Function at 0x140026dd0
Capabilities:
Compare security identifiers
Find taskbar

Disassembly:
push rbp
sub rsp, 0xc0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rdi
mov rax, qword [0x1401f0010]
xor rax, rbp
mov qword [rbp + 0x50], rax
xor esi, esi
mov dword [rbp], esi
mov qword [rbp + 0x10], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, esi
mov qword [rbp + 8], rsi
mov rax, qword [0x1401fef68]
cmp dword [rax + 0xe20], esi
jne 0x140026e2e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xf01ff
jmp 0x140026e75
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140026e82
mov dword [rbp + 4], esi
lea rdx, [rbp + 4]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 4]
test r8d, r8d
je 0x140026e82
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026e82
mov edx, 0x2000000
lea r8, [rbp + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov byte [rbp + 0x30], sil
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rbx
mov byte [rbp + 0x18], 0
mov qword [rbp + 0x20], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x28], rcx
mov dword [rbp + 0x48], 0
mov word [rbp + 0x4c], 0x500
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140026f89
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140026f89
mov eax, dword [rbp]
lea rcx, [rax + 0x10]
mov rdx, rsi
cmp rcx, rax
cmova rdx, rcx
test rdx, rdx
je 0x140026f89
cmp rdx, 0x400
ja 0x140026f36
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x140026f18
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140167c10
sub rsp, rax
lea rbx, [rsp + 0x60]
test rbx, rbx
je 0x140026f89
mov dword [rbx], 0xcccc
jmp 0x140026f4c
mov rcx, rdx
call fcn.14013abf8
mov rbx, rax
test rax, rax
je 0x140026f50
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x140026f89
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp]
mov r8, rbx
mov edx, 2
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140026fc4
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x140026f89
call fcn.140138b40
xor sil, sil
lea rcx, [rbp + 0x18]
call fcn.1400270b0
nop
lea rcx, [rbp + 0x30]
call fcn.1400270b0
movzx eax, sil
mov rcx, qword [rbp + 0x50]
xor rcx, rbp
call fcn.140131ef0
mov rbx, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x78]
mov rdi, qword [rbp + 0x80]
lea rsp, [rbp + 0x60]
pop rbp
ret
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140026f78
mov edi, esi
cmp dword [rbx], esi
jbe 0x140027035
nop dword [rax + rax]
mov ecx, edi
add rcx, rcx
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbx + rcx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140027030
inc edi
cmp edi, dword [rbx]
jb 0x140027010
jmp 0x140027035
mov esi, 1
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x140027046
call fcn.140138b40
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x140026f8c