Function at 0x18002d2c0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x1800737f8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
lea esi, [r8 - 0xd]
mov r14, rdx
lea rdx, [0x180000000]
mov r13, r9
mov edi, r8d
cmp r8d, esi
jbe 0x18002d4d3
mov r15d, 0x54
lea ebx, [r8 - 0xbd]
lea r12d, [r15 + 0x1c]
nop dword [rax + rax]
cmp ebx, 0x1e
ja case.0x18002d333.3
mov ecx, dword [rdx + rbx*4 + 0x2d6ec]
add rcx, rdx
jmp rcx
mov rcx, r14
call qword [0x180074988]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov byte [0x1800749b9], al
call qword [sym.imp.GDI32.dll_GetEnhMetaFileDescriptionW]
lea rdx, [0x180000000]
jmp case.0x18002d333.3
movzx eax, word [0x18006a93c]
lea rdx, [0x18006a940]
mov word [rbp - 0x31], ax
lea rcx, [rbp - 0x2f]
movzx eax, byte [0x18006a93e]
mov r8d, 3
mov byte [rbp - 0x2f], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [0x180000000]
jmp case.0x18002d333.3
movzx eax, word [0x18006a944]
mov dword [rbp - 0x1a], 0x6c6f6f
mov word [rbp - 0x17], ax
movzx eax, word [0x18006a948]
mov word [rbp - 0x15], ax
movzx eax, byte [0x18006a94a]
mov byte [rbp - 0x13], al
jmp case.0x18002d333.3
movzx eax, byte [0x1800749b9]
mov byte [rbp - 0x59], al
jmp case.0x18002d333.3
mov word [rbp - 0x1b], r15w
jmp case.0x18002d333.3
mov r8d, 2
mov word [rbp - 0x1e], 0x61
lea rdx, [0x180066e98]
lea rcx, [rbp - 0x21]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea rdx, [0x180000000]
jmp case.0x18002d333.3
mov dword [rbp - 0x2d], 0x737365
jmp case.0x18002d333.3
mov eax, dword [r14]
lea rdx, [rbp - 0x59]
mov r8, qword [0x180073ee8]
mov ecx, 0x92
mov dword [rbp - 0x59], eax
call fcn.18005e640
mov dword [rbp - 0x59], eax
lea rdx, [0x180000000]
jmp case.0x18002d333.3
mov r8d, 0xa
lea rdx, [rbp - 0x13]
lea ecx, [r8 + 0x16]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
mov r8d, 4
lea rdx, [0x18006a94c]
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [0x180000000]
mov word [rbp - 0xe], r12w
jmp case.0x18002d333.3
mov r8d, 0xa
lea rdx, [rbp - 0x2a]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
lea rdx, [0x180000000]
jmp case.0x18002d333.3
mov eax, dword [str.2Nex]
mov dword [rbp - 0x29], eax
movzx eax, word [0x18006a958]
mov word [rbp - 0x25], ax
movzx eax, byte [0x18006a95a]
mov byte [rbp - 0x23], al
mov dword [rbp - 0x21], 0x657243
jmp case.0x18002d333.3
cmp byte [0x1800749b8], 0
je 0x18002d5e8
dec ebx
lea eax, [rbx + 0xbd]
cmp eax, esi
ja 0x18002d320
lea esi, [rdi - 0xe]
cmp edi, esi
jbe case.0x18002d514.0
mov r12, qword [rbp - 0x59]
lea ebx, [rdi - 0xbf]
mov rdi, qword [rbp - 0x59]
mov r10d, 0x72
mov r15, qword [rbp - 0x59]
xor r9d, r9d
lea r8d, [r10 - 4]
lea r11d, [r10 - 0x44]
cmp ebx, 0xe
ja case.0x18002d514.1
mov ecx, dword [rdx + rbx*4 + 0x2d768]
add rcx, rdx
jmp rcx
mov word [rbp + 3], r10w
jmp case.0x18002d514.1
mov dword [rbp - 0xc], 0x746f68
mov dword [rbp - 1], 0x65006b
jmp case.0x18002d514.1
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x21]
call fcn.1800041c0
xor edx, edx
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rdi, rax
lea ecx, [rdx + 0x48]
call fcn.180006600
mov r8d, 0x6e
xor r9d, r9d
lea r10d, [r8 + 4]
lea r11d, [r8 - 0x40]
jmp case.0x18002d514.1
mov word [rbp + 5], r8w
jmp case.0x18002d514.1
mov r8d, 1
lea rdx, [0x180065aa0]
lea rcx, [rbp - 0x21]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18002d561
xor eax, eax
mov qword [rbp - 0x41], rax
mov dword [rbp - 0x39], eax
mov rax, qword [r14 + 0x260]
cmp rax, 0xffffffffffffffff
jne 0x18002d5c4
xor edx, edx
lea ecx, [rax + 3]
call rdi
mov qword [r14 + 0x260], rax
cmp rax, 0xffffffffffffffff
je 0x18002d5e8
cmp byte [r14 + 0x284], 0
lea rdx, [r14 + 0x28]
mov rcx, rax
je 0x18002d616
mov byte [r14 + 0x284], 0
call r12
test eax, eax
jne 0x18002d561
mov byte [rbp - 0x59], 0
mov eax, dword [rbp - 0x59]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1800604b0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call r15
test eax, eax
je 0x18002d5e8
jmp 0x18002d561
mov dword [rbp + 0xf], 0x64002e
mov dword [rbp + 0x13], 0x6c006c
jmp case.0x18002d514.1
mov eax, dword [r14 + 0x30]
mov dword [r13 + 0x18], eax
mov eax, dword [r14 + 0x48]
mov dword [r13 + 0x1c], eax
jmp case.0x18002d514.1
lea rax, [r14 + 0x54]
mov qword [r13], rax
xor eax, eax
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x49], eax
jmp case.0x18002d514.1
mov eax, dword [r14 + 0x44]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x41]
mov dword [r13 + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov byte [rbp - 0x59], 1
jmp 0x18002d561
lea rdx, str.kernel32.dll
mov word [rbp + 0x17], r9w
lea rcx, [rbp - 0x31]
call fcn.1800041c0
mov r8d, 0x6e
lea rdx, str.kernel32.dll
lea rcx, str.Process32FirstW
mov r15, rax
call fcn.1800041c0
mov r12, rax
jmp 0x18002d561
mov eax, 0x65
mov dword [rbp + 9], 0x33006c
mov word [rbp + 7], ax
mov eax, 0x32
mov word [rbp + 0xd], ax
dec ebx
lea eax, [rbx + 0xbf]
cmp eax, esi
jbe case.0x18002d514.0
lea rdx, [0x180000000]
jmp 0x18002d501