Function at 0x14010257c
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r12d, r12d
mov word [rbp + 0x2b], 0x500
lea rax, [rbp + 0xf]
mov qword [rbp + 0x1f], r12
mov qword [r11 - 0x68], rax
mov r13, rcx
mov dword [r11 - 0x70], r12d
lea rcx, [rbp + 0x27]
mov dword [r11 - 0x78], r12d
lea r8d, [r12 + 4]
mov dword [r11 - 0x80], r12d
mov ebx, r12d
mov dword [rsp + 0x30], r12d
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov dl, 1
mov dword [rsp + 0x20], r12d
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0xf], r12
mov qword [rbp + 7], r12
mov dword [rbp + 0x27], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140102636
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14010261c
mov edi, 0x80004005
jmp 0x14010262a
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
jmp 0x140102725
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x27]
mov dword [rsp + 0x48], r12d
mov dl, 1
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
lea r8d, [r9 + 6]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14010260b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x1f]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14010260b
mov rcx, qword [rbp + 0x1f]
lea r8, [rbp + 0x17]
call fcn.140104bc8
mov edi, eax
test eax, eax
jns 0x1401026b4
mov ecx, eax
call fcn.14007ac40
mov rbx, qword [rbp + 0x17]
jmp 0x140102725
mov rbx, qword [rbp + 0x17]
mov r15d, r12d
mov esi, r12d
mov r14d, r12d
cmp dword [rbx], r12d
jbe 0x14010271c
mov rcx, qword [rbp + 0xf]
mov r12d, r14d
add r12, r12
mov rdx, qword [rbx + r12*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1401026ed
xor r12d, r12d
mov r15d, 1
mov esi, r12d
jmp 0x14010270b
mov rdx, qword [rbx + r12*8 + 8]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
xor r12d, r12d
test eax, eax
je 0x14010270b
mov r15d, r12d
lea esi, [r12 + 1]
inc r14d
cmp r14d, dword [rbx]
jb 0x1401026c6
test esi, esi
jne 0x140102721
test r15d, r15d
jne 0x140102721
mov esi, 1
mov dword [r13], esi
mov ecx, edi
call fcn.14007ace8
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x14010273f
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp + 7], r12
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140102752
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp + 0xf], r12
test rbx, rbx
je 0x14010276b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x14010277a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140388a40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret