Function at 0x180001310
Capabilities:
Compare security identifiers
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x178]
sub rsp, 0x278
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.180024ab0
lea rdx, [rbp + 0x1a0]
mov dword [rbp + 0x1a0], 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, str.system
lea rcx, [rsp + 0x60]
call fcn.1800273c0
test eax, eax
je 0x180001469
xor esi, esi
mov qword [rbp + 0x1b0], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x1b0]
lea edx, [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rbp + 0x1b0]
test eax, eax
je 0x18000147e
lea rax, [rbp + 0x1a0]
mov dword [rbp + 0x1a0], 0x100
mov r9d, 0x100
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
lea edx, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180001477
lea rax, [rbp + 0x1b8]
mov dword [rbp + 0x1a8], esi
mov qword [rsp + 0x50], rax
lea r8d, [rsi + 0x12]
mov dword [rsp + 0x48], esi
lea rcx, [rbp + 0x1a8]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], esi
mov dl, 1
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov word [rbp + 0x1ac], 0x500
mov qword [rbp + 0x1b8], rsi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x180001477
mov rdi, qword [rbp + 0x1b8]
test rdi, rdi
je 0x180001477
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180001484
mov al, 1
add rsp, 0x278
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180001070
test al, al
jne 0x18000149a
call fcn.1800015c0
test al, al
je 0x1800015a4
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr ax, 8
shl cx, 8
or cx, ax
mov eax, 0x600
cmp cx, ax
jb 0x180001469
lea rcx, str.Advapi32.dll
mov qword [rbp + 0x1b0], rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x1b0]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800015a4
lea rcx, str.Advapi32.dll
mov dword [rbp + 0x1a8], esi
mov dword [rbp + 0x1a0], esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x18003e260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180001538
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x278
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9d, 4
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x1a8]
mov rcx, qword [rbp + 0x1b0]
lea edx, [r9 + 0x10]
call rax
test eax, eax
je 0x180001597
cmp dword [rbp + 0x1a0], 4
jne 0x180001597
cmp dword [rbp + 0x1a8], esi
mov rcx, qword [rbp + 0x1b0]
setne bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x180001469
xor al, al
add rsp, 0x278
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x278
pop rdi
pop rsi
pop rbx
pop rbp
ret