Function at 0x10001e7fc
Capabilities:
Compare security identifiers
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1f0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
lea rcx, [0x100082100]
mov rax, qword [0x100082100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
mov r12, qword [0x100083838]
xor r13d, r13d
mov ebp, r13d
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x78], r13d
lea rdx, [rsp + 0x90]
mov rcx, r12
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
lea r14d, [r13 + 1]
cmp eax, r13d
je 0x10001e90f
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
cmp rax, r13
je 0x10001e90f
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, r12
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, r13d
je 0x10001e901
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rdx, [0x100009f00]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
cmp eax, r13d
je 0x10001e901
mov rdx, qword [rsp + 0x88]
movzx eax, word [rdx + 0x14]
movzx ecx, word [rdx + 0x16]
movzx r9d, word [rdx + 0x10]
movzx r8d, word [rdx + 0x12]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [0x10000ba28]
lea rcx, [rsp + 0x68]
call fcn.10001fd30
mov ebp, r14d
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
cmp ebp, r13d
jne 0x10001e935
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x10000ba28]
lea rcx, [rsp + 0x68]
call fcn.10001fd30
mov rbx, qword [rsp + 0x68]
lea rdx, [0x1000025a0]
mov ecx, r14d
call fcn.10001dcc0
call fcn.10001e600
mov r8, rbx
lea rdx, [0x100005898]
mov ecx, r14d
call fcn.10001e170
mov edi, 0x11c
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xc0]
call sub.msvcrt.dll_memset
mov dword [rsp + 0xc0], edi
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebp, 2
cmp eax, r13d
jne 0x10001e9b3
mov dword [rsp + 0xc0], 0x114
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, r13d
je 0x10001ea6b
cmp dword [rsp + 0xd0], ebp
jne 0x10001e9c5
mov eax, dword [rsp + 0xcc]
jmp 0x10001e9cd
movzx eax, word [rsp + 0xcc]
lea rcx, [rsp + 0xd4]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xc8]
mov r8d, dword [rsp + 0xc4]
lea rdx, [0x1000058c0]
mov ecx, r14d
call fcn.10001e170
mov r8d, dword [rsp + 0xd0]
lea rax, [0x1000058ec]
lea r9, [0x1000058f4]
cmp r8d, ebp
cmove r9, rax
lea rdx, [0x100005900]
mov ecx, r14d
call fcn.10001e170
movzx r9d, word [rsp + 0x1d6]
movzx r8d, word [rsp + 0x1d4]
lea rdx, [0x100005930]
mov ecx, r14d
call fcn.10001e170
movzx r9d, byte [rsp + 0x1da]
movzx r8d, word [rsp + 0x1d8]
lea rdx, [0x100005960]
mov ecx, r14d
call fcn.10001e170
lea rdx, [0x1000059a0]
mov ecx, r14d
call fcn.10001dcc0
mov edi, r13d
mov qword [rsp + 0x70], r13
mov rsi, r13
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x80], r13
mov byte [rsp + 0xb8], r13b
mov byte [rsp + 0xb9], r13b
mov byte [rsp + 0xba], r13b
mov byte [rsp + 0xbb], r13b
mov byte [rsp + 0xbc], r13b
mov byte [rsp + 0xbd], 5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x70]
mov edx, 0x20008
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r13d
je 0x10001ebb0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
mov edx, r14d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10001ebb0
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
cmp rax, r13
je 0x10001ebb0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x60]
mov r8, rsi
mov edx, r14d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, r13d
je 0x10001ebb0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, r14b
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r13d
je 0x10001ebb0
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb edi, edi
neg edi
add edi, r14d
mov rcx, qword [rsp + 0x80]
cmp rcx, r13
je 0x10001ebc3
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp rsi, r13
je 0x10001ebd1
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x70]
cmp rcx, r13
je 0x10001ebe1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, r14d
je 0x10001ec09
cmp edi, ebp
jne 0x10001ebfb
lea rdx, [0x1000059d0]
mov ecx, r14d
call fcn.10001dcc0
jmp 0x10001ec09
lea rdx, [0x100005a20]
mov ecx, ebp
call fcn.10001dcc0
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
cmp rax, r13
je 0x10001ec5d
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], rcx
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0xa0]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
cmp eax, r13d
je 0x10001ec5d
mov eax, dword [rsp + 0xa8]
and eax, r14d
jne 0x10001ec5d
lea rdx, [0x100005ad0]
mov ecx, r14d
call fcn.10001dcc0
jmp 0x10001ec6d
lea rdx, [0x100005a90]
mov ecx, r14d
call fcn.10001dcc0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
cmp eax, r13d
jg 0x10001ec8c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x1f0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret