Function at 0x1400758e0
Capabilities:
Compare security identifiers

Disassembly:
sub rsp, 0x98
mov rax, qword [0x1401787a0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov eax, dword [0x14017adac]
test al, 4
jne 0x140075be4
test al, 2
jne 0x140075be4
test al, 1
jne 0x140075be4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CEnvironment::kIsWin9x___return_FALSE__2__LastError_u_n
mov edx, eax
call fcn.1400631f0
mov byte [rsp + 0x78], 0
mov byte [rsp + 0x79], 0
mov byte [rsp + 0x7a], 0
mov byte [rsp + 0x7b], 0
mov byte [rsp + 0x7c], 0
mov byte [rsp + 0x7d], 5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140075994
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CEnvironment::kCheckAdministrators___return_FALSE__2__LastError_u_OpenProcessToken_fail._n
mov edx, eax
call fcn.140062f80
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c6ac0
add rsp, 0x98
ret
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0xa0], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 2]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140075bc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400759f3
lea rcx, str.GetTokenInformation_API_:_LastError_is_different_from_ERROR_INSUFFICIENT_BUFFER.__LastError_:__d__n
mov edx, eax
call fcn.140062f80
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140075b70
mov edx, dword [rsp + 0x60]
lea rcx, str.GetTokenInformation_API_need_buffer_size._:__d_bytes__n
call fcn.140062f80
mov r11d, dword [rsp + 0x60]
test r11d, r11d
jne 0x140075a19
lea rcx, str.Zero_or_under_value_are_specified_to_buffer_size._n
jmp 0x140075bd0
mov rcx, r11
mov qword [rsp + 0xa8], rsi
call fcn.140096bcc
mov rsi, rax
test rax, rax
jne 0x140075a42
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Buffer_allocation_for_GetTokenInformation_API_is_fail._:_LastError__d__n
mov edx, eax
jmp 0x140075a77
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r8, rsi
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140075a8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CEnvironment::kCheckAdministrators___return_FALSE__3__LastError_u_GetTokenInformation_fail._n
mov edx, eax
call fcn.140062f80
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140075b68
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140075af8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.AllocateAndInitializeSid_LastErrorCode_:__d_n
mov edx, eax
call fcn.140062f80
mov rcx, rsi
call fcn.140096bc4
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140075b68
mov qword [rsp + 0x90], rdi
cmp dword [rsi], ebx
jbe 0x140075b2c
lea rdi, [rsi + 8]
nop dword [rax + rax]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140075b90
inc ebx
add rdi, 0x10
cmp ebx, dword [rsi]
jb 0x140075b10
mov rcx, rsi
call fcn.140096bc4
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CEnvironment::kCheckAdministrators___return_FALSE__5__LastError_u_n
mov edx, eax
call fcn.140062f80
xor eax, eax
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c6ac0
add rsp, 0x98
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CEnvironment::kCheckAdministrators___return_TRUE__4__LastError_u_EqualSid_returned_TRUE._n
mov edx, eax
call fcn.140062f80
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rsi
call fcn.140096bc4
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140075b60
lea rcx, str.GetTokenInformation_API_succeeded._But_buffer_size_specified_zero.
call fcn.140062f80
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140075b70
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CEnvironment::kIsWin9x___return_TRUE__1__LastError_u_n
mov edx, eax
call fcn.1400631f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CEnvironment::kCheckAdministrators___return_TRUE__1__LastError_u_detect_9x_OS._n
mov edx, eax
call fcn.1400631f0
mov eax, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c6ac0
add rsp, 0x98
ret