Function at 0x140044303
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov byte [rsp + 0x4f], r9b
mov dword [rsp + 0x5c], r8d
mov r15, rdx
mov rbx, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x80], 0
xor eax, eax
mov byte [rsp + 0x88], al
mov dword [rsp + 0x8c], 2
lea rbp, [0x140206c90]
mov qword [rsp + 0x78], rbp
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x9c], xmm0
cmp byte [rcx + 0x17], al
js 0x140044381
mov rcx, rbx
jmp 0x140044389
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400443cf
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0xb8]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov edx, 1
mov r8d, 4
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
je 0x140044440
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rdi, [rsp + 0x90]
mov qword [rdi - 0x18], rbp
mov rcx, rdi
xor edx, edx
mov r8d, 0xffffffff
call fcn.14004a21e
mov rcx, qword [rdi - 0x10]
call case.0x1400f5a1c.0
mov qword [rdi - 0x10], 0
mov rcx, rdi
call fcn.14004b6ee
lea rax, [0x140206cc0]
mov qword [rdi - 0x18], rax
mov rcx, qword [rdi - 0x10]
call case.0x1400f5a1c.0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0xb8]
test rsi, rsi
je 0x140044466
lea r14, [rsp + 0x78]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
mov rcx, r14
mov rdx, rsi
call fcn.14004a526
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0xb8], 0
je 0x1400443cf
mov qword [rsp + 0x68], rbx
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], rcx
cmp rcx, rax
je 0x14004473c
lea rbx, [rsp + 0x78]
lea rsi, [0x140206cf0]
mov rax, qword [rsp + 0x78]
mov rcx, rbx
call qword [rax + 8]
test eax, eax
je 0x140044704
mov rax, qword [rsp + 0x50]
add rax, 8
mov qword [rsp + 0x60], rax
xor r13d, r13d
mov r15, rsi
mov qword [rsp + 0xb8], rsi
mov byte [rsp + 0x104], 0
mov dword [rsp + 0x108], 7
lea rcx, [rsp + 0x110]
call fcn.14004aa34
lea rcx, [rsp + 0x118]
call fcn.14004aa34
lea rcx, [rsp + 0x120]
call fcn.14004aa34
lea rcx, [rsp + 0x128]
call fcn.14004aa34
mov rax, qword [rsp + 0x78]
mov rcx, rbx
mov edx, r13d
call qword [rax + 0x20]
mov r14, rax
add rax, 8
mov rbp, rdi
cmp rax, rdi
je 0x1400445b9
mov eax, dword [r14 + 0x58]
mov dword [rsp + 0x108], eax
lea rdx, [r14 + 0x60]
lea rcx, [rsp + 0x110]
call fcn.14004b2e8
lea rdx, [r14 + 0x68]
lea rcx, [rsp + 0x118]
call fcn.14004b2e8
lea rdx, [r14 + 0x70]
lea rcx, [rsp + 0x120]
call fcn.14004b2e8
mov al, byte [r14 + 0x54]
mov byte [rsp + 0x104], al
test al, al
je 0x1400445b9
mov rbx, r14
add rbx, 0x10
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
lea rdx, [rsp + 0xc0]
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1400447b8
mov ebx, dword [r14 + 0x80]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x18]
cmp byte [rsp + 0x104], 0
je 0x140044640
mov r12d, eax
mov r14b, byte [r14 + 0x84]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140044640
mov rax, qword [rsp + 0x50]
cmp byte [rax + 0x4c], 0
je 0x140044640
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140044640
lea rcx, [rsp + 0xc0]
mov rdx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [rsp + 0x5c]
and ebx, ecx
cmp ebx, ecx
jne 0x140044640
mov cl, byte [rsp + 0x4f]
and r14b, cl
cmp r14b, cl
jne 0x140044640
test r12b, r12b
jne 0x140044640
mov ebx, 1
test eax, eax
jne 0x140044642
xor ebx, ebx
mov rsi, r15
mov qword [rsp + 0xb8], r15
mov rdx, qword [rsp + 0x128]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
dec eax
test eax, eax
jg 0x140044672
add rdx, 0xffffffffffffffe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x120]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
dec eax
test eax, eax
mov rdi, rbp
jg 0x14004469a
add rdx, 0xffffffffffffffe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x118]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
dec eax
test eax, eax
jg 0x1400446bf
add rdx, 0xffffffffffffffe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x110]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
dec eax
test eax, eax
jg 0x1400446e4
add rdx, 0xffffffffffffffe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test ebx, ebx
lea rbx, [rsp + 0x78]
jne 0x140044723
inc r13d
mov rax, qword [rsp + 0x78]
mov rcx, rbx
call qword [rax + 8]
cmp r13d, eax
jb 0x1400444d2
mov rcx, rbx
mov rdx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x5c]
mov r9b, byte [rsp + 0x4f]
call fcn.14004b200
test al, al
je 0x1400447aa
mov rax, qword [rsp + 0x50]
add rax, 0x78
mov qword [rsp + 0x50], rax
cmp rax, qword [rsp + 0x70]
jne 0x1400444ae
mov rsi, qword [rsp + 0x68]
cmp byte [rsi + 0x17], 0
js 0x140044750
lea rbp, [0x140206c90]
jmp 0x140044763
mov rsi, qword [rsi]
test rsi, rsi
lea rbp, [0x140206c90]
je 0x1400443cf
lea rcx, [rsp + 0x78]
call fcn.14004b5c6
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov edx, 1
mov r8d, 4
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete sil
jmp 0x1400443d1
xor esi, esi
lea rbp, [0x140206c90]
jmp 0x1400443d1
call fcn.14004ab9c
mov byte [rsp + 0x104], 0
mov ecx, eax
call fcn.14004a3f6
int3