Function at 0x1400489c0
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, qword [0x1400db108]
mov rax, qword [rsi]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp byte [rcx + 0x6c], 0
je 0x140048a34
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], 0
mov rcx, qword [rcx + 0x60]
lea r8, [rsp + 0x28]
mov edx, 2
call fcn.140058740
mov r14, qword [rsp + 0x28]
test eax, eax
je 0x140048a3e
mov ebp, eax
mov qword [rsp + 0x28], 0
test r14, r14
je 0x140048c87
mov rcx, r14
call fcn.1400acb40
jmp 0x140048c87
mov ebp, 0x3f0
jmp 0x140048c87
xor ebp, ebp
test r14, r14
je 0x140048c87
cmp dword [r14], 0
je 0x140048c76
xor ebp, ebp
movabs r15, 0xf0f0f0f0f0f0f0f1
mov r13, qword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x140048aaf
mov eax, dword [rsp + 0x68]
mov dword [rdx + 0x40], eax
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmm2, xmmword [rsp + 0x48]
movups xmm3, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x30], xmm3
movups xmmword [rdx + 0x20], xmm2
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
add rdx, 0x44
mov qword [rbx + 0x38], rdx
nop word [rax + rax]
inc rbp
mov eax, dword [r14]
cmp rbp, rax
jae 0x140048c76
mov rax, rbp
shl rax, 4
test dword [r14 + rax + 0x10], 0xc0000020
jne 0x140048aa0
lea r12, [r14 + rax]
add r12, 8
test rdi, rdi
je 0x140048b1a
mov rax, qword [rdi]
cmp qword [rdi + 8], rax
je 0x140048b1a
xor esi, esi
nop dword [rax]
mov rcx, rsi
shl rcx, 6
lea rcx, [rcx + rsi*4]
add rcx, rax
call fcn.140052470
mov rdx, qword [r12]
mov rcx, rax
call r13
test eax, eax
jne 0x140048aa0
inc esi
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
sub rcx, rax
sar rcx, 2
imul rcx, r15
cmp rcx, rsi
ja 0x140048ae0
mov rdx, qword [r12]
lea rcx, [rsp + 0x28]
call fcn.140051d10
mov rdx, qword [rbx + 0x38]
mov rax, qword [rbx + 0x40]
cmp rdx, rax
jb 0x140048a68
mov rcx, qword [rbx + 0x30]
mov r12, rdx
sub r12, rcx
sar r12, 2
imul r12, r15
lea rsi, [r12 + 1]
movabs r9, 0x3c3c3c3c3c3c3c3
cmp rsi, r9
ja 0x140048caf
sub rax, rcx
sar rax, 2
imul rax, r15
lea r8, [rax + rax]
cmp r8, rsi
cmova rsi, r8
movabs r8, 0x1e1e1e1e1e1e1e1
cmp rax, r8
cmovae rsi, r9
test rsi, rsi
je 0x140048bb2
cmp rsi, r9
ja 0x140048cb4
mov rax, rsi
shl rax, 6
lea rcx, [rax + rsi*4]
call fcn.1400aca30
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rbx + 0x38]
jmp 0x140048bb4
xor eax, eax
mov r8, r12
shl r8, 6
lea r8, [r8 + r12*4]
lea r10, [rax + r8]
mov r9, rsi
shl r9, 6
lea r9, [r9 + rsi*4]
add r9, rax
mov r11d, dword [rsp + 0x68]
mov dword [rax + r8 + 0x40], r11d
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmm2, xmmword [rsp + 0x48]
movups xmm3, xmmword [rsp + 0x58]
movups xmmword [rax + r8 + 0x30], xmm3
movups xmmword [rax + r8 + 0x20], xmm2
movups xmmword [rax + r8 + 0x10], xmm1
movups xmmword [rax + r8], xmm0
cmp rdx, rcx
je 0x140048c50
nop dword [rax + rax]
mov r11d, dword [rdx - 4]
mov dword [r10 - 4], r11d
movups xmm0, xmmword [rdx - 0x44]
movups xmm1, xmmword [rdx - 0x34]
movups xmm2, xmmword [rdx - 0x24]
movups xmm3, xmmword [rdx - 0x14]
lea r11, [rdx - 0x44]
movups xmmword [r10 - 0x14], xmm3
movups xmmword [r10 - 0x24], xmm2
movups xmmword [r10 - 0x34], xmm1
movups xmmword [r10 - 0x44], xmm0
add r10, 0xffffffffffffffbc
mov rdx, r11
cmp r11, rcx
jne 0x140048c10
mov rcx, qword [rbx + 0x30]
add rax, r8
add rax, 0x44
mov qword [rbx + 0x30], r10
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], r9
test rcx, rcx
je 0x140048aa0
call fcn.1400acb10
jmp 0x140048aa0
mov rcx, r14
call fcn.1400acb40
mov rsi, qword [0x1400db108]
xor ebp, ebp
mov rax, qword [rsp + 0x70]
xor rax, rsp
mov rcx, qword [rsi]
cmp rcx, rax
jne 0x140048caa
mov eax, ebp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400addd0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
call fcn.140002940
int3