Function at 0x101f190
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x01042480]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [0x0100b728]
call fcn.0100fdd0
xor edi, edi
mov byte [rsp + 0x85], 5
mov byte [rsp + 0x80], dil
mov byte [rsp + 0x81], dil
mov byte [rsp + 0x82], dil
mov byte [rsp + 0x83], dil
mov byte [rsp + 0x84], dil
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ebx, [rdi + 8]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp eax, edi
jne 0x101f245
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x101f23e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
jne 0x101f245
xor eax, eax
jmp 0x101f3d4
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
lea rax, [rsp + 0x60]
lea esi, [r9 + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, edi
jne 0x101f23e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x101f23e
mov ebx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rdi
je 0x101f23e
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r8, rbx
mov edx, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, edi
jne 0x101f2d1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x101f23e
lea rax, [rsp + 0x70]
mov ebp, 0x20
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov r9d, 0x220
mov r8d, ebp
mov dl, sil
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, edi
je 0x101f2b8
lea rax, [rsp + 0x78]
lea rcx, [rsp + 0x80]
mov r9d, 0x223
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov r8d, ebp
mov dl, sil
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, edi
jne 0x101f37a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x101f23e
mov esi, edi
cmp dword [rbx], edi
jbe 0x101f3a8
lea rbp, [rbx + 8]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, edi
jne 0x101f3a3
inc esi
add rbp, 0x10
cmp esi, dword [rbx]
jb 0x101f384
jmp 0x101f3a8
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, edi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.01026f20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret