edx, 0x60000
mov rcx, rsi
mov r8d, eax
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1001092aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1001091b1
test byte [rcx + 0x1c], bl
je 0x1001091b1
cmp byte [rcx + 0x19], 2
jb 0x1001091b1
lea edx, [r12 + 0x15]
mov r8, r14
jmp 0x10010946b
cmp rbp, r15
je 0x100109323
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov r8d, 0x80000004
mov edx, ebx
mov rcx, rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
cmp eax, r15d
je 0x100109323
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1001091b1
test byte [rcx + 0x1c], bl
je 0x1001091b1
cmp byte [rcx + 0x19], 2
jb 0x1001091b1
mov edx, 0x15
mov r9d, 0x80000004
mov r8, r14
jmp 0x1001094f0
cmp r13, r15
je 0x100109515
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov r8d, ebx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
cmp eax, r15d
je 0x1001093ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1001091b1
test byte [rcx + 0x1c], bl
je 0x1001091b1
cmp byte [rcx + 0x19], 2
jb 0x1001091b1
mov edx, 0x16
jmp 0x1001092a2
mov rcx, qword [rsp + 0x98]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, r15d
jne 0x100109515
mov r14d, ebx
mov eax, 0x80000005
cmp rbp, r15
cmovne r14d, eax
mov eax, 0xe0000
mov ebx, 0xa0000
cmp rbp, r15
mov rcx, r12
cmovne ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 3
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov edx, ebx
mov rcx, rsi
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x100109480
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
lea ebx, [r12 + 2]
cmp rcx, rbp
je 0x1001091b1
test byte [rcx + 0x1c], bl
je 0x1001091b1
cmp byte [rcx + 0x19], 2
jb 0x1001091b1
lea edx, [rbx + 0x16]
lea r8, [0x100002fb0]
mov rcx, qword [rcx + 0x10]
mov r9, rsi
mov dword [rsp + 0x20], edi
call fcn.10001daa4
jmp 0x100109502
mov qword [rsp + 0x30], r15
mov ebx, 1
mov r9, r13
mov r8d, r14d
mov rcx, rax
mov edx, ebx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
cmp eax, r15d
je 0x10010950e
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1001091b1
test byte [rcx + 0x1c], bl
je 0x1001091b1
cmp byte [rcx + 0x19], 2
jb 0x1001091b1
lea edx, [rbx + 0x17]
mov r9d, r14d
lea r8, [0x100002fb0]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call fcn.100108d30
mov rcx, qword [0x1001653b8]
jmp 0x1001091b1
lea r14, [0x100002fb0]
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1001091b1
test byte [rcx + 0x1c], bl
je 0x1001091b1
cmp byte [rcx + 0x19], 5
jb 0x1001091b1
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r9, rsi
mov r8, r14
call fcn.10001da24
jmp 0x100109502