Function at 0x14001ef80
Capabilities:
Compare security identifiers
List user accounts for group

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov qword [r11 - 0x1a8], 0xfffffffffffffffe
mov rsi, r9
mov r13, rdx
mov r15, rcx
xor ebx, ebx
mov qword [rsp + 0x70], rbx
lea rax, [0x1400f83f8]
mov qword [rsp + 0x68], rax
mov qword [r11 - 0x278], rbx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x48], rbx
lea r14, str.0_t_
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x58], 7
mov qword [r11 - 0x1b0], rbx
mov dword [rsp + 0x5c], ebx
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x54], ebx
mov dword [r11 + 8], ebx
lea r12, str.base_stor_vssmodules_sec_security.cxx
mov qword [r11 - 0x260], r12
lea rax, str.CVssSidCollection::ExpandForVerification
mov qword [r11 - 0x258], rax
lea rax, str.SECSECRC
mov qword [r11 - 0x250], rax
mov dword [rsp + 0xb0], 0x763
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_114], 0xb
mov dword [rsp + 0xb8], 0xff
mov dword [rsp + 0x138], 0x1000000
lea rdi, [r11 - 0x238]
xor eax, eax
mov ecx, 0xf
rep stosq qword [rdi], rax
lea r8, str.ExpandForVerification__
lea rdx, [r11 - 0x260]
mov rcx, r13
call fcn.14001cc70
mov rcx, qword [r15 + 0x68]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetSidSubAuthorityCount]
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetSidSubAuthorityCount]
cmp rax, rdi
jb 0x140052000
lea r8, [rsp + 0x300]
mov rdx, qword [r15 + 0x68]
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualDomainSid]
cmp dword [rsp + 0x300], ebx
jne 0x14001f112
lea rdi, str.FALSE
mov qword [rsp + 0x20], rdi
lea r9, str.Returning_BOOL:__s
mov r8d, 0xaa
lea rdx, str.RETURN
mov rcx, r13
call fcn.14001d380
nop
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140052010
xor al, al
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x54]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_lsalookup_l1_1_0.dll_LookupAccountSidLocalW]
mov edi, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
cmp eax, 0x7a
jne 0x1400523a8
test edi, edi
jne 0x1400523b5
mov edx, dword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov r12, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14005201c
mov edx, dword [rsp + 0x54]
lea rdx, [rdx*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov r14, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14005203b
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, [rsp + 0x54]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_lsalookup_l1_1_0.dll_LookupAccountSidLocalW]
test eax, eax
je 0x14005205a
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x14005211c
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x148]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.samcli.dll_NetLocalGroupGetMembers]
mov edi, eax
cmp eax, 0x8ac
je 0x140052128
test eax, eax
jne 0x14005215e
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x14001f272
mov edi, ebx
mov r15, qword [rsp + 0x310]
cmp edi, dword [rsp + 0x5c]
jae 0x14001f2ec
mov ecx, edi
mov rdx, r15
mov rcx, qword [rsi + rcx*8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x140052372
inc edi
jmp 0x14001f24d
lea rdi, str.FALSE
mov qword [rsp + 0x20], rdi
lea r9, str.Returning_BOOL:__s
mov r8d, 0xaa
lea rdx, str.RETURN
mov rcx, r13
call fcn.14001d380
nop
lea rsi, str.0_t_
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140052366
mov qword [rsp + 0x48], rbx
lea rax, [0x1400f8090]
mov qword [rsp + 0x40], rax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov qword [rsp + 0x80], rbx
mov rcx, r12
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov qword [rsp + 0x70], rbx
xor al, al
jmp 0x14001f0ff
lea rsi, str.0_t_
lea rdi, str.FALSE
mov qword [rsp + 0x20], rdi
lea r9, str.Returning_BOOL:__s
mov r8d, 0xaa
lea rdx, str.RETURN
mov rcx, r13
call fcn.14001d380
nop
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001f331
call qword [sym.imp.netutils.dll_NetApiBufferFree]
mov qword [rsp + 0x48], rbx
lea rax, [0x1400f8090]
mov qword [rsp + 0x40], rax
test r14, r14
je 0x14001f351
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop
test r12, r12
je 0x14001f0fd
mov rcx, r12
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0x14001f0fd
mov dword [rsp + 0x300], 1
jmp 0x14001f112
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop
jmp 0x14001f0fd
mov dword [rsp + 0x88], 0x8007000e
lea rdx, [0x140167770]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll__CxxThrowException
mov dword [rsp + 0x8c], 0x8007000e
lea rdx, [0x140167770]
lea rcx, [rsp + 0x8c]
call sub.msvcrt.dll__CxxThrowException
lea rsi, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x98], rsi
lea r15, str.CVssSidCollection::ExpandForVerification
mov qword [rsp + 0xa0], r15
lea r12, str.SECSECRC
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb0], 0x795
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_114], 0xb
mov dword [rsp + 0xb8], 0xff
mov dword [rsp + 0x138], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc0]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
lea r8, str.LookupAccountSid_fails_unexpectedly__winerror__d.
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.14001cc70
xor edx, edx
mov rcx, r13
call fcn.14001cbf4
movzx edi, al
lea rcx, [rsp + 0x40]
call fcn.14005d714
nop
lea rcx, [rsp + 0x78]
call fcn.140027ab0
nop
lea rcx, [rsp + 0x68]
call fcn.140027ab0
movzx eax, dil
jmp 0x14001f0ff
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop
jmp 0x14001f1e0
xor edx, edx
mov rcx, r13
call fcn.14001cbf4
movzx edi, al
lea rcx, [rsp + 0x40]
call fcn.14005d714
nop
lea rcx, [rsp + 0x78]
call fcn.140027ab0
nop
lea rcx, [rsp + 0x68]
call fcn.140027ab0
movzx eax, dil
jmp 0x14001f0ff
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rdx, qword [r15 + 0x70]
test rdx, rdx
je 0x140052196
mov rcx, rax
sub rcx, rdx
cmp rcx, 0x36ee80
ja 0x140052196
lea rsi, str.base_stor_vssmodules_sec_security.cxx
lea r15, str.CVssSidCollection::ExpandForVerification
lea r12, str.SECSECRC
jmp 0x1400522e8
mov qword [r15 + 0x70], rax
lea rsi, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x98], rsi
lea r15, str.CVssSidCollection::ExpandForVerification
mov qword [rsp + 0xa0], r15
lea r12, str.SECSECRC
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb0], 0x7b8
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_114], 0xb
mov dword [rsp + 0xb8], 0xff
mov dword [rsp + 0x138], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc0]
call sub.msvcrt.dll_memset
test edi, edi
jg 0x14005220f
mov r8d, edi
jmp 0x14005221a
movzx r8d, di
or r8d, 0x80070000
mov qword [rsp + 0x20], r14
lea r9, str.NetLocalGroupGetMemebers__s_
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.1400da57c
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb0], 0x7bd
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_114], 0xb
mov dword [rsp + 0xb8], 0xff
mov dword [rsp + 0x138], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc0]
call sub.msvcrt.dll_memset
mov r8, r14
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x98]
call fcn.14000ad60
mov r8d, edi
lea rdx, [rsp + 0x168]
mov rcx, rax
call fcn.1400d9d78
mov r9d, 2
mov r8, rax
mov edx, 0x2026
mov rcx, r13
call fcn.1400db328
lea rcx, [rsp + 0x210]
call fcn.14000ae60
lea rcx, [rsp + 0x98]
call fcn.14000ae60
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb0], 0x7c1
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_114], 0xb
mov dword [rsp + 0xb8], 0xff
mov dword [rsp + 0x138], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc0]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
lea r9, str.NetLocalGroupGetMembers___failed_for___s__with__d
mov r8d, 0x80042302
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.1400dc25c
nop
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop
jmp 0x14001f2b5
mov dl, 1
mov rcx, r13
call fcn.14001cbf4
movzx edi, al
lea rcx, [rsp + 0x40]
call fcn.14005d714
nop
lea rcx, [rsp + 0x78]
call fcn.140027ab0
nop
lea rcx, [rsp + 0x68]
call fcn.140027ab0
movzx eax, dil
jmp 0x14001f0ff
test edi, edi
jne 0x1400523b5
lea rdi, str.FALSE
jmp 0x1400523bc
lea rdi, str.TRUE
mov qword [rsp + 0x98], r12
lea r15, str.CVssSidCollection::ExpandForVerification
mov qword [rsp + 0xa0], r15
lea r12, str.SECSECRC
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb0], 0x786
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_114], 0xb
mov dword [rsp + 0xb8], 0xff
mov dword [rsp + 0x138], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc0]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x20], rdi
mov r9d, r14d
lea r8, str.LookupAccountSid_returned_with_winerror__d__bRes__s.
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.14001cc70
xor edx, edx
mov rcx, r13
call fcn.14001cbf4
movzx edi, al
lea rcx, [rsp + 0x40]
call fcn.14005d714
nop
lea rcx, [rsp + 0x78]
call fcn.140027ab0
nop
lea rcx, [rsp + 0x68]
call fcn.140027ab0
movzx eax, dil
jmp 0x14001f0ff