Function at 0x140020750
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x180
mov qword [rsp + 0x170], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x1400e5f10]
lea rbx, str.Kernel32
test al, 1
jne 0x1400207b5
or eax, 1
mov dword [0x1400e5f10], eax
xor r9d, r9d
lea r8, str.GetNamedPipeServerProcessId
mov rdx, rbx
lea rcx, [0x1400e5f00]
call fcn.14004b920
lea rcx, [0x1400b4400]
call fcn.140075530
nop
mov rax, qword [0x1400e5f00]
test rax, rax
je 0x140020ac2
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call rax
test eax, eax
jne 0x140020863
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [0x1400b59c8]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.GetNamedPipeServerProcessId
mov edx, 0x100
lea rcx, [rsp + 0x48]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x40], r11
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x148]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x40]
call fcn.140073110
int3
mov r8d, dword [rsp + 0x1a0]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x178], rax
test rax, rax
jne 0x1400208bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov r9d, dword [rsp + 0x1a0]
lea rdx, str.OpenProcess__lu_
lea rcx, [rsp + 0x40]
call fcn.14001b7b0
lea rdx, [0x1400e08b0]
lea rcx, [rsp + 0x40]
call fcn.140073110
int3
lea rdx, [rsp + 0x1a8]
mov rcx, rdi
call qword [0x1400e5f00]
test eax, eax
je 0x140020a39
mov eax, dword [rsp + 0x1a8]
cmp dword [rsp + 0x1a0], eax
jne 0x140020a39
xor edi, edi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x30]
mov edx, 0x20008
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140020993
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [0x1400b59c8]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], dil
mov byte [rsp + 0x148], dil
or r9d, 0xffffffff
lea r8, [0x1400b8bf0]
mov edx, 0x100
lea rcx, [rsp + 0x48]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x40], r11
mov byte [rsp + 0x148], dil
or r9d, 0xffffffff
lea r8, str.System
lea edx, [rdi + 0x20]
lea rcx, [rsp + 0x148]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x40]
call fcn.140073110
int3
mov rcx, rdi
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1400209b4
lea rcx, [rsp + 0x38]
call fcn.140046c90
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400209f4
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1400209f4
mov rcx, qword [rsp + 0x38]
call fcn.140073030
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400209e1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140020b26
lea rax, [0x1400b59c8]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.I_refuse_to_connect:_endpoint_had_unexpected_identity
mov edx, 0x100
lea rcx, [rsp + 0x48]
call fcn.14001e6f0
lea rdx, [0x1400e0790]
lea rcx, [rsp + 0x40]
call fcn.140073110
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [0x1400b59c8]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.process_sync_failed_w_GetNamedPipeServerProcessId
mov edx, 0x100
lea rcx, [rsp + 0x48]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x40], r11
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x148]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x40]
call fcn.140073110
nop
mov qword [rsp + 0x20], rbx
lea r9, str.GetNamedPipeServerProcessId
lea r8, str.Function__s_not_found_in__s_library
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.14001a6b0
lea r11, [0x1400b8b28]
mov qword [rsp + 0x40], r11
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.DynamicFnLoadFailed
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x148]
call fcn.14001e6f0
lea rdx, [0x1400e09d8]
lea rcx, [rsp + 0x40]
call fcn.140073110
int3
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret