Function at 0x1400307d0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1401c7808]
xor rax, rsp
mov qword [rbp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
lea r15, vtable.ATL::CAccessToken.0
mov qword [rbp + 0x58], r15
movdqu xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rbp + 0x50]
mov edx, 8
lea r8d, [rdx - 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x140030d72
mov rax, qword [rbp + 0x58]
lea rcx, [rbp + 0x58]
mov rax, qword [rax + 8]
call qword [0x14015a890]
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x50], xmm0
lea r12, vtable.ATL::CTokenGroups.0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x78], 0x11
mov dword [rbp - 0x68], 0
mov dword [rbp - 0x64], 0xa
movdqa xmmword [rbp - 0x60], xmm0
movss xmm1, dword [0x14015d50c]
movss dword [rsp + 0x7c], xmm1
movss xmm0, dword [0x14015d508]
movss dword [rbp - 0x80], xmm0
movss xmm1, dword [0x14015d510]
movss dword [rbp - 0x7c], xmm1
mov qword [rbp - 0x78], 0x26
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x50], 0
mov byte [rbp - 0x48], 1
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x58]
call fcn.1400303e0
test al, al
je 0x140030d68
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x48], esi
xor edi, edi
mov qword [rsp + 0x38], rdi
xor r13d, r13d
mov qword [rsp + 0x40], r13
cmp qword [rsp + 0x70], rdi
je 0x140030bec
xor eax, eax
mov r14d, dword [rsp + 0x78]
test r14d, r14d
je 0x140030a92
mov r15, qword [rsp + 0x68]
cmp qword [r15 + rax*8], rdi
jne 0x140030968
inc eax
cmp eax, r14d
jb 0x140030956
jmp 0x140030a8b
mov rbx, qword [r15 + rax*8]
nop dword [rax]
mov qword [rbp - 0x40], rbx
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x140030985
mov rbx, rax
jmp 0x1400309a2
xor edx, edx
mov eax, dword [rbx + 0x88]
div r14d
inc edx
xor ebx, ebx
cmp edx, r14d
jae 0x1400309a2
mov rbx, qword [r15 + rdx*8]
test rbx, rbx
je 0x140030990
cmp rdi, r13
jb 0x140030a63
lea r12, [rdi + 1]
cmp r12, r13
jbe 0x140030a63
lfence
test rsi, rsi
jne 0x1400309eb
lea edx, [rsi + 0x78]
mov rcx, r12
call fcn.140107c8c
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140030d93
mov r13, r12
mov qword [rsp + 0x40], r12
mov rdi, qword [rsp + 0x38]
jmp 0x140030a59
mov rdx, qword [rsp + 0x40]
mov rcx, rdx
shr rcx, 1
mov rax, r12
sub rax, rdx
cmp rax, rcx
cmovbe rax, rcx
add rax, rdx
mov r13, r12
cmp r12, rax
cmovb r13, rax
mov edx, 0x78
mov rcx, r13
call fcn.140107c8c
mov rsi, rax
test rax, rax
je 0x140030d93
mov rdi, qword [rsp + 0x38]
imul r8, rdi, 0x78
mov r14, qword [rsp + 0x30]
test r8, r8
je 0x140030a47
mov rdx, r14
mov rcx, rax
call fcn.14012ec40
mov rcx, r14
call fcn.140107c94
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r13
mov r15, qword [rsp + 0x68]
mov r14d, dword [rsp + 0x78]
imul rcx, rdi, 0x78
add rcx, rsi
mov rdx, qword [rbp - 0x40]
call fcn.14002f730
inc rdi
mov qword [rsp + 0x38], rdi
test rbx, rbx
jne 0x140030970
lea r12, vtable.ATL::CTokenGroups.0
lea r15, vtable.ATL::CAccessToken.0
xor ebx, ebx
test rdi, rdi
je 0x140030bec
add rsi, 8
lea r14, vtable.ATL::CSid.0
cmp rbx, rdi
jae 0x140030d5d
mov dword [rsp + 0x20], 0x220
mov r9d, 0x20
lea r8d, [r9 - 0x1e]
lea rdx, [0x14015d368]
lea rcx, [rbp - 0x30]
call fcn.14002f560
test rsi, rsi
je 0x140030b1a
cmp byte [rsi + 0x44], 0
je 0x140030b1a
lfence
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140030b1a
cmp byte [rbp + 0x1c], 0
je 0x140030b1a
lea rcx, [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140030b1a
lfence
lea rdx, [rbp - 0x28]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne dil
jmp 0x140030b1d
xor dil, dil
inc rbx
add rsi, 0x78
mov qword [rbp - 0x30], r14
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140030b52
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14015a890]
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140030b7c
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14015a890]
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140030ba6
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14015a890]
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140030bd0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14015a890]
test dil, dil
jne 0x140030cb5
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
jb 0x140030ab1
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x140030c24
test rdi, rdi
je 0x140030c1b
mov rbx, rsi
nop dword [rax]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
mov rax, qword [rax]
call qword [0x14015a890]
add rbx, 0x78
sub rdi, 1
jne 0x140030c00
mov rcx, rsi
call fcn.140107c94
nop
mov qword [rsp + 0x60], r12
mov rcx, qword [rbp - 0x50]
call fcn.140107c94
lea rcx, [rsp + 0x68]
call fcn.14002f8b0
nop
mov qword [rbp + 0x58], r15
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x60]
test rdx, rdx
je 0x140030c65
test rcx, rcx
je 0x140030c5d
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rbp + 0x60]
mov qword [rbp + 0x68], 0
test rcx, rcx
je 0x140030c78
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x60], 0
mov edx, 8
mov rcx, qword [rbp + 0x70]
call fcn.14013b860
xor al, al
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.14013b830
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x140030cf4
mov rbx, rsi
mov rdi, qword [rsp + 0x38]
nop word [rax + rax]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
mov rax, qword [rax]
call qword [0x14015a890]
add rbx, 0x78
sub rdi, 1
jne 0x140030cd0
mov rcx, rsi
call fcn.140107c94
nop
mov qword [rsp + 0x60], r12
mov rcx, qword [rbp - 0x50]
call fcn.140107c94
lea rcx, [rsp + 0x68]
call fcn.14002f8b0
nop
mov qword [rbp + 0x58], r15
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x60]
test rdx, rdx
je 0x140030d35
test rcx, rcx
je 0x140030d2d
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rbp + 0x60]
mov qword [rbp + 0x68], 0
test rcx, rcx
je 0x140030d48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x60], 0
mov edx, 8
mov rcx, qword [rbp + 0x70]
call fcn.14013b860
mov al, 1
jmp 0x140030c88
mov ecx, 0x80070057
call fcn.14002ff50
nop
lea rcx, [rsp + 0x60]
call fcn.14002fa60
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x80070000
mov dword [rsp + 0x50], eax
lea rdx, [0x1401be5d8]
lea rcx, [rsp + 0x50]
call fcn.14012eb70
nop
mov ecx, 0x8007000e
call fcn.14002ff50
int3