Function at 0x140030ad4
Capabilities:
Compare security identifiers

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r14
mov rax, qword [0x1400d1548]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov rsi, rdx
mov rbx, rcx
xor edi, edi
lea rcx, [rbp + 8]
xor edx, edx
mov qword [rbp + 8], rdi
call fcn.14000fd7c
lea r8, [rbp + 8]
mov edx, 0x88
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
je 0x14004edd0
mov rcx, qword [rbp + 8]
lea rax, [rbp]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rdi + 6]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
jne 0x14004ee0b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x14004eddc
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov edx, dword [rbp]
add edx, 0xc
add edx, eax
mov ecx, edx
mov dword [rbp], edx
lea rax, [rdx + 0xf]
cmp rax, rcx
ja 0x140030ba2
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140039ae0
sub rsp, rax
mov r9d, ecx
mov rcx, qword [rbp + 8]
lea rax, [rbp]
mov edx, 6
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x14004edd0
cmp qword [rbx], rdi
je 0x14004ee0b
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov rcx, qword [rbx]
mov r14d, edi
add ax, 8
add word [rcx + 2], ax
xor edx, edx
mov rcx, qword [rbx]
lea r8, [rbp + 0x10]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
nop dword [rax + rax]
test eax, eax
je 0x140030c45
mov rdx, qword [rbp + 0x10]
mov rcx, rsi
add rdx, 8
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
jne 0x140030ccf
inc r14d
mov edx, r14d
jmp 0x140030c07
mov rcx, qword [rbx]
mov r9, rsi
mov edx, 2
mov r8d, 0x10000000
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAccessAllowedAce]
nop dword [rax + rax]
test eax, eax
je 0x14004edea
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidAcl]
nop dword [rax + rax]
mov rax, qword [rbx]
mov r8, rbx
mov rcx, qword [rbp + 8]
mov edx, 6
movzx r9d, word [rax + 2]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x14004edea
lea rcx, [rbp + 8]
call fcn.14001d64c
mov eax, edi
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140036b80
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov r14, qword [rbp + 0x48]
lea rsp, [rbp + 0x20]
pop rbp
ret
mov eax, edi
mov edi, eax
jmp 0x140030ca1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14004ee10
movzx eax, ax
or eax, 0x80070000
jmp 0x14004ee10
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140030cd1
movzx eax, ax
or eax, 0x80070000
jmp 0x140030cd1
mov eax, 0x80004005
mov edi, eax
jmp 0x140030ccf