Function at 0x1400011b0
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xd0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor ebx, ebx
mov qword [r11 + 0x10], rsi
lea rax, [rbp + 7]
mov qword [r11 + 0x18], r12
mov qword [rsp + 0x50], rax
mov r12, rcx
mov dword [rsp + 0x48], ebx
lea rcx, [rbp - 1]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov dl, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rbp - 1], 0
mov word [rbp + 3], 0x100
mov dword [rbp - 9], 0
mov word [rbp - 5], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140001231
mov qword [rbp + 7], rbx
lea rax, [rbp + 0xf]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 9]
mov dword [rsp + 0x48], ebx
mov r8d, 0xb
mov dword [rsp + 0x40], ebx
mov dl, 1
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x14000126f
mov qword [rbp + 0xf], rbx
lea rax, [rbp + 0x17]
mov r9d, 0x201
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 9]
mov dword [rsp + 0x48], ebx
mov r8d, 0x20
mov dword [rsp + 0x40], ebx
mov dl, 2
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1400012b0
mov qword [rbp + 0x17], rbx
lea rax, [rbp + 0x1f]
mov r9d, 0x221
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 9]
mov dword [rsp + 0x48], ebx
mov r8d, 0x20
mov dword [rsp + 0x40], ebx
mov dl, 2
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1400012f1
mov qword [rbp + 0x1f], rbx
mov rsi, qword [str.SeServiceLogonRight]
mov qword [rbp - 0x21], rbx
test rsi, rsi
jne 0x14000130a
mov qword [rbp - 0x11], rbx
mov dword [rbp - 0x19], ebx
jmp 0x140001359
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], bl
jne 0x140001311
lea rcx, [rdi*2 + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea rdx, [rdi + 1]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov qword [rbp - 0x11], rax
lea r9, [0x1400035a8]
mov r8, 0xffffffffffffffff
call fcn.140001010
add di, di
mov word [rbp - 0x19], di
add di, 2
mov word [rbp - 0x17], di
mov qword [rsp + 0xc8], r14
lea r9, [rbp - 0x29]
lea r8, [rbp - 0x21]
mov qword [rsp + 0xc0], r15
lea rdx, [rbp - 0x19]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_LsaEnumerateAccountsWithUserRight]
test eax, eax
jne 0x1400013eb
mov r14d, ebx
cmp dword [rbp - 0x29], ebx
jbe 0x1400013e1
nop word [rax + rax]
mov eax, r14d
lea rsi, [rbp + 7]
mov edi, ebx
lea r15, [rax*8]
mov rcx, qword [rbp - 0x21]
mov rdx, qword [rsi]
mov rcx, qword [r15 + rcx]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400013c9
inc edi
add rsi, 8
cmp edi, 4
jb 0x1400013a1
mov eax, dword [0x140005090]
jmp 0x1400013d4
mov eax, 1
mov dword [0x140005090], eax
test eax, eax
jne 0x1400013e1
inc r14d
cmp r14d, dword [rbp - 0x29]
jb 0x140001390
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rsi, qword [str.SeNetworkLogonRight]
mov qword [rbp - 0x21], rbx
test rsi, rsi
jne 0x140001404
mov qword [rbp - 0x11], rbx
mov dword [rbp - 0x19], ebx
jmp 0x140001458
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rsi + rdi], bl
jne 0x140001410
lea rcx, [rdi*2 + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea rdx, [rdi + 1]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov qword [rbp - 0x11], rax
lea r9, [0x1400035a8]
mov r8, 0xffffffffffffffff
call fcn.140001010
add di, di
mov word [rbp - 0x19], di
add di, 2
mov word [rbp - 0x17], di
lea r9, [rbp - 0x29]
mov rcx, r12
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_LsaEnumerateAccountsWithUserRight]
test eax, eax
jne 0x1400014db
mov r14d, ebx
cmp dword [rbp - 0x29], ebx
jbe 0x1400014d1
nop dword [rax]
mov eax, r14d
lea rsi, [rbp + 7]
mov edi, ebx
lea r15, [rax*8]
mov rcx, qword [rbp - 0x21]
mov rdx, qword [rsi]
mov rcx, qword [r15 + rcx]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400014b9
inc edi
add rsi, 8
cmp edi, 4
jb 0x140001491
mov eax, dword [0x1400050a8]
jmp 0x1400014c4
mov eax, 1
mov dword [0x1400050a8], eax
test eax, eax
jne 0x1400014d1
inc r14d
cmp r14d, dword [rbp - 0x29]
jb 0x140001480
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rsi, qword [str.SeInteractiveLogonRight]
mov qword [rbp - 0x21], rbx
test rsi, rsi
jne 0x1400014f4
mov qword [rbp - 0x11], rbx
mov dword [rbp - 0x19], ebx
jmp 0x140001548
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rsi + rdi], bl
jne 0x140001500
lea rcx, [rdi*2 + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea rdx, [rdi + 1]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov qword [rbp - 0x11], rax
lea r9, [0x1400035a8]
mov r8, 0xffffffffffffffff
call fcn.140001010
add di, di
mov word [rbp - 0x19], di
add di, 2
mov word [rbp - 0x17], di
lea r9, [rbp - 0x29]
mov rcx, r12
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_LsaEnumerateAccountsWithUserRight]
mov r12, qword [rsp + 0x100]
test eax, eax
jne 0x1400015cc
mov r14d, ebx
cmp dword [rbp - 0x29], ebx
jbe 0x1400015c2
mov eax, r14d
lea rsi, [rbp + 7]
mov edi, ebx
lea r15, [rax*8]
mov rcx, qword [rbp - 0x21]
mov rdx, qword [rsi]
mov rcx, qword [r15 + rcx]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400015aa
inc edi
add rsi, 8
cmp edi, 4
jb 0x140001582
mov eax, dword [0x1400050c0]
jmp 0x1400015b5
mov eax, 1
mov dword [0x1400050c0], eax
test eax, eax
jne 0x1400015c2
inc r14d
cmp r14d, dword [rbp - 0x29]
jb 0x140001571
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov r15, qword [rsp + 0xc0]
lea rdi, [rbp + 7]
mov r14, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xf8]
nop dword [rax + rax]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
inc ebx
lea rdi, [rdi + 8]
cmp ebx, 4
jb 0x1400015f0
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140001fd0
add rsp, 0xd0
pop rdi
pop rbx
pop rbp
ret