Function at 0x14002a89c
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor edi, edi
xor r13d, r13d
cmp ecx, 1
sete r13b
neg r9d
mov r12d, r8d
sbb r15d, r15d
mov r14, rdx
mov esi, ecx
and r15d, 0xffffff80
mov qword [rax + 0x10], rdi
add r15d, 0x100
xor ebx, ebx
mov rcx, qword [str.___t_]
lea rax, str.___t_
mov bpl, 4
cmp rcx, rax
je 0x14002a928
test byte [rcx + 0x1c], bpl
je 0x14002a928
cmp byte [rcx + 0x19], 5
jb 0x14002a928
mov rcx, qword [rcx + 0x10]
lea r8, [0x140002ae8]
mov edx, 0x1c6
call fcn.14000e618
mov rcx, qword [str.___t_]
lea rax, str.___t_
test r14, r14
jne 0x14002a960
cmp rcx, rax
je 0x14002a956
test byte [rcx + 0x1c], bpl
je 0x14002a956
cmp byte [rcx + 0x19], 2
jb 0x14002a956
mov rcx, qword [rcx + 0x10]
lea r8, [0x140002ae8]
mov edx, 0x1c7
xor r9d, r9d
call fcn.140017a54
mov eax, 0x57
jmp 0x14002ab6a
cmp esi, 1
jbe 0x14002a990
cmp rcx, rax
je 0x14002a956
test byte [rcx + 0x1c], bpl
je 0x14002a956
cmp byte [rcx + 0x19], 2
jb 0x14002a956
mov rcx, qword [rcx + 0x10]
lea r8, [0x140002ae8]
mov edx, 0x1c8
mov r9d, esi
call fcn.14000e63c
jmp 0x14002a956
call fcn.140052b14
mov rsi, rax
test rax, rax
jne 0x14002a9ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14002ab52
test byte [rcx + 0x1c], bpl
je 0x14002ab52
cmp byte [rcx + 0x19], 2
jb 0x14002ab52
mov rcx, qword [rcx + 0x10]
lea r8, [0x140002ae8]
mov edx, 0x1c9
mov r9d, ebx
call fcn.14000e63c
jmp 0x14002ab52
test r13d, r13d
je 0x14002a9f9
test r12d, r15d
cmove rbx, rax
mov rbp, qword [rsp + 0x80]
mov r9, rbx
mov r8d, r13d
mov rdx, r14
mov qword [rsp + 0x20], rbp
call fcn.140016714
mov ebx, eax
test eax, eax
je 0x14002aa57
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14002aa49
test byte [rcx + 0x1c], 4
je 0x14002aa49
cmp byte [rcx + 0x19], 2
jb 0x14002aa49
mov rcx, qword [rcx + 0x10]
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.14001bdf8
cmp ebx, 2
jne 0x14002ab52
jmp 0x14002ab4d
mov edx, 0x5c
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x14002aa6e
add rax, 2
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rdx, rax
call fcn.14001624c
mov ebx, eax
test eax, eax
je 0x14002aac5
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14002aabb
test byte [rcx + 0x1c], 4
je 0x14002aabb
cmp byte [rcx + 0x19], 2
jb 0x14002aabb
mov rcx, qword [rcx + 0x10]
lea r8, [0x140002ae8]
mov edx, 0x1cb
mov r9d, ebx
call fcn.14000e63c
mov rdi, qword [rsp + 0x68]
jmp 0x14002ab52
mov rdi, qword [rsp + 0x68]
test rdi, rdi
jne 0x14002ab04
lea edx, [rdi + 1]
mov ecx, r12d
call fcn.14005caf0
test eax, eax
jne 0x14002ab52
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14002ab4d
test byte [rcx + 0x1c], 4
je 0x14002ab4d
cmp byte [rcx + 0x19], 2
jb 0x14002ab4d
mov edx, 0x1cc
jmp 0x14002ab3d
test r12d, r15d
jne 0x14002ab52
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14002ab52
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14002ab4d
test byte [rcx + 0x1c], 4
je 0x14002ab4d
cmp byte [rcx + 0x19], 2
jb 0x14002ab4d
mov edx, 0x1cd
mov rcx, qword [rcx + 0x10]
lea r8, [0x140002ae8]
call fcn.14000e618
mov ebx, 0x1b61
mov rcx, rsi
call fcn.140072328
test rdi, rdi
je 0x14002ab68
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret