Function at 0x14000d130
Capabilities:
Compare security identifiers

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r15d, r15d
xor eax, eax
mov qword [rbp + 0x40], r15
mov rdi, rcx
mov dword [rbp + 0x38], r15d
mov esi, r15d
mov dword [rbp + 0x30], r15d
mov r14d, r15d
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], eax
mov qword [rbp + 0x48], r15
test rcx, rcx
je 0x14000d4f4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x40]
lea edx, [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000d4f4
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r15 + 2]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14000d1c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000d4f4
mov ecx, dword [rbp + 0x38]
lea rdx, [0x14014fdc0]
mov qword [rsp + 0x68], rbx
call fcn.14002e8b0
mov rcx, qword [rbp + 0x40]
mov rbx, rax
test rax, rax
je 0x14000d23a
mov r9d, dword [rbp + 0x38]
lea rax, [rbp + 0x38]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000d22e
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14000d253
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14000d253
mov rcx, rbx
call fcn.14002e8a8
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x68]
xor al, al
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rbp + 0x38]
lea rdx, [0x14014fdc0]
mov qword [rsp + 0x60], r12
call fcn.14002e8b0
mov r12, rax
test rax, rax
jne 0x14000d274
mov rcx, rbx
jmp 0x14000d2cd
mov r9d, dword [rbp + 0x38]
lea rax, [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
mov r8, r12
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000d2c2
xor r9d, r9d
lea rax, [rbp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 + 7]
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x14000d2e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14000d2e3
mov rcx, rbx
call fcn.14002e8a8
mov rcx, r12
call fcn.14002e8a8
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14000d37c
mov ecx, dword [rbp + 0x38]
lea rdx, [0x14014fdc0]
mov qword [rsp + 0x58], r13
call fcn.14002e8b0
mov r13, rax
test rax, rax
jne 0x14000d30f
mov rcx, rbx
call fcn.14002e8a8
mov rcx, r12
jmp 0x14000d3bd
mov r9d, dword [rbp + 0x38]
lea rax, [rbp + 0x38]
mov r8, r13
mov qword [rsp + 0x20], rax
mov edx, 7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
je 0x14000d3aa
lea r9, [rbp + 0x30]
mov rcx, r13
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x14000d3aa
mov rcx, qword [rbp - 0x40]
test rcx, rcx
jne 0x14000d392
mov rcx, rbx
call fcn.14002e8a8
mov rcx, r12
call fcn.14002e8a8
mov rcx, r13
call fcn.14002e8a8
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r9d, 2
lea rdx, [rbp - 0x38]
lea r8d, [r9 + 0xa]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x14000d3d0
mov rcx, rbx
call fcn.14002e8a8
mov rcx, r12
call fcn.14002e8a8
mov rcx, r13
call fcn.14002e8a8
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14000d377
cmp dword [rbp - 0x38], esi
jbe 0x14000d4b2
nop dword [rax]
mov rcx, qword [rbp - 0x40]
lea r8, [rbp + 0x48]
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x14000d4a5
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000d4a5
cmp byte [rcx], 1
jne 0x14000d456
mov rdx, qword [r12]
add rcx, 8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp + 0x48]
test eax, eax
je 0x14000d425
or r14d, dword [rcx + 4]
xor edi, edi
cmp dword [rbx], edi
jbe 0x14000d456
nop dword [rax + rax]
mov edx, edi
add rcx, 8
add rdx, rdx
mov rdx, qword [rbx + rdx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp + 0x48]
test eax, eax
je 0x14000d450
or r14d, dword [rcx + 4]
inc edi
cmp edi, dword [rbx]
jb 0x14000d430
cmp byte [rcx], 0
jne 0x14000d4a5
mov rdx, qword [r12]
add rcx, 8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp + 0x48]
test eax, eax
je 0x14000d474
or esi, dword [rcx + 4]
xor edi, edi
cmp dword [rbx], edi
jbe 0x14000d4a5
nop word [rax + rax]
mov edx, edi
add rcx, 8
add rdx, rdx
mov rdx, qword [rbx + rdx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp + 0x48]
test eax, eax
je 0x14000d49f
or esi, dword [rcx + 4]
inc edi
cmp edi, dword [rbx]
jb 0x14000d480
inc r15d
cmp r15d, dword [rbp - 0x38]
jb 0x14000d3e0
mov rcx, rbx
call fcn.14002e8a8
mov rcx, r12
call fcn.14002e8a8
mov rcx, r13
call fcn.14002e8a8
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and esi, 0x1201b6
cmp esi, 0x1201b6
jne 0x14000d3cc
test esi, r14d
jne 0x14000d3cc
jmp 0x14000d375
xor al, al
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret