Function at 0x14002ca00
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
xor ebx, ebx
mov r14d, edx
mov qword [rsp + 0x90], rbx
mov ebp, ebx
mov rdi, rcx
call fcn.140033fd0
mov rsi, rax
test rax, rax
jne 0x14002ca42
lea rcx, str.out_of_memory
call fcn.140046c10
jmp 0x14002cd19
mov rcx, rbx
lea rdx, str.sshd
nop dword [rax]
movzx eax, word [rsi + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14002cad8
cmp rcx, 5
jne 0x14002ca50
call fcn.14002b660
test eax, eax
jne 0x14002caaa
mov qword [rsp + 0x98], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x98]
mov edx, 0xf00ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14002ccf7
call fcn.14002cf80
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14002ccf7
lea rdx, str.get_user_token
lea rcx, str._s___unable_to_generate_sshd_virtual_token__ensure_sshd_service_has_TCB_privileges
call fcn.140046b30
jmp 0x14002ccf7
call fcn.14002b660
test eax, eax
jne 0x14002cc00
xor ecx, ecx
call fcn.14002b750
mov rcx, rdi
mov rbx, rax
call fcn.14002b750
mov rbp, rax
test rax, rax
jne 0x14002cb12
call fcn.14002d3e0
test rax, rax
je 0x14002cb12
lea rcx, str._s___i_am_running_as__s__returning_process_token_since_custom_lsa_is_configured
jmp 0x14002cb2d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x14002cbe5
lea rcx, str._s___i_am_running_as__s__returning_process_token
mov r8, rdi
lea rdx, str.get_user_token
call fcn.140046c70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x98]
mov edx, 0xf00ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14002cb7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.get_user_token
lea rcx, str._s___OpenProcessToken_failed_with__d
call fcn.140046b30
jmp 0x14002ccf7
test r14d, r14d
je 0x14002cb97
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x90], rax
jmp 0x14002ccf7
mov rcx, qword [rsp + 0x98]
lea r8, [rsp + 0x90]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x14002cbd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.get_user_token
lea rcx, str._s___DuplicateToken_failed_with__d
call fcn.140046b30
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002ccf7
mov r8, rdi
lea rdx, str.get_user_token
lea rcx, str._s___unable_to_generate_user_token_for__s_as_i_am_not_running_as_system
call fcn.140046c10
jmp 0x14002ccf7
mov rcx, rdi
call fcn.14002b750
mov rbp, rax
test rax, rax
jne 0x14002cc6a
call fcn.14002d3e0
test rax, rax
je 0x14002cc6a
test r14d, r14d
jne 0x14002cc6a
call fcn.14002d3e0
mov r8, rax
lea rdx, [0x1400a98ad]
mov rcx, rdi
call fcn.14002c700
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14002ccf7
call fcn.14002d3e0
mov r9, rax
lea rdx, str.get_user_token
mov r8, rdi
lea rcx, str._s___unable_to_generate_identity_token_for__s_from_custom_lsa_provider:__s
call fcn.140046b30
jmp 0x14002ccf7
mov edx, r14d
mov rcx, rsi
call fcn.14002c360
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14002ccf7
mov r8, rsi
lea rdx, str.get_user_token
lea rcx, str._s___unable_to_generate_token_for_user__ls
call fcn.140046c70
lea rax, [rsp + 0x90]
mov r9d, 8
mov qword [rsp + 0x30], rax
lea r8, str.FakePasswd
lea rdx, str.FakeDomain
mov dword [rsp + 0x20], ebx
lea rcx, str.FakeUser
call fcn.140036180
mov edx, r14d
mov rcx, rsi
call fcn.14002c360
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14002ccf7
mov r8, rsi
lea rdx, str.get_user_token
lea rcx, str._s___unable_to_generate_token_on_2nd_attempt_for_user__ls
call fcn.140046b30
mov rcx, rsi
call fcn.14007a8b4
test rbp, rbp
je 0x14002cd0c
mov rcx, rbp
call fcn.14007a8b4
test rbx, rbx
je 0x14002cd19
mov rcx, rbx
call fcn.14007a8b4
mov rax, qword [rsp + 0x90]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret