Function at 0x1000e4074
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x168
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r14b, r9b
mov r15d, r8d
mov rbx, rdx
mov r13, rcx
mov rbp, qword [rsp + 0x1d0]
mov qword [rsp + 0x38], rbp
lea rsi, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000e40fb
test byte [rcx + 0x1c], 1
je 0x1000e40fb
cmp byte [rcx + 0x19], 5
jb 0x1000e40fb
movzx eax, r9b
mov edx, 0x18
mov dword [rsp + 0x20], eax
mov r9d, r8d
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.10003b338
xor r12d, r12d
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0xd0]
call fcn.1000e2ecc
nop
mov dword [rbp], r12d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov edi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000e415b
test byte [rcx + 0x1c], 2
je 0x1000e415b
cmp byte [rcx + 0x19], 4
jb 0x1000e415b
lea edx, [r12 + 0x19]
mov r9d, eax
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rcx, qword [0x100152eb8]
cmp edi, 1
jne 0x1000e4367
mov edi, r12d
mov rdx, qword [rsp + 0x30]
cmp rdx, r12
setne dil
cmp rcx, rsi
je 0x1000e41a8
test byte [rcx + 0x1c], 2
je 0x1000e41a8
cmp byte [rcx + 0x19], 4
jb 0x1000e41a8
mov edx, 0x1a
mov r9d, edi
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x100152eb8]
cmp edi, 1
jne 0x1000e4367
lea rcx, [rsp + 0xd0]
call fcn.1000e2f60
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x50]
call fcn.1000e2ecc
nop
mov esi, r12d
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 8]
cmp eax, r12d
jbe 0x1000e42f5
mov rax, qword [r13]
mov edx, esi
mov rcx, r13
call qword [rax + 0x20]
mov r12, rax
lea rbx, [rax + 8]
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x1000e427b
mov ecx, dword [rbx + 0x50]
mov dword [rsp + 0xa0], ecx
lea rdx, [rbx + 0x58]
lea rcx, [rsp + 0xa8]
call fcn.100035ed8
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0xb0]
call fcn.100035ed8
lea rdx, [rbx + 0x68]
lea rcx, [rsp + 0xb8]
call fcn.100035ed8
mov r11b, byte [rbx + 0x4c]
mov byte [rsp + 0x9c], r11b
test r11b, r11b
je 0x1000e427b
add rbx, 8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov r8, rbx
lea rdx, [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1000e42db
mov ebp, dword [r12 + 0x80]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
mov bl, al
mov r12b, byte [r12 + 0x84]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1000e42c6
test bl, bl
jne 0x1000e42c6
cmp ebp, r15d
jne 0x1000e42c6
mov al, r14b
and al, r12b
cmp al, r14b
je 0x1000e434f
inc esi
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 8]
cmp esi, eax
jae 0x1000e42f0
jmp 0x1000e41ef
call fcn.10004f5fc
mov byte [rsp + 0x9c], 0
mov ecx, eax
call fcn.100036264
int3
mov rbp, qword [rsp + 0x38]
mov r9b, r14b
mov r8d, r15d
lea rdx, [rsp + 0xd0]
mov rcx, r13
call fcn.10003a2fc
movzx edi, al
mov rcx, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rcx, rsi
je 0x1000e4345
test byte [rcx + 0x1c], 2
je 0x1000e4345
cmp byte [rcx + 0x19], 4
jb 0x1000e4345
mov edx, 0x1b
mov r9d, edi
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
cmp edi, 1
jne 0x1000e4356
mov dword [rbp], edi
jmp 0x1000e4356
lea rsi, [0x100152eb8]
lea rcx, [rsp + 0x50]
call fcn.100039f00
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000e4391
test byte [rcx + 0x1c], 1
je 0x1000e4391
cmp byte [rcx + 0x19], 5
jb 0x1000e4391
mov edx, 0x1c
mov r9d, edi
lea r8, [0x10001dc38]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
nop
lea rcx, [rsp + 0xd0]
call fcn.100039f00
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10011b980
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret