Function at 0x10010954c
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rbp, r8
mov r13, rdx
mov edi, r15d
mov rsi, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
lea r14, [0x100002f70]
lea ebx, [r15 + 1]
cmp rcx, rax
je 0x1001095b5
test byte [rcx + 0x1c], bl
je 0x1001095b5
cmp byte [rcx + 0x19], 5
jb 0x1001095b5
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x10]
mov r8, r14
call fcn.10001c854
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
or r12, 0xffffffffffffffff
mov qword [rsp + 0x98], r15
mov qword [rsp + 0x88], r15
cmp rcx, rax
je 0x1001095fb
test byte [rcx + 0x1c], bl
je 0x1001095fb
cmp byte [rcx + 0x19], 5
jb 0x1001095fb
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x13]
mov r9, rsi
mov r8, r14
call fcn.10001db08
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp r13, r15
jne 0x1001096bb
cmp rbp, r15
jne 0x1001096bb
mov edi, 0x80070057
cmp rcx, rax
je 0x10010963a
test byte [rcx + 0x1c], bl
je 0x10010963a
cmp byte [rcx + 0x19], 2
jb 0x10010963a
mov rcx, qword [rcx + 0x10]
mov edx, 0x13
mov r8, r14
call fcn.10001c854
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
mov rax, qword [rsp + 0x88]
cmp rax, r15
je 0x100109666
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1001653b8]
mov qword [rsp + 0x88], r15
cmp r12, 0xffffffffffffffff
je 0x10010967c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1001096a1
test byte [rcx + 0x1c], bl
je 0x1001096a1
cmp byte [rcx + 0x19], 5
jb 0x1001096a1
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f70]
mov edx, 0x1a
call fcn.10001c854
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 3
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov edx, 0x60000
mov rcx, rsi
mov r8d, eax
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x10010973a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x100109641
test byte [rcx + 0x1c], bl
je 0x100109641
cmp byte [rcx + 0x19], 2
jb 0x100109641
lea edx, [r12 + 0x15]
mov r8, r14
jmp 0x1001098fb
cmp rbp, r15
je 0x1001097b3
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov r8d, 0x80000004
mov edx, ebx
mov rcx, rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
cmp eax, r15d
je 0x1001097b3
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x100109641
test byte [rcx + 0x1c], bl
je 0x100109641
cmp byte [rcx + 0x19], 2
jb 0x100109641
mov edx, 0x15
mov r9d, 0x80000004
mov r8, r14
jmp 0x100109980
cmp r13, r15
je 0x1001099a5
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x98]
mov r8d, ebx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
cmp eax, r15d
je 0x10010983c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x100109641
test byte [rcx + 0x1c], bl
je 0x100109641
cmp byte [rcx + 0x19], 2
jb 0x100109641
mov edx, 0x16
jmp 0x100109732
mov rcx, qword [rsp + 0x98]
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, r15d
jne 0x1001099a5
mov r14d, ebx
mov eax, 0x80000005
cmp rbp, r15
cmovne r14d, eax
mov eax, 0xe0000
mov ebx, 0xa0000
cmp rbp, r15
mov rcx, r12
cmovne ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 3
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov edx, ebx
mov rcx, rsi
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x100109910
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
lea ebx, [r12 + 2]
cmp rcx, rbp
je 0x100109641
test byte [rcx + 0x1c], bl
je 0x100109641
cmp byte [rcx + 0x19], 2
jb 0x100109641
lea edx, [rbx + 0x16]
lea r8, [0x100002f70]
mov rcx, qword [rcx + 0x10]
mov r9, rsi
mov dword [rsp + 0x20], edi
call fcn.10001ddb0
jmp 0x100109992
mov qword [rsp + 0x30], r15
mov ebx, 1
mov r9, r13
mov r8d, r14d
mov rcx, rax
mov edx, ebx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
cmp eax, r15d
je 0x10010999e
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x100109641
test byte [rcx + 0x1c], bl
je 0x100109641
cmp byte [rcx + 0x19], 2
jb 0x100109641
lea edx, [rbx + 0x17]
mov r9d, r14d
lea r8, [0x100002f70]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call fcn.1001091c0
mov rcx, qword [0x1001653b8]
jmp 0x100109641
lea r14, [0x100002f70]
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x100109641
test byte [rcx + 0x1c], bl
je 0x100109641
cmp byte [rcx + 0x19], 5
jb 0x100109641
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r9, rsi
mov r8, r14
call fcn.10001db08
jmp 0x100109992