Function at 0x1400bd940
Capabilities:
Compare security identifiers
Get disk information
Get token membership
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x490
mov rdi, qword [0x140207460]
mov r9d, 0xffffffff
mov r8d, 0x104
mov rax, qword [rdi]
mov qword [rsp + 0x488], rax
xor eax, eax
lea rsi, [rsp + 0x70]
mov rbx, rcx
mov r12, rdx
mov qword [rsp + 0x50], 0
mov rdx, rcx
mov rcx, rsi
mov qword [rsp + 0x58], 0
call fcn.1400bb020
test eax, eax
js 0x1400bdb40
xor r9d, r9d
mov r8d, 0x104
mov edx, eax
mov rcx, rsi
call fcn.1400bc630
test eax, eax
js 0x1400bdb4e
cmp word [0x14023e0a0], 0
lea rbp, [0x14023e0a0]
je 0x1400bdb08
mov rdx, rbp
mov rcx, rsi
mov ebp, 1
call sub.msvcrt.dll__wcsicmp_1
test eax, eax
jne 0x1400bda10
mov rax, qword [rsp + 0x488]
sub rax, qword [rdi]
jne 0x1400bde0c
mov eax, ebp
add rsp, 0x490
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x50]
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov r8d, 5
mov edx, 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x1400bdae8
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400bdae8
mov rsi, qword [sym.imp.ADVAPI32.dll_IsValidSid]
call rsi
test eax, eax
je 0x1400bdae8
mov rbp, qword [0x14023e090]
test rbp, rbp
je 0x1400bdcbf
mov rcx, rbp
call rsi
test eax, eax
jne 0x1400bdc90
mov rcx, qword [rsp + 0x50]
mov rbp, qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
mov edx, 0x1a
call rbp
test eax, eax
jne 0x1400bdc60
test r12, r12
je 0x1400bdae8
mov rcx, qword [rsp + 0x50]
mov edx, 1
call rbp
test eax, eax
je 0x1400bdbd8
mov rcx, rbx
call fcn.1400c3760
test eax, eax
jne 0x1400bdb67
mov r8, rbx
lea rdx, str._s_is_on_a_file_system_that_does_not_record_ownership_n
mov rcx, r12
call fcn.14007ed40
nop dword [rax]
xor ebp, ebp
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400bd9e5
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400bd9e5
mov r8d, 0x104
mov rdx, rbp
lea rcx, str.HOME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x103
jbe 0x1400bd9d1
lea rdx, str.::N_A::
mov rcx, rbp
call sub.msvcrt.dll_wcscpy
jmp 0x1400bd9d1
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400bdb58
xor ebp, ebp
jmp 0x1400bd9e5
call rbx
xor ebp, ebp
mov dword [rax], 0x26
jmp 0x1400bd9e5
lea rbp, [rsp + 0x280]
mov r9d, eax
mov r8d, 0x104
mov rdx, rbx
mov rcx, rbp
call fcn.1400bb020
test eax, eax
jle 0x1400bdad2
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x38], 0
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1400bdad2
test byte [rsp + 0x68], 8
je 0x1400bdad2
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov r14, qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
lea rdx, [rsp + 0x60]
call r14
test eax, eax
je 0x1400bdcac
mov rbp, qword [rsp + 0x60]
mov r13, qword [0x14023e090]
test r13, r13
je 0x1400bdd26
mov rcx, r13
call rsi
test eax, eax
jne 0x1400bdd37
lea rax, [0x1401e137c]
xor r13d, r13d
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, rbx
mov rcx, r12
lea rdx, str._s_is_owned_by:_n_t_s_nbut_the_current_user_is:_n_t_s_n
call fcn.14007ed40
mov rcx, rbp
mov rbx, qword [sym.imp.KERNEL32.dll_LocalFree]
call rbx
mov rcx, r13
call rbx
jmp 0x1400bdae8
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x4c]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400bdaa9
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x1400bdaa9
mov ebp, 1
jmp 0x1400bdaea
mov rdx, qword [0x14023e090]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1400bda8e
jmp 0x1400bdc86
lea rax, str._inconvertible_
xor ebp, ebp
mov qword [rsp + 0x60], rax
jmp 0x1400bdbf9
mov dword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400bdd16
lea r14, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], r14
mov rbp, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, 1
call rbp
test eax, eax
je 0x1400bdd57
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14023e090], 0
jmp 0x1400bda8e
lea rax, [0x1401e1386]
mov qword [rsp + 0x68], rax
jmp 0x1400bdc25
mov rcx, qword [0x14023e090]
lea rdx, [rsp + 0x68]
call r14
test eax, eax
je 0x1400bdda3
mov r13, qword [rsp + 0x68]
mov rax, r13
jmp 0x1400bdc25
mov ecx, dword [rsp + 0x60]
call fcn.1400a5fa0
mov qword [rsp + 0x20], r14
mov r9d, dword [rsp + 0x60]
mov edx, 1
mov rcx, qword [rsp + 0x68]
mov r13, rax
mov r8, rax
call rbp
test eax, eax
jne 0x1400bddb7
mov rcx, r13
call fcn.1400d2670
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14023e090], 0
jmp 0x1400bda8e
lea rax, str._inconvertible_
xor r13d, r13d
mov qword [rsp + 0x68], rax
jmp 0x1400bdc25
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov dword [rsp + 0x60], eax
call fcn.1400a5fa0
mov r8, qword [r13]
mov ecx, dword [rsp + 0x60]
mov rbp, rax
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1400bde11
mov rcx, r13
call fcn.1400d2670
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14023e090], rbp
test rbp, rbp
je 0x1400bda8e
jmp 0x1400bda81
call fcn.1401be670
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_copy_SID___ld_
mov r14d, eax
mov rax, qword [0x1402078f0]
cmp dword [rax], 0
je 0x1400bde35
call sub.libintl_8.dll_libintl_gettext
mov rcx, rax
mov edx, r14d
call fcn.1400a0b40
mov rcx, rbp
call fcn.1400d2670
jmp 0x1400bdd80