Function at 0x14000ab40
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movaps xmmword [rsp + 0x180], xmm6
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r8d
mov ebp, edx
mov rbx, rcx
mov sil, byte [rsp + 0x200]
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x178], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x108], 7
mov word [rsp + 0x10c], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r14, rax
test rbx, rbx
jne 0x14000b9b4
lea r8, [rsp + 0x130]
mov rcx, r14
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000b9e8
lea rbx, [rsp + 0x100]
mov rdx, qword [rsp + 0x130]
mov rcx, rbx
call fcn.140008000
mov byte [rbx + 0xc], 1
mov rbx, qword [rsp + 0x208]
test sil, sil
je 0x14000ac39
mov byte [rsp + 0x10d], 1
test rbx, rbx
je 0x14000acca
xorps xmm0, xmm0
lea r14, [rsp + 0x130]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov dword [r14 + 0x40], 0
mov ecx, 0x44
mov rdx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
lea r15, [rsp + 0xa0]
mov rcx, r15
mov rdx, r14
mov r8d, 0x10000000
call fcn.14000c6e0
lea r9, [rsp + 0x80]
mov dword [r9], 0x44
lea r14, [rsp + 0x130]
mov ecx, 0x47
xor edx, edx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov rcx, r15
mov rdx, r14
mov r8d, 0x20000
call fcn.14000c6e0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm0
cmp ebp, 7
ja case.default.0x14000ad0a
mov r13b, byte [rsp + 0x210]
mov eax, ebp
lea rcx, [0x14000c380]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
test r13b, r13b
je case.0x14000ad0a.7
cmp byte [rsp + 0x10c], 0
je 0x14000c23c
lea rcx, [rsp + 0xa0]
call fcn.14000c970
test eax, eax
jne 0x14000af91
lea r14, [rsp + 0x130]
mov qword [r14], 0
mov rcx, qword [rsp + 0x100]
mov edx, 2
mov r8, r14
call fcn.14000c610
mov r14, qword [r14]
test eax, eax
jne 0x14000b804
test r14, r14
je case.0x14000ad0a.7
mov eax, dword [r14]
test eax, eax
je 0x14000ae36
lea rsi, [r14 + 0x10]
xor edi, edi
xorps xmm6, xmm6
lea rbx, [rsp + 0x130]
mov r12, qword [sym.imp.ADVAPI32.dll_CopySid]
lea r15, [rsp + 0xa0]
test byte [rsi], 0x20
jne 0x14000ae24
mov r8, qword [rsi - 8]
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
mov dword [rsp + 0x170], 0
mov ecx, 0x44
mov rdx, rbx
call r12
cmp byte [rsp + 0x10c], 0
je 0x14000ae21
mov rdx, qword [rsp + 0xa8]
cmp rdx, qword [rsp + 0xb0]
jne 0x14000ae07
mov rcx, r15
mov r8, rbx
call fcn.14000c3f0
jmp 0x14000ae21
mov r8d, 0x44
mov rcx, rdx
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
add qword [rsp + 0xa8], 0x44
mov eax, dword [r14]
inc rdi
mov ecx, eax
add rsi, 0x10
cmp rdi, rcx
jb 0x14000ad9b
mov rcx, r14
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
mov r14, qword [rsp + 0x218]
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0x44]
test eax, eax
jne 0x14000af78
cmp byte [rsp + 0x10c], 0
je 0x14000c248
lea rdx, [rsp + 0x130]
mov qword [rdx], 0
lea rcx, [rsp + 0xa0]
call fcn.14000ca70
test eax, eax
jne 0x14000c262
mov rcx, qword [rsp + 0x130]
lea r8, [rsp + 0x128]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x14000c25c
mov rdx, qword [rsp + 0x128]
lea rsi, [rsp + 0x120]
mov qword [rsi], 0
mov rcx, rsi
call fcn.140008000
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbx
mov rdi, rax
mov rsi, qword [rsi]
call rbx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0xf01ff
lea r9, [rsp + 0x118]
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14000c269
mov rdx, qword [rsp + 0x118]
mov rcx, r14
call fcn.140008000
mov rsi, qword [rsp + 0x120]
lea rax, [rsi + 1]
cmp rax, 2
jae 0x14000b7d4
mov rsi, qword [rsp + 0x130]
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14000af93
call fcn.140008110
mov r8, qword [rsp + 0x1d8]
lea rdi, [rsp + 0x130]
mov rcx, rsi
mov rdx, rdi
mov r9, rax
call fcn.140001040
mov rcx, qword [rdi]
call fcn.140001700
jmp 0x14000af93
cmp eax, 1
jne 0x14000c252
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.14000ca70
mov ebp, eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14000b51c
mov rsi, qword [rsp + 0x80]
test rsi, rsi
jne 0x14000b53b
mov rsi, qword [rsp + 0x100]
lea rax, [rsi + 1]
cmp rax, 2
jae 0x14000b4e5
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14000b008
mov rdx, qword [rsp + 0xf8]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000bb59
lea rsi, [rsp + 0xe8]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14000b048
mov rdx, qword [rsp + 0xe0]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000c1fa
lea rsi, [rsp + 0xd0]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14000b088
mov rdx, qword [rsp + 0xc8]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000c21b
lea rsi, [rsp + 0xb8]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14000b0b2
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000bb7a
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14001c330
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0xa0]
call fcn.14001cc70
test r13b, r13b
je 0x14000b176
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r14, [rsp + 0x130]
xor ecx, ecx
xor edx, edx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.14000c3a0
test rbx, rbx
je 0x14000b176
xorps xmm0, xmm0
lea r14, [rsp + 0x130]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov dword [r14 + 0x40], 0
mov ecx, 0x44
mov rdx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.14000c3a0
mov ebp, 0x3f0
cmp byte [rsp + 0x10c], 0
je 0x14000af93
lea r14, [rsp + 0x130]
mov qword [r14], 0
mov rcx, qword [rsp + 0x100]
mov edx, 2
mov r8, r14
call fcn.14000c610
mov r14, qword [r14]
test eax, eax
jne 0x14000b804
test r14, r14
je 0x14000b2d8
cmp dword [r14], 0
je 0x14000b2d0
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rax, rdi
sub rax, rsi
sar rax, 2
movabs r13, 0xf0f0f0f0f0f0f0f1
imul r13, rax
xor ebp, ebp
xorps xmm6, xmm6
lea r12, [rsp + 0x130]
mov rax, rbp
shl rax, 4
test dword [r14 + rax + 0x10], 0xc0000020
jne 0x14000b277
lea rbx, [r14 + rax]
add rbx, 8
cmp rdi, rsi
jne 0x14000b288
mov r8, qword [rbx]
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
mov dword [rsp + 0x170], 0
mov ecx, 0x44
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov rdx, qword [rsp + 0xd8]
cmp rdx, qword [rsp + 0xe0]
jne 0x14000b2b4
lea rcx, [rsp + 0xd0]
mov r8, r12
call fcn.14000c3f0
inc rbp
mov eax, dword [r14]
cmp rbp, rax
jb 0x14000b1fa
jmp 0x14000b2d0
xor r15d, r15d
mov rdx, qword [rbx]
mov rax, r15
shl rax, 6
lea rcx, [rax + r15*4]
add rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14000b277
inc r15d
cmp r13, r15
jbe 0x14000b219
jmp 0x14000b28b
mov r8d, 0x44
mov rcx, rdx
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
add qword [rsp + 0xd8], 0x44
jmp 0x14000b277
mov rcx, r14
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
cmp byte [rsp + 0x10c], 0
mov ebp, 0x3f0
je 0x14000af93
lea r14, [rsp + 0x130]
mov qword [r14], 0
mov rcx, qword [rsp + 0x100]
mov edx, 3
mov r8, r14
call fcn.14000c610
mov r14, qword [r14]
test eax, eax
jne 0x14000b804
test r14, r14
je case.0x14000ad0a.7
cmp dword [r14], 0
je 0x14000ae36
mov r15, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
sub rax, r15
sar rax, 5
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x50], r15
cmp qword [rsp + 0x58], r15
jne 0x14000b47d
lea rax, [rbx + rbx*2]
lea rbp, [r14 + rax*4]
add rbp, 4
mov rdi, qword [rsp + 0xc0]
cmp rdi, qword [rsp + 0xc8]
jne 0x14000b81c
mov r15, rdi
sub r15, qword [rsp + 0xb8]
sar r15, 3
lea rsi, [r15 + 1]
mov r13, r15
shr r13, 1
movabs rcx, 0x1fffffffffffffff
mov rax, rcx
sub rax, r13
add r13, r15
cmp r13, rsi
cmovbe r13, rsi
cmp r15, rax
cmova r13, rcx
cmp r13, rcx
ja 0x14000b85f
lea rcx, [r13*8]
cmp r13, 0x200
jae 0x14000b831
test r13, r13
je 0x14000b864
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r12, rax
mov rax, qword [rbp]
mov qword [r12 + r15*8], rax
mov rdx, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov r8, rdi
sub r8, rdx
mov rcx, r12
call sub.VCRUNTIME140.dll_memmove
cmp rbp, rdi
jne 0x14000b86c
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14000b444
mov rdx, qword [rsp + 0xc8]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000bb9b
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov qword [rsp + 0xb8], r12
lea rax, [r12 + rsi*8]
mov qword [rsp + 0xc0], rax
lea rax, [r12 + r13*8]
mov qword [rsp + 0xc8], rax
mov r15, qword [rsp + 0x50]
inc rbx
mov eax, dword [r14]
cmp rbx, rax
jb 0x14000b355
jmp 0x14000ae36
lea rax, [rbx + rbx*2]
lea rsi, [r14 + rax*4]
add rsi, 4
xor edi, edi
mov qword [rsp + 0x130], 0
mov rdx, rdi
shl rdx, 5
cmp qword [r15 + rdx + 0x18], 8
jb 0x14000b4ac
mov rdx, qword [r15 + rdx]
jmp 0x14000b4af
add rdx, r15
xor ecx, ecx
lea r8, [rsp + 0x130]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [rsi + 4]
cmp eax, dword [rsp + 0x134]
jne 0x14000b4d6
mov eax, dword [rsi]
cmp eax, dword [rsp + 0x130]
je 0x14000b469
inc edi
cmp qword [rsp + 0x48], rdi
jbe 0x14000b360
jmp 0x14000b48b
lea rdi, [rsp + 0x100]
call fcn.140008110
mov r8, qword [rsp + 0x1d8]
mov rcx, rsi
mov rdx, rdi
mov r9, rax
call fcn.140001040
mov rcx, qword [rdi]
call fcn.140001700
mov qword [rdi], 0
jmp 0x14000afc8
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
cmp rdx, 0x1000
jae 0x14000c276
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000afa1
mov rdi, qword [rsp + 0x88]
cmp rsi, rdi
je 0x14000b590
mov rbx, rsi
mov rax, qword [rbx + 0x18]
cmp rax, 8
jb 0x14000b572
mov rcx, qword [rbx]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14000c297
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 7
mov word [rbx], 0
add rbx, 0x20
cmp rbx, rdi
jne 0x14000b54b
mov rdx, qword [rsp + 0x90]
sub rdx, rsi
cmp rdx, 0x1000
jae 0x14000c2be
mov rcx, rsi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000afb2
mov edi, 0x44
lea r12, [rsp + 0x128]
mov dword [r12], edi
mov rsi, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea r14, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r14
mov r9, r12
call rsi
lea r15, [rsp + 0x60]
mov rcx, r15
xor edx, edx
mov r8, r14
call fcn.14000c3f0
mov r14, qword [r15 + 8]
mov r15, qword [r15 + 0x10]
mov dword [r12], edi
lea r8, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 1
xor edx, edx
call rsi
cmp r14, r15
jne 0x14000c2df
lea r12, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r12
mov rdx, r15
call fcn.14000c3f0
mov r14, qword [r12 + 8]
mov r15, qword [r12 + 0x10]
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, r15
jne 0x14000c303
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rdx, r15
call fcn.14000c3f0
xor eax, eax
lea r14, [rsp + 0x130]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, r14
call fcn.14001c680
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, r14
call fcn.14001cdf0
mov rax, qword [r14 + 0x18]
cmp rax, 8
jae 0x14000c327
test r13b, r13b
je 0x14000c36e
mov edi, 0x44
lea r15, [rsp + 0x128]
mov dword [r15], edi
lea r12, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r12
mov r9, r15
call rsi
lea r14, [rsp + 0xa0]
mov rcx, r14
mov rdx, r12
call fcn.14000c3a0
mov dword [r15], edi
lea r15, [rsp + 0x130]
lea r12, [rsp + 0x128]
mov ecx, 1
xor edx, edx
mov r8, r15
mov r9, r12
call rsi
mov rcx, r14
mov rdx, r15
call fcn.14000c3a0
mov dword [r12], edi
lea r15, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 0x12
xor edx, edx
mov r8, r15
call rsi
mov rcx, r14
mov rdx, r15
call fcn.14000c3a0
test rbx, rbx
je 0x14000b7c2
xorps xmm0, xmm0
lea r14, [rsp + 0x130]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov dword [r14 + 0x40], 0
mov ecx, 0x44
mov rdx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.14000c3a0
lea rcx, [rsp + 0xa0]
call fcn.14000d1b0
jmp 0x14000b176
call fcn.140008110
mov r8, qword [rsp + 0x1d8]
lea rdi, [rsp + 0x120]
mov rcx, rsi
mov rdx, rdi
mov r9, rax
call fcn.140001040
mov rcx, qword [rdi]
call fcn.140001700
jmp 0x14000af39
mov ebp, eax
test r14, r14
je 0x14000af93
mov rcx, r14
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x14000af93
mov rax, qword [rbp]
mov qword [rdi], rax
add qword [rsp + 0xc0], 8
jmp 0x14000b469
movabs rax, 0x1fffffffffffffff
add rax, 0xfffffffffffffffd
cmp r13, rax
jae 0x14000b85f
add rcx, 0x27
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x14000b3eb
call fcn.14001efd0
xor r12d, r12d
jmp 0x14000b3eb
lea rcx, [r12 + r15*8]
add rcx, 8
mov r8, qword [rsp + 0xc0]
sub r8, rdi
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
jmp 0x14000b41a
mov esi, 0x44
lea r15, [rsp + 0x128]
mov dword [r15], esi
mov rdi, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea rbx, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, rbx
mov r9, r15
call rdi
lea r12, [rsp + 0x60]
mov rcx, r12
xor edx, edx
mov r8, rbx
call fcn.14000c3f0
mov r14, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
mov dword [r15], esi
lea r8, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 1
xor edx, edx
call rdi
cmp r14, rbx
jne 0x14000bbbc
lea r15, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r15
mov rdx, rbx
call fcn.14000c3f0
mov r14, qword [r15 + 8]
mov rbx, qword [r15 + 0x10]
jmp 0x14000bbdb
mov esi, 0x44
lea r15, [rsp + 0x128]
mov dword [r15], esi
mov rbp, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea rbx, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, rbx
mov r9, r15
call rbp
lea r12, [rsp + 0x60]
mov rcx, r12
xor edx, edx
mov r8, rbx
call fcn.14000c3f0
mov r14, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
mov dword [r15], esi
lea r8, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 1
xor edx, edx
call rbp
cmp r14, rbx
jne 0x14000bd3b
lea r15, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r15
mov rdx, rbx
call fcn.14000c3f0
mov r14, qword [r15 + 8]
mov rbx, qword [r15 + 0x10]
jmp 0x14000bd5a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x130]
mov rcx, rax
mov rdx, rbx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x14000ac00
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000ac24
mov ebp, 0xa0
jmp 0x14000afb2
xor eax, eax
lea r14, [rsp + 0x130]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, r14
call fcn.14001c680
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, r14
call fcn.14001cdf0
mov rax, qword [r14 + 0x18]
cmp rax, 8
jb 0x14000ba8c
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000ba87
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c368
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
lea rcx, [rsp + 0xa0]
call fcn.14001cc70
test r13b, r13b
je 0x14000b176
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r14, [rsp + 0x130]
mov ecx, 0x12
jmp 0x14000b10f
mov esi, 0x44
lea r12, [rsp + 0x128]
mov dword [r12], esi
mov rdi, qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea r14, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r14
mov r9, r12
call rdi
lea rbp, [rsp + 0x60]
mov rcx, rbp
xor edx, edx
mov r8, r14
call fcn.14000c3f0
mov r15, qword [rbp + 8]
mov r14, qword [rbp + 0x10]
mov dword [r12], esi
lea r8, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 1
xor edx, edx
call rdi
cmp r15, r14
jne 0x14000bdac
lea r12, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r12
mov rdx, r14
call fcn.14000c3f0
mov r15, qword [r12 + 8]
mov r14, qword [r12 + 0x10]
jmp 0x14000bdcb
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000c368
add rdx, 0x27
mov rcx, rax
jmp 0x14000afed
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000c368
add rdx, 0x27
mov rcx, rax
jmp 0x14000b0ad
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000c368
add rdx, 0x27
mov rcx, rax
jmp 0x14000b43f
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, rbx
jne 0x14000bc26
lea r15, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r15
mov rdx, rbx
call fcn.14000c3f0
mov r14, qword [r15 + 8]
mov rbx, qword [r15 + 0x10]
jmp 0x14000bc45
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, rbx
jne 0x14000bc85
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rdx, rbx
call fcn.14000c3f0
jmp 0x14000bca4
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
xor eax, eax
lea rbx, [rsp + 0x130]
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, rbx
call fcn.14001c680
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, rbx
call fcn.14001cdf0
mov rax, qword [rbx + 0x18]
cmp rax, 8
jb 0x14000b176
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000bd31
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c368
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000b176
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, rbx
jne 0x14000be1f
lea r15, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r15
mov rdx, rbx
call fcn.14000c3f0
mov r14, qword [r15 + 8]
mov rbx, qword [r15 + 0x10]
jmp 0x14000be3e
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, 0x44
mov qword [rsp + 0x68], r15
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r15, r14
jne 0x14000be85
lea r12, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rcx, r12
mov rdx, r14
call fcn.14000c3f0
mov r15, qword [r12 + 8]
mov r14, qword [r12 + 0x10]
jmp 0x14000bea4
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r14, rbx
jne 0x14000beeb
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rdx, rbx
call fcn.14000c3f0
jmp 0x14000bf0a
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, 0x44
mov qword [rsp + 0x68], r15
lea r9, [rsp + 0x128]
mov dword [r9], 0x44
lea r8, [rsp + 0x130]
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp r15, r14
jne 0x14000c09c
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov rdx, r14
call fcn.14000c3f0
jmp 0x14000c0bb
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
xor eax, eax
lea rbx, [rsp + 0x130]
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, rbx
call fcn.14001c680
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, rbx
call fcn.14001cdf0
mov rax, qword [rbx + 0x18]
cmp rax, 8
jb 0x14000bf98
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000bf93
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c368
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
test r13b, r13b
je 0x14000b176
mov esi, 0x44
lea r14, [rsp + 0x128]
mov dword [r14], esi
lea r15, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r15
mov r9, r14
call rbp
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov rdx, r15
call fcn.14000c3a0
mov dword [r14], esi
lea r14, [rsp + 0x130]
lea r15, [rsp + 0x128]
mov ecx, 1
xor edx, edx
mov r8, r14
mov r9, r15
call rbp
mov rcx, rbx
mov rdx, r14
call fcn.14000c3a0
mov dword [r15], esi
lea r14, [rsp + 0x130]
lea r15, [rsp + 0x128]
mov ecx, 0xb
xor edx, edx
mov r8, r14
mov r9, r15
call rbp
mov rcx, rbx
mov rdx, r14
call fcn.14000c3a0
mov dword [r15], esi
lea r14, [rsp + 0x130]
lea r15, [rsp + 0x128]
mov ecx, 0x11
xor edx, edx
mov r8, r14
mov r9, r15
call rbp
mov rcx, rbx
mov rdx, r14
call fcn.14000c3a0
mov dword [r15], esi
lea r14, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 0x12
xor edx, edx
mov r8, r14
call rbp
mov rcx, rbx
mov rdx, r14
call fcn.14000c3a0
mov rcx, rbx
call fcn.14000c970
mov rcx, rbx
jmp 0x14000b7ca
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, 0x44
mov qword [rsp + 0x68], r15
xor eax, eax
lea r14, [rsp + 0x130]
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], 0
lea r8, str.SeChangeNotifyPrivilege
mov edx, 0x17
mov rcx, r14
call fcn.14001c680
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, r14
call fcn.14001cdf0
mov rax, qword [r14 + 0x18]
cmp rax, 8
jb 0x14000c14a
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000c145
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c368
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
test r13b, r13b
je 0x14000b176
mov esi, 0x44
lea r15, [rsp + 0x128]
mov dword [r15], esi
lea r12, [rsp + 0x130]
mov ecx, 0x1b
xor edx, edx
mov r8, r12
mov r9, r15
call rdi
lea r14, [rsp + 0xa0]
mov rcx, r14
mov rdx, r12
call fcn.14000c3a0
mov dword [r15], esi
lea r15, [rsp + 0x130]
lea r12, [rsp + 0x128]
mov ecx, 1
xor edx, edx
mov r8, r15
mov r9, r12
call rdi
mov rcx, r14
mov rdx, r15
call fcn.14000c3a0
mov dword [r12], esi
lea r15, [rsp + 0x130]
lea r9, [rsp + 0x128]
mov ecx, 0x12
xor edx, edx
mov r8, r15
call rdi
mov rcx, r14
mov rdx, r15
call fcn.14000c3a0
mov rcx, r14
call fcn.14000c970
mov rcx, r14
call fcn.14000d1b0
jmp 0x14000b12a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000c368
add rdx, 0x27
mov rcx, rax
jmp 0x14000b02d
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000c368
add rdx, 0x27
mov rcx, rax
jmp 0x14000b06d
xor ecx, ecx
mov ebp, 0x3f0
jmp 0x14000af98
mov ebp, 0x3f0
jmp 0x14000af93
mov ebp, 0xa0
jmp 0x14000af93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14000af39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14000af23
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000c368
add rdx, 0x27
mov rcx, rax
jmp 0x14000b531
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c368
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x14000b56d
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, rax
cmp rsi, 0x20
jae 0x14000c368
add rdx, 0x27
mov rsi, rax
jmp 0x14000b5a8
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
jmp 0x14000b646
lea rdx, [rsp + 0x130]
mov r8d, 0x44
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, 0x44
mov qword [rsp + 0x68], r14
jmp 0x14000b688
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000c35e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000c368
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
jmp 0x14000b6db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rcx, [rsp + 0xa0]
call fcn.14001cc70
jmp 0x14000b176