Function at 0x1400139c0
Capabilities:
Check for time delay via gettickcount
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov dword [rbp - 0x28], 0x38b
mov qword [rbp - 0x40], rax
mov r14, rdx
lea rax, str.CAutoSid::operator_
mov dword [rbp - 0x24], reloc.VssTrace.DLL_Ordinal_11
mov qword [rbp - 0x38], rax
mov rsi, rcx
lea rax, str.SECSECRC
mov dword [rbp - 0x20], 0xff
xor r15d, r15d
mov qword [rbp - 0x30], rax
xor edx, edx
mov dword [rbp + 0x60], 0x1000000
lea rcx, [rbp - 0x18]
lea r8d, [r15 + 0x78]
call sub.msvcrt.dll_memset
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x78], rax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x68], rax
mov eax, dword [rbp - 0x28]
mov dword [rsp + 0x70], eax
mov eax, dword [rbp - 0x24]
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x58], r15d
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
xorps xmm0, xmm0
mov dword [rsp + 0x54], 0xffffffff
mov dword [rbp - 0x7c], eax
lea rcx, [rbp + 0x90]
mov eax, dword [rbp - 0x20]
xorps xmm1, xmm1
mov dword [rbp - 0x78], eax
mov dword [rsp + 0x50], r15d
mov qword [rbp - 0x50], r15
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
mov qword [rbp + 0x90], r15
call qword [sym.imp.VssTrace.DLL_Ordinal_10]
test eax, eax
js 0x1400526c4
lea rcx, [rsp + 0x50]
call qword [sym.imp.VssTrace.DLL_Ordinal_9]
test eax, eax
js 0x1400526c4
mov rax, qword [rbp + 0x90]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400526cd
mov eax, dword [rax + 0x30]
inc eax
mov dword [rbp - 0x80], eax
cmp dword [rbp - 0x78], 0xff
mov ebx, RegisterTypeLib
mov edi, dword [rsp + 0x74]
cmovne ebx, dword [rbp - 0x78]
call qword [sym.imp.VssTrace.DLL_Ordinal_5]
test eax, eax
jne 0x1400526d6
cmp byte [rbp + 0x63], r15b
je 0x140013b26
lea rbx, [rbp - 0x18]
mov edi, 0xf
nop
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140052741
add rbx, 8
sub rdi, 1
jne 0x140013b10
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14005274f
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x140052768
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_EqualSid]
test eax, eax
jne 0x140013c81
xor sil, sil
lea rax, str.FALSE
lea r9, str.Returning_BOOL:__s
mov qword [rsp + 0x20], rax
mov r8d, 0xaa
lea rdx, str.RETURN
lea rcx, [rsp + 0x50]
call fcn.14000f840
mov rbx, r15
mov rcx, qword [rbp + rbx*8 - 0x70]
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
mov qword [rbp + rbx*8 - 0x70], r15
inc rbx
cmp rbx, 4
jl 0x140013b7e
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
mov r8d, dword [rbp - 0x78]
mov r9d, eax
sub r9d, dword [rbp - 0x7c]
mov eax, 0x10624dd3
mul r9d
mov eax, 0x88888889
mov edi, r9d
mov r10d, edx
shr r10d, 6
mul r10d
imul ecx, r10d, 0x3e8
shr edx, 5
imul eax, edx, 0x3c
sub edi, ecx
sub r10d, eax
mov eax, 0x45e7b273
mul r9d
mov eax, 0x88888889
mov r11d, edx
shr r11d, 0xe
mul r11d
mov eax, 0x95217cb1
shr edx, 5
imul ecx, edx, 0x3c
mul r9d
mov eax, 0x88888889
sub r11d, ecx
mov ebx, edx
shr ebx, 0x15
mul ebx
shr edx, 5
imul eax, edx, 0x3c
sub ebx, eax
cmp r8d, 0xff
jne 0x140013c1f
mov r8d, RegisterTypeLib
mov ecx, dword [rsp + 0x58]
lea rdx, str.EXIT
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], r9d
lea r9, str.Time_spent:__02ld:_02ld:_02ld__04ld__total:__x__HRESULT:__x
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
call fcn.14000f840
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.VssTrace.DLL_Ordinal_9]
lea r11, [rsp + 0x170]
movzx eax, sil
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov sil, 1
lea rax, str.TRUE
jmp 0x140013b58
mov rax, qword [rbp - 0x50]
jmp 0x140013acd
mov dword [rbp - 0x80], r15d
jmp 0x140013ade
mov ecx, edi
call qword [sym.imp.VssTrace.DLL_Ordinal_7]
test eax, eax
je 0x140013b00
lea rcx, [rsp + 0x50]
call fcn.1400d0428
cmp dword [rsp + 0x50], r15d
je 0x140013b00
mov r9d, dword [rbp - 0x80]
lea rax, str.ENTER
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x20], eax
call qword [sym.imp.VssTrace.DLL_Ordinal_3]
nop
jmp 0x140013b00
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
mov qword [rbx], r15
jmp 0x140013b1c
cmp qword [r14 + 8], r15
lea rcx, [rsp + 0x50]
sete dl
call fcn.14001082c
movzx esi, al
jmp 0x140013b7b
lea rcx, [rsp + 0x50]
call fcn.14001082c
movzx esi, al
jmp 0x140013b7b