Function at 0x140003540
Capabilities:
Compare security identifiers
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov r15, r8
mov rsi, rdx
mov r14d, ecx
mov dword [rbp + 0x108], r14d
mov r8d, ecx
shr r8d, 0x18
mov eax, ecx
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
movzx ecx, al
movzx r9d, r14b
xor r13d, r13d
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rax, 0x100000001b3
imul r9, rax
xor r9, rcx
imul r9, rax
xor rdx, r9
imul rdx, rax
xor rdx, r8
imul rdx, rax
and rdx, qword [0x140014a80]
shl rdx, 4
add rdx, qword [0x140014a68]
mov rcx, qword [rdx + 8]
mov rax, qword [0x140014a58]
cmp rcx, rax
je 0x140003611
mov rdx, qword [rdx]
cmp r14d, dword [rcx + 0x10]
je 0x140003614
nop dword [rax]
cmp rcx, rdx
je 0x140003611
mov rcx, qword [rcx + 8]
cmp r14d, dword [rcx + 0x10]
jne 0x140003600
jmp 0x140003614
mov rcx, r13
test rcx, rcx
je 0x140003622
cmp rcx, rax
jne 0x140003f1e
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140014ab0], eax
jle 0x1400037d0
lea rcx, [0x140014ab0]
call fcn.14000b968
cmp dword [0x140014ab0], 0xffffffff
jne 0x1400037d0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x140014a98], xmm0
mov qword [0x140014aa8], rax
lea rdx, str.csrss.exe
lea rcx, [rbp - 0x60]
call fcn.140008400
nop
lea rdx, str.wininit.exe
lea rcx, [rbp - 0x40]
call fcn.140008400
nop
lea rdx, str.winlogon.exe
lea rcx, [rbp - 0x20]
call fcn.140008400
nop
lea rdx, str.services.exe
lea rcx, [rbp]
call fcn.140008400
nop
lea rdx, str.lsass.exe
lea rcx, [rbp + 0x20]
call fcn.140008400
nop
lea rdx, str.smss.exe
lea rcx, [rbp + 0x40]
call fcn.140008400
nop
lea rdx, str.System
lea rcx, [rbp + 0x60]
call fcn.140008400
nop
lea rdx, str.svchost.exe
lea rcx, [rbp + 0x80]
call fcn.140008400
nop
lea rdx, [0x14000eef8]
lea rcx, [rbp + 0xa0]
call fcn.140008400
nop
xorps xmm0, xmm0
movdqu xmmword [0x140014a98], xmm0
mov qword [0x140014aa8], r13
mov edx, 9
lea r12, [0x140014a98]
mov rcx, r12
call fcn.14000a220
mov qword [rbp + 0xc8], r12
lea rdi, [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov rbx, qword [0x140014a98]
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x120], r12
mov rdx, rdi
mov rcx, rbx
call fcn.140008540
add rbx, 0x20
mov qword [rbp + 0x118], rbx
add rdi, 0x20
lea rax, [rbp + 0xc0]
cmp rdi, rax
jne 0x140003764
mov rdx, rbx
mov rcx, rbx
call fcn.140009950
mov qword [0x140014aa0], rbx
lea r9, [fcn.140008390]
mov edx, 0x20
mov r8d, 9
lea rcx, [rbp - 0x60]
call fcn.14000ba1c
lea rcx, [0x14000dd60]
call fcn.14000bd14
nop
lea rcx, [0x140014ab0]
call fcn.14000b8fc
mov r8, qword [0x140014a98]
mov r10, qword [0x140014aa0]
cmp r8, r10
je 0x140003850
mov r11, qword [rsi + 0x18]
mov rbx, qword [rsi + 0x10]
nop dword [rax + rax]
mov rax, rsi
cmp r11, 7
jbe 0x1400037fc
mov rax, qword [rsi]
mov rdx, qword [r8 + 0x10]
mov r9, r8
cmp qword [r8 + 0x18], 7
jbe 0x14000380d
mov r9, qword [r8]
cmp rdx, rbx
jne 0x140003836
test rdx, rdx
je 0x14000383f
sub r9, rax
nop word [rax + rax]
movzx ecx, word [r9 + rax]
cmp cx, word [rax]
jne 0x140003836
add rax, 2
sub rdx, 1
jne 0x140003820
jmp 0x14000383f
add r8, 0x20
cmp r8, r10
jne 0x1400037f0
cmp r8, r10
je 0x140003850
lea rdx, [rbp + 0xc8]
jmp 0x140003f12
test r14d, 0xfffffffb
je 0x140003f0b
lea r8, [rbp + 0xf8]
mov edx, 8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140003a83
mov dword [rbp + 0xc0], r13d
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003a76
mov ecx, dword [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140003a76
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0xc0]
mov r8, rbx
mov edx, 1
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140003a6d
mov dword [rbp + 0x100], 0
mov word [rbp + 0x104], 0x500
mov qword [rbp + 0xe8], r13
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xc8], r13
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, 0x12
mov dl, 1
lea rcx, [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140003a6d
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, 0x14
mov dl, 1
lea rcx, [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140003a6d
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, 0x13
mov dl, 1
lea rcx, [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140003a6d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140003b0d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140003b0d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140003b0d
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x104
lea r8, [rbp + 0x130]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x140003f07
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x60]
call fcn.140008400
nop
lea rdx, [0x1400149b0]
lea rcx, [rsp + 0x60]
call fcn.1400029b0
movzx ebx, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140003b67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x110]
call fcn.1400091a0
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003f1e
call fcn.14000bd2c
test bl, bl
je 0x140003f07
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x110]
call fcn.1400091a0
mov r8, rsi
lea rdx, str.Skipping_Microsoft_signed_process:
lea rcx, [rbp - 0x80]
call fcn.140008d90
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x140003bdd
lea rsi, [rcx + 8]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 7
jbe 0x140003bc0
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x10
lea rdx, [0x14000ef00]
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], r13w
jmp 0x140003bfd
mov qword [rsp + 0x20], 8
lea r9, [0x14000ef00]
mov edx, 8
mov rcx, rbx
call fcn.140009f70
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd8], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xc8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xd8], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
lea rax, [rbp + 0x130]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140003c45
mov rsi, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x140003cac
lea rax, [rdi + rsi]
mov qword [rbp + 0xd8], rax
lea rbx, [rbp + 0xc8]
cmp rcx, 7
cmova rbx, qword [rbp + 0xc8]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x130]
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r13w
lea rax, [rbp + 0xc8]
jmp 0x140003cc7
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x130]
mov rdx, rdi
lea rcx, [rbp + 0xc8]
call fcn.140009f70
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rcx, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x128]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140003d49
lea rax, [rcx + 1]
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x110]
cmp rdx, 7
cmova rax, qword [rbp + 0x110]
mov dword [rax + rcx*2], 0x29
lea rax, [rbp + 0x110]
jmp 0x140003d6a
mov qword [rsp + 0x20], 1
lea r9, [0x14000eefc]
mov edx, 1
lea rcx, [rbp + 0x110]
call fcn.140009f70
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rcx, [rsp + 0x60]
call fcn.140001860
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140003dec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003de7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003de7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bd2c
movdqa xmm0, xmmword [0x140010180]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r13w
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x140003e51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bd2c
movdqa xmm0, xmmword [0x140010180]
movdqu xmmword [rbp + 0x120], xmm0
mov word [rbp + 0x110], r13w
mov rdx, qword [rbp + 0xe0]
cmp rdx, 7
jbe 0x140003eb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ea5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ea5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bd2c
movdqa xmm0, xmmword [0x140010180]
movdqu xmmword [rbp + 0xd8], xmm0
mov word [rbp + 0xc8], r13w
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140003f1e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bd2c
jmp 0x140003f1e
xor al, al
jmp 0x140003f20
lea rdx, [rbp + 0x110]
lea r8, [rbp + 0x108]
call fcn.1400091a0
mov al, 1
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.14000b8a0
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x450
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret