Function at 0x1400f47ec
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov rsi, r8
mov ebx, r12d
mov r14, rdx
mov rdi, rcx
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
lea r13d, [r12 + 1]
cmp rcx, r15
je 0x1400f484f
test byte [rcx + 0x1c], r13b
je 0x1400f484f
cmp byte [rcx + 0x19], 5
jb 0x1400f484f
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x11]
lea r8, [0x140157120]
call fcn.140004c54
mov rcx, qword [0x140170048]
or rbp, 0xffffffffffffffff
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x88], r12
cmp rcx, r15
je 0x1400f4891
test byte [rcx + 0x1c], r13b
je 0x1400f4891
cmp byte [rcx + 0x19], 5
jb 0x1400f4891
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x13]
mov r9, rdi
lea r8, [0x140157120]
call fcn.140005bdc
mov rcx, qword [0x140170048]
test r14, r14
jne 0x1400f48dc
test rsi, rsi
jne 0x1400f48dc
mov ebx, 0x80070057
cmp rcx, r15
je 0x1400f4ba4
test byte [rcx + 0x1c], r13b
je 0x1400f4ba4
cmp byte [rcx + 0x19], 2
jb 0x1400f4ba4
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x13]
lea r8, [0x140157120]
call fcn.140004c54
mov rcx, qword [0x140170048]
jmp 0x1400f4ba4
mov eax, 3
mov qword [rsp + 0x30], r12
mov r8d, eax
mov dword [rsp + 0x28], 0x2200000
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov edx, 0x60000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f4966
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400f4ba4
test byte [rcx + 0x1c], r13b
je 0x1400f4ba4
cmp byte [rcx + 0x19], 2
jb 0x1400f4ba4
lea edx, [rbp + 0x15]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140157120]
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005c44
jmp 0x1400f48d0
test rsi, rsi
je 0x1400f49e7
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8d, 0x80000004
mov edx, r13d
mov qword [rsp + 0x20], r12
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x1400f49e7
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400f4ba4
test byte [rcx + 0x1c], r13b
je 0x1400f4ba4
cmp byte [rcx + 0x19], 2
jb 0x1400f4ba4
mov rcx, qword [rcx + 0x10]
mov edx, 0x15
mov dword [rsp + 0x28], ebx
mov r9d, 0x80000004
mov qword [rsp + 0x20], rdi
call fcn.1400f4490
jmp 0x1400f48d0
test r14, r14
je 0x1400f4c26
lea rax, [rsp + 0x88]
mov r8d, r13d
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x98]
mov qword [rsp + 0x30], r12
mov edx, r13d
mov qword [rsp + 0x28], r12
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x1400f4a69
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400f4ba4
test byte [rcx + 0x1c], r13b
je 0x1400f4ba4
cmp byte [rcx + 0x19], 2
jb 0x1400f4ba4
mov edx, 0x16
jmp 0x1400f494a
mov rcx, qword [rsp + 0x98]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400f4c26
mov rax, rsi
mov rcx, rbp
neg rax
sbb r15d, r15d
and r15d, 0x80000004
add r15d, r13d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
mov r8d, 3
mov rax, rsi
mov dword [rsp + 0x28], 0x2200000
neg rax
mov dword [rsp + 0x20], r8d
mov rcx, rdi
sbb edx, edx
xor r9d, r9d
and edx, 0x40000
add edx, 0xa0000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f4b26
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x1400f4ba4
test byte [rcx + 0x1c], r13b
je 0x1400f4ba4
cmp byte [rcx + 0x19], 2
jb 0x1400f4ba4
lea edx, [rbp + 0x18]
jmp 0x1400f494a
mov qword [rsp + 0x30], r12
mov r9, r14
mov qword [rsp + 0x28], rsi
mov r8d, r15d
mov edx, r13d
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x1400f4c1f
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x1400f4b9d
test byte [rcx + 0x1c], r13b
je 0x1400f4b9d
cmp byte [rcx + 0x19], 2
jb 0x1400f4b9d
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov dword [rsp + 0x28], ebx
mov r9d, r15d
mov qword [rsp + 0x20], rdi
call fcn.1400f4490
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x1400f4bc9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x140170048]
mov qword [rsp + 0x88], r12
cmp rbp, 0xffffffffffffffff
je 0x1400f4bdf
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400f4c05
test byte [rcx + 0x1c], r13b
je 0x1400f4c05
cmp byte [rcx + 0x19], 5
jb 0x1400f4c05
mov rcx, qword [rcx + 0x10]
lea r8, [0x140157120]
mov edx, 0x1a
call fcn.140004c54
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r15, [0x140170048]
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400f4ba4
test byte [rcx + 0x1c], r13b
je 0x1400f4ba4
cmp byte [rcx + 0x19], 5
jb 0x1400f4ba4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140157120]
mov edx, 0x19
mov r9, rdi
call fcn.140005bdc
jmp 0x1400f48d0