Function at 0x7ff74b37800
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
lea rbp, [rsp + 0x40]
mov qword [rbp + 0xa8], rbx
mov rax, qword [0x7ff74b58340]
xor rax, rbp
mov qword [rbp + 0x40], rax
xor esi, esi
mov r12, r8
mov r15, rdx
mov r14, rcx
cmp r8, rsi
jne 0x7ff74b37847
mov eax, 0x80004003
jmp 0x7ff74b37a37
xor eax, eax
mov dword [r8], esi
mov edi, esi
mov byte [rbp + 0x10], sil
mov dword [rbp + 8], 0xc
mov word [rbp + 0x20], si
mov qword [rbp + 0x11], rax
mov word [rbp + 0x19], ax
mov byte [rbp + 0x1b], al
mov qword [rbp + 0x22], rax
mov qword [rbp + 0x2a], rax
mov qword [rbp + 0x32], rax
mov dword [rbp + 0x3a], eax
mov word [rbp + 0x3e], ax
mov dword [rbp + 4], 0x10
mov rbx, rsi
cmp rcx, rsi
je 0x7ff74b3796a
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rbx + rax + 2]
mov rbx, rsi
movsxd r13, ecx
lea rsi, [r13 + r13]
test rsi, rsi
je 0x7ff74b37912
cmp rsi, qword [0x7ff74b585e0]
ja 0x7ff74b37912
mov rax, qword [0x7ff74b585e8]
lea rdi, [r13 + r13 + 8]
lea rcx, [rdi + rax]
cmp rcx, rsi
jb 0x7ff74b37912
call fcn.7ff74ae6340
test eax, eax
je 0x7ff74b37912
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x7ff74b378f0
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.7ff74ae3a20
sub rsp, rax
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x7ff74b37912
mov dword [rbx], 0x6b637453
add rbx, 8
jne 0x7ff74b37949
lea rcx, [r13 + r13 + 8]
cmp rcx, rsi
jb 0x7ff74b37938
call qword [0x7ff74b585f0]
xor esi, esi
mov rbx, rax
cmp rax, rsi
je 0x7ff74b3793f
mov dword [rax], 0x70616548
add rbx, 8
jmp 0x7ff74b3793a
xor esi, esi
cmp rbx, rsi
jne 0x7ff74b3794b
mov eax, 0x8007000e
jmp 0x7ff74b37a37
xor esi, esi
lea r8, str._s_s
mov r9, r14
mov rdx, r13
mov rcx, rbx
mov qword [rsp + 0x20], r15
call fcn.7ff74b043e4
mov r15, rbx
mov edi, eax
lea rax, [rbp]
lea r9, [rbp + 8]
lea r8, [rbp + 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 4]
mov rdx, r15
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [0x7ff74b58090]
cmp eax, esi
jne 0x7ff74b379e6
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
je 0x7ff74b379df
cmp dword [0x7ff74b582c8], esi
je 0x7ff74b379df
mov rcx, qword [0x7ff74b58350]
lea r8, [0x7ff74b58350]
cmp rcx, r8
je 0x7ff74b379df
test byte [rcx + 0x1c], 2
je 0x7ff74b379df
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b517b0]
mov edx, 0xc
mov r9d, eax
call fcn.7ff74b25ec4
mov edi, 1
jmp 0x7ff74b37a1e
cmp dword [rbp], 5
jne 0x7ff74b37a1e
lea rdx, [0x7ff74b517d0]
lea rcx, [rbp + 0x10]
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_EqualSid]
cmp eax, esi
jne 0x7ff74b37a16
lea rdx, [0x7ff74b517e0]
lea rcx, [rbp + 0x10]
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_EqualSid]
cmp eax, esi
je 0x7ff74b37a1e
mov dword [r12], 1
cmp rbx, rsi
je 0x7ff74b37a35
lea rcx, [rbx - 8]
cmp dword [rcx], 0x70616548
jne 0x7ff74b37a35
call qword [0x7ff74b585f8]
mov eax, edi
mov rcx, qword [rbp + 0x40]
xor rcx, rbp
call fcn.7ff74ae3090
mov rbx, qword [rbp + 0xa8]
lea rsp, [rbp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret