Function at 0x140049070
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
movaps xmmword [rsp + 0x160], xmm7
movaps xmmword [rsp + 0x150], xmm6
mov r14, r8
mov qword [rsp + 0x40], rdx
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x148], rax
movaps xmm6, xmmword [0x1402724c0]
movaps xmmword [rsp + 0x100], xmm6
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x110], rdi
mov byte [rsp + 0x100], 0
lea rdx, [rcx + 0x18]
lea rcx, [rsp + 0xa0]
mov qword [rcx + 0x10], rdi
movaps xmmword [rcx], xmm6
call fcn.1400488d0
cmp byte [rsi + 0x88], 0
mov qword [rsp + 0x38], rsi
je 0x1400491ce
lea r15, [rsp + 0x120]
mov rcx, r14
mov rdx, r15
call fcn.140033f00
mov rbx, qword [r15]
mov r15, qword [r15 + 8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
sub r15, rbx
je 0x140049171
js 0x14004a64f
mov rcx, r15
call fcn.140184834
mov qword [rsp + 0xc0], rax
lea rsi, [rax + r15]
mov qword [rsp + 0xd0], rsi
mov rcx, rax
mov rdx, rbx
mov r8, r15
call fcn.140188f50
mov qword [rsp + 0xc8], rsi
test rbx, rbx
je 0x140049186
mov qword [rsp + 0x128], rbx
mov rcx, rbx
call fcn.14018482c
mov rax, qword [rsp + 0xa8]
cmp rax, qword [rsp + 0xb0]
jb 0x14004a71d
lea rcx, [rsp + 0xa0]
lea rbx, [rsp + 0xc0]
mov rdx, rbx
call fcn.140048e50
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400491c9
mov qword [rsp + 0xc8], rcx
call fcn.14018482c
mov rsi, qword [rsp + 0x38]
cmp byte [rsi + 0x6f], 0
je 0x1400493a0
mov rdx, qword [r14]
lea rbx, [rsp + 0x120]
mov rcx, rbx
mov r8d, 2
call fcn.1400523d0
mov rdi, qword [rbx]
mov rbp, qword [rbx + 8]
cmp rdi, rbp
je 0x14004934e
mov qword [rsp + 0x48], r14
xorps xmm7, xmm7
lea rbx, [rsp + 0xa0]
lea r15, [rsp + 0xc0]
mov rsi, qword [sym.imp.ADVAPI32.dll_EqualSid]
mov eax, dword [rdi + 0x18]
cmp eax, 0xbfffffff
ja 0x140049334
and eax, 0x20
jne 0x140049334
mov rax, qword [rsp + 0x38]
mov r12, qword [rax + 0x70]
mov r13, qword [rax + 0x78]
cmp r12, r13
je 0x140049260
mov rdx, qword [rdi]
mov rcx, qword [r12]
call rsi
test eax, eax
jne 0x140049334
add r12, 0x18
jmp 0x140049244
mov r12, qword [rdi]
mov r13, qword [rdi + 8]
movaps xmmword [rsp + 0xc0], xmm7
mov qword [rsp + 0xd0], 0
sub r13, r12
je 0x1400492b8
js 0x14004a64f
mov rcx, r13
call fcn.140184834
mov qword [rsp + 0xc0], rax
lea r14, [rax + r13]
mov qword [rsp + 0xd0], r14
mov rcx, rax
mov rdx, r12
mov r8, r13
call fcn.140188f50
mov qword [rsp + 0xc8], r14
mov rax, qword [rsp + 0xa8]
cmp rax, qword [rsp + 0xb0]
jae 0x14004930f
test rax, rax
je 0x14004a678
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0xc0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xc8]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xd0]
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rsp + 0xa8], rax
jmp 0x140049334
mov rcx, rbx
mov rdx, r15
call fcn.140048e50
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x140049334
mov qword [rsp + 0xc8], rcx
call fcn.14018482c
add rdi, 0x20
cmp rdi, rbp
jne 0x140049220
mov rdi, qword [rsp + 0x120]
mov r14, qword [rsp + 0x48]
test rdi, rdi
je 0x140049396
mov rax, qword [rsp + 0x128]
mov rcx, rdi
cmp rax, rdi
je 0x140049389
lea rsi, [rax - 0x20]
mov rcx, qword [rax - 0x20]
test rcx, rcx
je 0x140049379
mov qword [rax - 0x18], rcx
call fcn.14018482c
mov rax, rsi
cmp rsi, rdi
jne 0x140049363
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x128], rdi
call fcn.14018482c
movabs rdi, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x80]
mov qword [rcx + 0x10], rdi
movaps xmmword [rcx], xmm6
mov rsi, qword [rsp + 0x38]
mov rdx, rsi
call fcn.1400488d0
cmp byte [rsi + 0x8a], 0
je 0x140049497
lea r12, [rsp + 0x120]
mov r15, r14
mov rcx, r14
mov rdx, r12
call fcn.140033f00
mov rbx, qword [r12]
mov r12, qword [r12 + 8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
sub r12, rbx
je 0x14004943c
js 0x14004a64f
mov rcx, r12
call fcn.140184834
mov qword [rsp + 0xc0], rax
lea rsi, [rax + r12]
mov qword [rsp + 0xd0], rsi
mov rcx, rax
mov rdx, rbx
mov r8, r12
call fcn.140188f50
mov qword [rsp + 0xc8], rsi
test rbx, rbx
je 0x140049451
mov qword [rsp + 0x128], rbx
mov rcx, rbx
call fcn.14018482c
mov rax, qword [rsp + 0x88]
cmp rax, qword [rsp + 0x90]
jb 0x14004a6c5
mov r14, r15
lea rcx, [rsp + 0x80]
lea rbx, [rsp + 0xc0]
mov rdx, rbx
call fcn.140048e50
mov rcx, qword [rbx]
test rcx, rcx
je 0x140049497
mov qword [rsp + 0xc8], rcx
call fcn.14018482c
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0x8b], 0
je 0x140049630
mov rdx, qword [r14]
lea rbx, [rsp + 0x120]
mov rcx, rbx
mov r8d, 2
call fcn.1400523d0
mov rdi, qword [rbx]
mov rsi, qword [rbx + 8]
cmp rdi, rsi
je 0x1400495de
mov r15, r14
xorps xmm7, xmm7
lea rbx, [rsp + 0x80]
lea r12, [rsp + 0xc0]
test byte [rdi + 0x18], 0x20
jne 0x1400495c6
mov r13, qword [rdi]
mov rbp, qword [rdi + 8]
movaps xmmword [rsp + 0xc0], xmm7
mov qword [rsp + 0xd0], 0
sub rbp, r13
je 0x14004954a
js 0x14004a64f
mov rcx, rbp
call fcn.140184834
mov qword [rsp + 0xc0], rax
lea r14, [rax + rbp]
mov qword [rsp + 0xd0], r14
mov rcx, rax
mov rdx, r13
mov r8, rbp
call fcn.140188f50
mov qword [rsp + 0xc8], r14
mov rax, qword [rsp + 0x88]
cmp rax, qword [rsp + 0x90]
jae 0x1400495a1
test rax, rax
je 0x14004a669
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0xc0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xc8]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xd0]
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rsp + 0x88], rax
jmp 0x1400495c6
mov rcx, rbx
mov rdx, r12
call fcn.140048e50
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x1400495c6
mov qword [rsp + 0xc8], rcx
call fcn.14018482c
add rdi, 0x20
cmp rdi, rsi
jne 0x1400494e8
mov rdi, qword [rsp + 0x120]
mov r14, r15
test rdi, rdi
je 0x140049626
mov rax, qword [rsp + 0x128]
mov rcx, rdi
cmp rax, rdi
je 0x140049619
lea rsi, [rax - 0x20]
mov rcx, qword [rax - 0x20]
test rcx, rcx
je 0x140049609
mov qword [rax - 0x18], rcx
call fcn.14018482c
mov rax, rsi
cmp rsi, rdi
jne 0x1400495f3
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x128], rdi
call fcn.14018482c
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0x89], 0
jne 0x140049a3c
mov rax, qword [rsp + 0xa0]
cmp rax, qword [rsp + 0xa8]
jne 0x140049675
mov rax, qword [rsp + 0x80]
cmp rax, qword [rsp + 0x88]
jne 0x140049675
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0x6d], 0
je 0x14004a3dc
xorps xmm0, xmm0
lea rax, [rsp + 0xc0]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x38]
movzx r8d, byte [rcx + 0x6d]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0xf01ff
lea r15, [rsp + 0x120]
lea r9, [rsp + 0xa0]
mov rcx, r14
mov rdx, r15
call fcn.140055700
cmp byte [r15], 0
je 0x14004a67b
lea rdx, [rsp + 0x128]
cmp byte [rsp + 0x100], 0
jne 0x1400496fd
lea rcx, [rsp + 0x108]
call fcn.1400455d0
mov byte [rsp + 0x100], 1
jmp 0x14004970a
lea rcx, [rsp + 0x108]
call fcn.1400419e0
cmp byte [rsp + 0x120], 0
je 0x140049729
lea r14, [rsp + 0x128]
mov rcx, r14
call fcn.140013df0
mov byte [r14 - 8], 0
mov rsi, qword [rsp + 0xc0]
test rsi, rsi
je 0x140049780
mov rax, qword [rsp + 0xc8]
mov rcx, rsi
cmp rax, rsi
je 0x140049773
lea rdi, [rax - 0x18]
cmp byte [rax - 1], 0
jns 0x140049759
mov rcx, qword [rax - 0x18]
call fcn.14018482c
mov rax, rdi
cmp rdi, rsi
jne 0x140049746
mov rcx, qword [rsp + 0xc0]
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xc8], rsi
call fcn.14018482c
cmp byte [rsp + 0x100], 0
je 0x14004a4a8
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0x6d], 0
je 0x1400497a3
cmp byte [rax + 0x6e], 0
jne 0x14004a42f
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xf0], rdi
movaps xmmword [rsp + 0xe0], xmm6
lea r14, [rsp + 0x120]
mov qword [r14 + 0x20], rdi
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
mov rdx, qword [rsp + 0x108]
mov rcx, r14
mov r8d, 6
call fcn.140163c40
cmp byte [r14], 0
je 0x140049959
mov r14, qword [rsp + 0x128]
mov r15, qword [r14]
test r15, r15
je 0x14004a6a3
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
je 0x14004a6ab
movzx r13d, word [r15 + 2]
mov rcx, r13
call fcn.140184cf8
mov r12, rax
mov rcx, rax
mov rdx, r15
mov r8, r13
call fcn.140188f50
mov byte [rsp + 0xe0], 1
mov qword [rsp + 0xe8], r12
mov al, 1
test r14, r14
je 0x140049868
mov rcx, r14
call fcn.14018482c
mov al, byte [rsp + 0xe0]
test al, al
je 0x140049959
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0x6c], 0
je 0x140049966
mov qword [rsp + 0x140], rdi
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
cmp byte [rsp + 0x100], 0
je 0x14004a4a6
lea r14, [rsp + 0x120]
lea rcx, [rsp + 0x108]
mov rdx, r14
call fcn.140052280
cmp byte [r14], 0
je 0x140049abf
mov r14, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xd0]
cmp r14, rax
jae 0x140049b09
test r14, r14
je 0x14004a7b3
mov r15, qword [rsp + 0x128]
mov r12, qword [rsp + 0x130]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
sub r12, r15
je 0x140049938
js 0x14004a772
mov rcx, r12
call fcn.140184834
mov qword [r14], rax
lea rsi, [rax + r12]
mov qword [r14 + 0x10], rsi
mov rcx, rax
mov rdx, r15
mov r8, r12
call fcn.140188f50
mov qword [r14 + 8], rsi
mov qword [r14 + 0x18], 3
mov dword [r14 + 0x20], 0
add r14, 0x28
mov qword [rsp + 0xc8], r14
jmp 0x140049c4b
mov rax, qword [rsp + 0x40]
mov byte [rax], 0
jmp 0x14004a383
xor eax, eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x7c], 0x10000000
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x74], 0xa
mov r14, qword [rsp + 0xc8]
cmp r14, qword [rsp + 0xd0]
jae 0x14004a61d
test r14, r14
je 0x14004a7b0
lea r12, [rsp + 0x120]
mov rcx, r12
mov edx, 0xa
call fcn.140050560
mov r15, qword [r12]
mov r12, qword [r12 + 8]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
sub r12, r15
je 0x1400499fc
js 0x14004a772
mov rcx, r12
call fcn.140184834
mov qword [r14], rax
lea rsi, [rax + r12]
mov qword [r14 + 0x10], rsi
mov rcx, rax
mov rdx, r15
mov r8, r12
call fcn.140188f50
mov qword [r14 + 8], rsi
movabs rax, 0x1000000000000000
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x20], 0
test r15, r15
je 0x140049a1f
mov rcx, r15
call fcn.14018482c
add r14, 0x28
mov qword [rsp + 0xc8], r14
cmp qword [rsp + 0xc0], r14
jne 0x140049c7d
int3
lea rbx, [rsp + 0x120]
mov qword [rbx + 0x20], rdi
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov rcx, r14
mov rdx, rbx
call fcn.140052280
cmp byte [rbx], 0
je 0x140049642
lea rdx, [rsp + 0x128]
mov rax, qword [rsp + 0x88]
cmp rax, qword [rsp + 0x90]
jb 0x14004a5cd
lea rcx, [rsp + 0x80]
call fcn.140048e50
cmp byte [rsp + 0x120], 0
je 0x140049642
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x140049642
mov qword [rsp + 0x130], rcx
call fcn.14018482c
jmp 0x140049642
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x490
je 0x140049c59
mov rax, qword [rsp + 0x40]
mov byte [rax], 0
cmp byte [rsp + 0x120], 0
je 0x14004a35b
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x14004a35b
mov qword [rsp + 0x130], rcx
call fcn.14018482c
jmp 0x14004a35b
mov rsi, qword [rsp + 0xc0]
mov rbx, r14
sub rbx, rsi
sar rbx, 3
movabs rcx, 0xcccccccccccccccd
imul rbx, rcx
lea rdi, [rbx + 1]
movabs rdx, 0x666666666666666
cmp rdi, rdx
ja 0x14004a7b6
sub rax, rsi
sar rax, 3
imul rax, rcx
lea rcx, [rax + rax]
cmp rcx, rdi
cmova rdi, rcx
movabs rcx, 0x333333333333333
cmp rax, rcx
cmovae rdi, rdx
test rdi, rdi
je 0x14004a7b9
cmp rdi, rdx
ja 0x14004a7c1
lea rax, [rdi*8]
lea rcx, [rax + rax*4]
call fcn.140184834
mov r12, rax
lea rbx, [rbx + rbx*4]
lea r15, [rbx*8]
add r15, r12
je 0x14004a7c4
mov r13, qword [rsp + 0x128]
mov rbp, qword [rsp + 0x130]
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], 0
sub rbp, r13
je 0x140049bfb
mov qword [rsp + 0x48], rsi
js 0x14004a7c7
mov rcx, rbp
call fcn.140184834
mov qword [r15], rax
lea rsi, [rax + rbp]
mov qword [r15 + 0x10], rsi
mov rcx, rax
mov rdx, r13
mov r8, rbp
call fcn.140188f50
mov qword [r15 + 8], rsi
mov rsi, qword [rsp + 0x48]
lea rax, [rdi + rdi*4]
lea rax, [r12 + rax*8]
mov qword [r12 + rbx*8 + 0x18], 3
mov dword [r12 + rbx*8 + 0x20], 0
lea rcx, [r15 + 0x28]
cmp r14, rsi
jne 0x14004a7cf
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rax
test r14, r14
jne 0x14004a873
mov r14, qword [rsp + 0xc8]
cmp qword [rsp + 0xc0], r14
je 0x14004a7ad
cmp byte [rsp + 0x120], 0
je 0x140049c7d
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x140049c7d
mov qword [rsp + 0x130], rcx
call fcn.14018482c
mov rax, qword [rsp + 0x38]
mov rsi, qword [rax + 0x30]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x48], rax
cmp rsi, rax
je 0x140049f6c
xorps xmm6, xmm6
mov ebx, dword [rsi + 0x18]
mov ebp, dword [rsi + 0x1c]
mov r13d, dword [rsi + 0x20]
mov r14, qword [rsi]
mov r12, qword [rsi + 8]
movaps xmmword [rsp + 0x120], xmm6
mov qword [rsp + 0x130], 0
sub r12, r14
je 0x140049f5b
js 0x14004a65c
mov rcx, r12
call fcn.140184834
mov r15, rax
mov qword [rsp + 0x120], rax
lea rdi, [rax + r12]
mov qword [rsp + 0x130], rdi
mov rcx, rax
mov rdx, r14
mov r8, r12
call fcn.140188f50
mov qword [rsp + 0x128], rdi
mov dword [rsp + 0x138], ebx
mov dword [rsp + 0x13c], ebp
mov dword [rsp + 0x140], r13d
mov rbp, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xd0]
cmp rbp, rax
jae 0x140049d98
test rbp, rbp
je 0x14004a675
mov rax, qword [rsp + 0x120]
mov qword [rbp], rax
mov rax, qword [rsp + 0x128]
mov qword [rbp + 8], rax
mov rax, qword [rsp + 0x130]
mov qword [rbp + 0x10], rax
movaps xmmword [rsp + 0x120], xmm6
mov qword [rsp + 0x130], 0
lea rcx, [rsp + 0x138]
mov eax, dword [rcx + 8]
mov dword [rbp + 0x20], eax
mov rax, qword [rcx]
mov qword [rbp + 0x18], rax
add rbp, 0x28
mov qword [rsp + 0xc8], rbp
xor ecx, ecx
jmp 0x140049f40
mov r12, qword [rsp + 0xc0]
mov r14, rbp
sub r14, r12
sar r14, 3
movabs rcx, 0xcccccccccccccccd
imul r14, rcx
lea rbx, [r14 + 1]
movabs rdx, 0x666666666666666
cmp rbx, rdx
ja 0x14004a672
sub rax, r12
sar rax, 3
imul rax, rcx
lea rcx, [rax + rax]
cmp rcx, rbx
cmova rbx, rcx
movabs rcx, 0x333333333333333
cmp rax, rcx
cmovae rbx, rdx
test rbx, rbx
je 0x140049f65
cmp rbx, rdx
ja 0x14004a66c
lea rax, [rbx*8]
lea rcx, [rax + rax*4]
call fcn.140184834
lea r8, [r14 + r14*4]
lea rdx, [r8*8]
add rdx, rax
je 0x14004a66f
lea rcx, [rbx + rbx*4]
lea rcx, [rax + rcx*8]
mov qword [rdx], r15
mov qword [rdx + 8], rdi
mov qword [rdx + 0x10], rdi
movaps xmmword [rsp + 0x120], xmm6
mov qword [rsp + 0x130], 0
lea r10, [rsp + 0x138]
mov r9d, dword [r10 + 8]
mov dword [rax + r8*8 + 0x20], r9d
mov r9, qword [r10]
mov qword [rax + r8*8 + 0x18], r9
lea rax, [rdx + 0x28]
cmp rbp, r12
je 0x140049f13
xor r9d, r9d
movups xmmword [rdx - 0x28], xmm6
mov qword [rdx - 0x18], r9
mov r8, qword [rbp - 0x28]
mov qword [rdx - 0x28], r8
mov r8, qword [rbp - 0x20]
mov qword [rdx - 0x20], r8
mov r8, qword [rbp - 0x18]
mov qword [rdx - 0x18], r8
mov qword [rbp - 0x18], r9
movups xmmword [rbp - 0x28], xmm6
mov r8d, dword [rbp - 8]
mov dword [rdx - 8], r8d
mov r8, qword [rbp - 0x10]
mov qword [rdx - 0x10], r8
add rdx, 0xffffffffffffffd8
lea r8, [rbp - 0x28]
mov rbp, r8
cmp r8, r12
jne 0x140049e7e
mov rbp, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xc8]
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rcx
cmp r8, rbp
je 0x140049f2b
lea rdi, [r8 - 0x28]
mov rcx, qword [r8 - 0x28]
test rcx, rcx
je 0x140049f09
mov qword [r8 - 0x20], rcx
call fcn.14018482c
mov r8, rdi
cmp rdi, rbp
jne 0x140049ef3
jmp 0x140049f2b
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rcx
test rbp, rbp
je 0x140049f38
mov rcx, rbp
call fcn.14018482c
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x140049f4a
call fcn.14018482c
add rsi, 0x28
cmp rsi, qword [rsp + 0x48]
jne 0x140049c9b
jmp 0x140049f6c
xor edi, edi
xor r15d, r15d
jmp 0x140049d04
xor eax, eax
jmp 0x140049e19
cmp byte [rsp + 0x100], 0
je 0x14004a4a6
lea r15, [rsp + 0x120]
lea rcx, [rsp + 0x108]
mov rdx, r15
call fcn.140033f00
mov r14, qword [r15]
mov r13, qword [r15 + 8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
sub r13, r14
je 0x14004a77a
js 0x14004a785
mov rcx, r13
call fcn.140184834
mov r15, rax
mov qword [rsp + 0x50], rax
lea r12, [rax + r13]
mov qword [rsp + 0x60], r12
mov rcx, rax
mov rdx, r14
mov r8, r13
call fcn.140188f50
mov qword [rsp + 0x58], r12
test r14, r14
je 0x140049ffa
mov qword [rsp + 0x128], r14
mov rcx, r14
call fcn.14018482c
mov r14, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xd0]
cmp r14, rax
jae 0x14004a07e
test r14, r14
je 0x14004a792
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
sub r12, r15
je 0x14004a057
js 0x14004a772
mov rcx, r12
call fcn.140184834
mov qword [r14], rax
lea rsi, [rax + r12]
mov qword [r14 + 0x10], rsi
mov rcx, rax
mov rdx, r15
mov r8, r12
call fcn.140188f50
mov qword [r14 + 8], rsi
movabs rax, 0x1000000000000000
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x20], 0
add r14, 0x28
mov qword [rsp + 0xc8], r14
jmp 0x14004a25d
mov rsi, qword [rsp + 0xc0]
mov rbx, r14
sub rbx, rsi
sar rbx, 3
movabs rcx, 0xcccccccccccccccd
imul rbx, rcx
lea rdi, [rbx + 1]
movabs rdx, 0x666666666666666
cmp rdi, rdx
ja 0x14004a795
sub rax, rsi
sar rax, 3
imul rax, rcx
lea rcx, [rax + rax]
cmp rcx, rdi
cmova rdi, rcx
movabs rcx, 0x333333333333333
cmp rax, rcx
cmovae rdi, rdx
test rdi, rdi
je 0x14004a798
cmp rdi, rdx
ja 0x14004a79f
lea rax, [rdi*8]
lea rcx, [rax + rax*4]
call fcn.140184834
mov rbp, rax
lea rbx, [rbx + rbx*4]
lea r13, [rbx*8]
add r13, rbp
je 0x14004a7a2
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
sub r12, r15
je 0x14004a162
mov qword [rsp + 0x48], rsi
js 0x14004a7a5
mov rcx, r12
call fcn.140184834
mov qword [r13], rax
lea rsi, [rax + r12]
mov qword [r13 + 0x10], rsi
mov rcx, rax
mov rdx, r15
mov r8, r12
call fcn.140188f50
mov qword [r13 + 8], rsi
mov rsi, qword [rsp + 0x48]
lea rax, [rdi + rdi*4]
lea rax, [rax*8]
add rax, rbp
movabs rcx, 0x1000000000000000
mov qword [rbp + rbx*8 + 0x18], rcx
mov dword [rbp + rbx*8 + 0x20], 0
lea rcx, [r13 + 0x28]
cmp r14, rsi
jne 0x14004a1ae
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rax
jmp 0x14004a248
xorps xmm0, xmm0
xor edx, edx
movups xmmword [r13 - 0x28], xmm0
mov qword [r13 - 0x18], rdx
mov r8, qword [r14 - 0x28]
mov qword [r13 - 0x28], r8
mov r8, qword [r14 - 0x20]
mov qword [r13 - 0x20], r8
mov r8, qword [r14 - 0x18]
mov qword [r13 - 0x18], r8
mov qword [r14 - 0x18], rdx
movups xmmword [r14 - 0x28], xmm0
mov r8d, dword [r14 - 8]
mov dword [r13 - 8], r8d
mov r8, qword [r14 - 0x10]
mov qword [r13 - 0x10], r8
add r13, 0xffffffffffffffd8
lea r8, [r14 - 0x28]
mov r14, r8
cmp r8, rsi
jne 0x14004a1b3
mov r14, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rax
cmp rdx, r14
je 0x14004a248
lea rsi, [rdx - 0x28]
mov rcx, qword [rdx - 0x28]
test rcx, rcx
je 0x14004a240
mov qword [rdx - 0x20], rcx
call fcn.14018482c
mov rdx, rsi
cmp rsi, r14
jne 0x14004a22a
test r14, r14
je 0x14004a255
mov rcx, r14
call fcn.14018482c
mov r14, qword [rsp + 0xc8]
cmp qword [rsp + 0xc0], r14
je 0x14004a78f
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14004a27a
call fcn.14018482c
cmp byte [rsp + 0xe0], 0
je 0x14004a4a6
lea rcx, [rsp + 0xe8]
lea rdx, [rsp + 0xc0]
call fcn.14003cdb0
test al, al
je 0x14004a353
cmp byte [rsp + 0x100], 0
je 0x14004a4a6
cmp byte [rsp + 0xe0], 0
je 0x14004a4a6
mov rax, qword [rsp + 0xe8]
lea r8, [rsp + 0x120]
mov qword [r8], rax
mov rcx, qword [rsp + 0x108]
mov edx, 6
mov r9d, 8
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x14004a353
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0x60], 0
je 0x14004a323
cmp byte [rsp + 0x100], 0
je 0x14004a4a6
mov rax, qword [rsp + 0x38]
mov edx, dword [rax + 0x64]
lea rcx, [rsp + 0x108]
call fcn.14003fbc0
test al, al
je 0x14004a353
xorps xmm0, xmm0
mov rax, qword [rsp + 0x40]
movups xmmword [rax], xmm0
cmp byte [rsp + 0x100], 0
je 0x14004a35b
mov rsi, qword [rsp + 0x40]
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x108]
call fcn.1400455d0
mov byte [rsi], 1
jmp 0x14004a35b
mov rax, qword [rsp + 0x40]
mov byte [rax], 0
cmp byte [rsp + 0xe0], 0
je 0x14004a383
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
test rcx, rcx
je 0x14004a383
call fcn.1401849a0
mov rsi, qword [rsp + 0xc0]
test rsi, rsi
je 0x14004a4b0
mov rax, qword [rsp + 0xc8]
mov rcx, rsi
cmp rax, rsi
je 0x14004a3ca
lea rdi, [rax - 0x28]
mov rcx, qword [rax - 0x28]
test rcx, rcx
je 0x14004a3ba
mov qword [rax - 0x20], rcx
call fcn.14018482c
mov rax, rdi
cmp rdi, rsi
jne 0x14004a3a4
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rsi
call fcn.14018482c
jmp 0x14004a4b0
lea r15, [rsp + 0x120]
mov rcx, r14
mov rdx, r15
mov r8d, 0xf01ff
call fcn.14020b5f0
cmp byte [r15], 0
je 0x14004a880
lea rdx, [rsp + 0x128]
cmp byte [rsp + 0x100], 0
jne 0x14004a5a0
lea rcx, [rsp + 0x108]
call fcn.1400455d0
mov byte [rsp + 0x100], 1
jmp 0x14004a5ad
lea rdx, str.SeChangeNotifyPrivilege
lea r14, [rsp + 0x120]
mov rcx, r14
call fcn.1401c4820
lea rcx, [rsp + 0x108]
mov rdx, r14
call fcn.1400756f0
mov ebp, eax
cmp byte [r14 + 0x17], 0
jns 0x14004a46c
mov rcx, qword [rsp + 0x120]
call fcn.14018482c
test bpl, bpl
je 0x14004a4a8
cmp byte [rsp + 0x100], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xf0], rdi
movaps xmmword [rsp + 0xe0], xmm6
jne 0x1400497ca
ud2
mov rax, qword [rsp + 0x40]
mov byte [rax], 0
mov rsi, qword [rsp + 0x80]
test rsi, rsi
je 0x14004a500
mov rax, qword [rsp + 0x88]
mov rcx, rsi
cmp rax, rsi
je 0x14004a4f3
lea rdi, [rax - 0x18]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14004a4e3
mov qword [rax - 0x10], rcx
call fcn.14018482c
mov rax, rdi
cmp rdi, rsi
jne 0x14004a4cd
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rsi
call fcn.14018482c
mov rsi, qword [rsp + 0xa0]
test rsi, rsi
je 0x14004a550
mov rax, qword [rsp + 0xa8]
mov rcx, rsi
cmp rax, rsi
je 0x14004a543
lea rdi, [rax - 0x18]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14004a533
mov qword [rax - 0x10], rcx
call fcn.14018482c
mov rax, rdi
cmp rdi, rsi
jne 0x14004a51d
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rsi
call fcn.14018482c
cmp byte [rsp + 0x100], 0
je 0x14004a567
lea rcx, [rsp + 0x108]
call fcn.140013df0
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.1401874c0
mov rax, qword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x150]
movaps xmm7, xmmword [rsp + 0x160]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x108]
call fcn.1400419e0
cmp byte [rsp + 0x120], 0
je 0x140049780
lea rcx, [rsp + 0x128]
call fcn.140013df0
jmp 0x140049780
test rax, rax
je 0x14004a8a8
xorps xmm0, xmm0
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov r8, qword [rsp + 0x128]
mov qword [rax], r8
mov r8, qword [rsp + 0x130]
mov qword [rax + 8], r8
mov r8, qword [rsp + 0x138]
mov qword [rax + 0x10], r8
mov qword [rdx + 0x10], rcx
movups xmmword [rdx], xmm0
add rax, 0x18
mov qword [rsp + 0x88], rax
jmp 0x140049a8e
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0xc0]
lea rdx, [rsp + 0x74]
lea r8, [rsp + 0x78]
lea r9, [rsp + 0x7c]
mov rcx, r14
call fcn.140232700
mov r14, qword [r14 + 8]
jmp 0x140049a2b
lea rcx, [rsp + 0xc0]
call fcn.1401c7c60
lea rcx, [rsp + 0x120]
call fcn.1401c7c60
int3
int3
int3
int3
int3
int3
cmp byte [rsp + 0x100], 0
je 0x140049729
lea rcx, [rsp + 0x108]
call fcn.140013df0
mov byte [rsp + 0x100], 0
jmp 0x14004970a
xor r12d, r12d
jmp 0x140049842
mov ecx, 0x538
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsp + 0xe0], 0
xor eax, eax
jmp 0x140049854
test rax, rax
je 0x14004a8ab
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0xc0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xc8]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xd0]
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rsp + 0x88], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov r14, r15
jmp 0x140049497
test rax, rax
je 0x14004a8ae
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0xc0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xc8]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xd0]
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rsp + 0xa8], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
jmp 0x1400491c9
mov rcx, r14
call fcn.1401c7c60
xor r15d, r15d
xor r12d, r12d
jmp 0x140049fe5
lea rcx, [rsp + 0x50]
call fcn.1401c7c60
int3
int3
int3
xor ebp, ebp
jmp 0x14004a102
int3
int3
mov rcx, r13
call fcn.1401c7c60
int3
int3
int3
int3
xor r12d, r12d
jmp 0x140049b8d
int3
int3
mov rcx, r15
call fcn.1401c7c60
xorps xmm0, xmm0
xor edx, edx
movups xmmword [r15 - 0x28], xmm0
mov qword [r15 - 0x18], rdx
mov r8, qword [r14 - 0x28]
mov qword [r15 - 0x28], r8
mov r8, qword [r14 - 0x20]
mov qword [r15 - 0x20], r8
mov r8, qword [r14 - 0x18]
mov qword [r15 - 0x18], r8
mov qword [r14 - 0x18], rdx
movups xmmword [r14 - 0x28], xmm0
mov r8d, dword [r14 - 8]
mov dword [r15 - 8], r8d
mov r8, qword [r14 - 0x10]
mov qword [r15 - 0x10], r8
add r15, 0xffffffffffffffd8
lea r8, [r14 - 0x28]
mov r14, r8
cmp r8, rsi
jne 0x14004a7d4
mov r14, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rax
cmp rdx, r14
je 0x140049c3a
lea rsi, [rdx - 0x28]
mov rcx, qword [rdx - 0x28]
test rcx, rcx
je 0x14004a865
mov qword [rdx - 0x20], rcx
call fcn.14018482c
mov rdx, rsi
cmp rsi, r14
je 0x140049c3a
jmp 0x14004a84f
mov rcx, r14
call fcn.14018482c
jmp 0x140049c43
cmp byte [rsp + 0x100], 0
je 0x140049780
lea rcx, [rsp + 0x108]
call fcn.140013df0
mov byte [rsp + 0x100], 0
jmp 0x14004a5ad
int3
int3
int3