Function at 0x140029810
Capabilities:
Compare security identifiers
List user accounts for group

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov qword [r11 - 0x1a0], 0xfffffffffffffffe
mov rsi, r9
mov r13, rdx
mov r15, rcx
xor ebx, ebx
mov qword [r11 - 0x270], rbx
lea rax, [0x1400f2350]
mov qword [r11 - 0x278], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
lea r14, [0x1400f23f8]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x78], 7
mov qword [r11 - 0x1a8], rbx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x50], ebx
mov dword [r11 + 8], ebx
lea r12, str.base_stor_vssmodules_sec_security.cxx
mov qword [r11 - 0x258], r12
lea rax, str.CVssSidCollection::ExpandForVerification
mov qword [r11 - 0x250], rax
lea rax, str.SECSECRC
mov qword [r11 - 0x248], rax
mov dword [rsp + 0xb8], 0x74c
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
mov dword [rsp + 0x140], 0x1000000
lea rdi, [r11 - 0x230]
xor eax, eax
mov ecx, 0xf
rep stosq qword [rdi], rax
lea r8, str.ExpandForVerification__
lea rdx, [r11 - 0x258]
mov rcx, r13
call fcn.140010920
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_GetSidSubAuthorityCount]
mov rdi, rax
mov rcx, qword [r15 + 0x68]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_GetSidSubAuthorityCount]
cmp rdi, rax
jb 0x14004dcfe
lea r8, [rsp + 0x300]
mov rdx, qword [r15 + 0x68]
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_EqualDomainSid]
cmp dword [rsp + 0x300], ebx
jne 0x1400299a4
lea rdi, str.FALSE
mov qword [rsp + 0x20], rdi
lea r9, str.Returning_BOOL:__s
mov r8d, 0xaa
lea rdx, str.RETURN
mov rcx, r13
call fcn.14000f840
nop
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x14004dd0e
xor al, al
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_lsalookup_l1_1_1.dll_LookupAccountSidLocalW]
mov edi, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov r14d, eax
cmp eax, 0x7a
jne 0x14004e0af
test edi, edi
jne 0x14004e0bc
mov edx, dword [rsp + 0x54]
lea rdx, [rdx*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov r12, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14004dd1a
mov edx, dword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov r14, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14004dd39
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, [rsp + 0x50]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_lsalookup_l1_1_1.dll_LookupAccountSidLocalW]
test eax, eax
je 0x14004dd58
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x14004de1d
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.samcli.dll_NetLocalGroupGetMembers]
mov edi, eax
cmp eax, 0x8ac
je 0x14004de29
test eax, eax
jne 0x14004de62
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x140029b04
mov edi, ebx
mov r15, qword [rsp + 0x310]
cmp edi, dword [rsp + 0x58]
jae 0x140029b7e
mov ecx, edi
mov rdx, r15
mov rcx, qword [rsi + rcx*8]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_EqualSid]
test eax, eax
jne 0x14004e076
inc edi
jmp 0x140029adf
lea rdi, str.FALSE
mov qword [rsp + 0x20], rdi
lea r9, str.Returning_BOOL:__s
mov r8d, 0xaa
lea rdx, str.RETURN
mov rcx, r13
call fcn.14000f840
nop
lea rsi, [0x1400f23f8]
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x14004e06a
mov qword [rsp + 0x48], rbx
lea rax, [0x1400eb7b0]
mov qword [rsp + 0x40], rax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov qword [rsp + 0x70], rbx
mov rcx, r12
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov qword [rsp + 0x88], rbx
xor al, al
jmp 0x140029991
lea rsi, [0x1400f23f8]
lea rdi, str.FALSE
mov qword [rsp + 0x20], rdi
lea r9, str.Returning_BOOL:__s
mov r8d, 0xaa
lea rdx, str.RETURN
mov rcx, r13
call fcn.14000f840
nop
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140029bc3
call qword [sym.imp.netutils.dll_NetApiBufferFree]
mov qword [rsp + 0x48], rbx
lea rax, [0x1400eb7b0]
mov qword [rsp + 0x40], rax
test r14, r14
je 0x140029be3
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop
test r12, r12
je 0x14002998f
mov rcx, r12
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0x14002998f
mov dword [rsp + 0x300], 1
jmp 0x1400299a4
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop
jmp 0x14002998f
mov dword [rsp + 0x94], 0x8007000e
lea rdx, [0x140156368]
lea rcx, [rsp + 0x94]
call sub.msvcrt.dll__CxxThrowException
mov dword [rsp + 0x98], 0x8007000e
lea rdx, [0x140156368]
lea rcx, [rsp + 0x98]
call sub.msvcrt.dll__CxxThrowException
lea rsi, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0xa0], rsi
lea r15, str.CVssSidCollection::ExpandForVerification
mov qword [rsp + 0xa8], r15
lea r12, str.SECSECRC
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0xb8], 0x77e
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
mov dword [rsp + 0x140], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov r9d, eax
lea r8, str.LookupAccountSid_fails_unexpectedly__winerror__d.
lea rdx, [rsp + 0xa0]
mov rcx, r13
call fcn.140010920
xor edx, edx
mov rcx, r13
call fcn.14001082c
movzx edi, al
lea rcx, [rsp + 0x40]
call fcn.14005ab18
nop
lea rcx, [rsp + 0x68]
call fcn.14000384c
nop
lea rcx, [rsp + 0x80]
call fcn.14000384c
movzx eax, dil
jmp 0x140029991
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop
jmp 0x140029a72
xor edx, edx
mov rcx, r13
call fcn.14001082c
movzx edi, al
lea rcx, [rsp + 0x40]
call fcn.14005ab18
nop
lea rcx, [rsp + 0x68]
call fcn.14000384c
nop
lea rcx, [rsp + 0x80]
call fcn.14000384c
movzx eax, dil
jmp 0x140029991
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount64]
mov rdx, qword [r15 + 0x70]
test rdx, rdx
je 0x14004de9a
mov rcx, rax
sub rcx, rdx
cmp rcx, 0x36ee80
ja 0x14004de9a
lea rsi, str.base_stor_vssmodules_sec_security.cxx
lea r15, str.CVssSidCollection::ExpandForVerification
lea r12, str.SECSECRC
jmp 0x14004dfec
mov qword [r15 + 0x70], rax
lea rsi, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0xa0], rsi
lea r15, str.CVssSidCollection::ExpandForVerification
mov qword [rsp + 0xa8], r15
lea r12, str.SECSECRC
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0xb8], 0x7a1
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
mov dword [rsp + 0x140], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll_memset
test edi, edi
jg 0x14004df13
mov r8d, edi
jmp 0x14004df1e
movzx r8d, di
or r8d, 0x80070000
mov qword [rsp + 0x20], r14
lea r9, str.NetLocalGroupGetMemebers__s_
lea rdx, [rsp + 0xa0]
mov rcx, r13
call fcn.1400cd68c
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0xb8], 0x7a6
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
mov dword [rsp + 0x140], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll_memset
mov r8, r14
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0xa0]
call fcn.140022250
mov r8d, edi
lea rdx, [rsp + 0x170]
mov rcx, rax
call fcn.1400cce88
mov r9d, 2
mov r8, rax
mov edx, 0x2026
mov rcx, r13
call fcn.140010bcc
lea rcx, [rsp + 0x218]
call fcn.140019ca4
lea rcx, [rsp + 0xa0]
call fcn.140019ca4
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0xb8], 0x7aa
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
mov dword [rsp + 0x140], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
lea r9, str.NetLocalGroupGetMembers___failed_for___s__with__d
mov r8d, 0x80042302
lea rdx, [rsp + 0xa0]
mov rcx, r13
call fcn.1400ce7c0
nop
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop
jmp 0x140029b47
mov dl, 1
mov rcx, r13
call fcn.14001082c
movzx edi, al
lea rcx, [rsp + 0x40]
call fcn.14005ab18
nop
lea rcx, [rsp + 0x68]
call fcn.14000384c
nop
lea rcx, [rsp + 0x80]
call fcn.14000384c
movzx eax, dil
jmp 0x140029991
test edi, edi
jne 0x14004e0bc
lea rdi, str.FALSE
jmp 0x14004e0c3
lea rdi, str.TRUE
mov qword [rsp + 0xa0], r12
lea r15, str.CVssSidCollection::ExpandForVerification
mov qword [rsp + 0xa8], r15
lea r12, str.SECSECRC
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0xb8], 0x76f
mov dword [rsp + reloc.VssTrace.DLL_Ordinal_11c], 0xb
mov dword [rsp + 0xc0], 0xff
mov dword [rsp + 0x140], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x20], rdi
mov r9d, r14d
lea r8, str.LookupAccountSid_returned_with_winerror__d__bRes__s.
lea rdx, [rsp + 0xa0]
mov rcx, r13
call fcn.140010920
xor edx, edx
mov rcx, r13
call fcn.14001082c
movzx edi, al
lea rcx, [rsp + 0x40]
call fcn.14005ab18
nop
lea rcx, [rsp + 0x68]
call fcn.14000384c
nop
lea rcx, [rsp + 0x80]
call fcn.14000384c
movzx eax, dil
jmp 0x140029991