Function at 0x1400844f0
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x198], rax
mov qword [rsp + 0xe0], rdx
xor edi, edi
mov dword [rsp + 0x78], edi
mov byte [rdx], dil
xorps xmm0, xmm0
movups xmmword [r11 - 0x50], xmm0
movups xmmword [r11 - 0x40], xmm0
lea rsi, vtable.ATL::CAccessToken.0
mov qword [r11 - 0x50], rsi
movdqu xmmword [r11 - 0x48], xmm0
mov qword [r11 - 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x170]
lea edx, [rdi + 8]
lea r8d, [rdi + 1]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x140084c4d
mov rax, qword [rsp + 0x178]
lea rcx, [rsp + 0x178]
mov rax, qword [rax + 8]
call qword [case.0x140047d56.0]
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xd0], xmm0
lea r14, vtable.ATL::CTokenGroups.0
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x98], 0x11
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0xbc], 0xa
movdqa xmmword [rsp + 0xc0], xmm0
movss xmm1, dword [0x14026e394]
movss dword [rsp + 0x9c], xmm1
movss xmm0, dword [0x14026e390]
movss dword [rsp + 0xa0], xmm0
movss xmm1, dword [0x14026e398]
movss dword [rsp + 0xa4], xmm1
mov qword [rsp + 0xa8], 0x26
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xd0], rdi
mov byte [rsp + 0xd8], 1
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x178]
call fcn.140082c60
test al, al
jne 0x140084713
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rsp + 0x80], r14
mov rcx, qword [rsp + 0xd0]
call fcn.1400e5990
lea rcx, [rsp + 0x88]
call fcn.140081e50
nop
mov qword [rsp + 0x178], rsi
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
test rdx, rdx
je 0x1400846e7
test rcx, rcx
je 0x1400846df
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x180]
mov qword [rsp + 0x188], rdi
test rcx, rcx
je 0x1400846fa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x180], rdi
mov edx, 8
mov rcx, qword [rsp + 0x190]
call fcn.1401544b8
mov eax, ebx
jmp 0x140084cbb
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x48], r14d
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
xor r15d, r15d
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x68], r15d
xor ebx, ebx
mov qword [rsp + 0x38], rbx
xor r12d, r12d
mov qword [rsp + 0x40], r12
xor esi, esi
mov qword [rsp + 0x58], rsi
xor r13d, r13d
mov qword [rsp + 0x60], r13
cmp qword [rsp + 0x90], rbx
je 0x140084799
xor ecx, ecx
cmp dword [rsp + 0x98], ecx
jbe 0x140084799
nop word [rax + rax]
mov rax, qword [rsp + 0x88]
cmp qword [rax + rcx*8], rbx
jne 0x1400847bf
inc ecx
cmp ecx, dword [rsp + 0x98]
jb 0x140084780
xor edi, edi
nop dword [rax + rax]
test rdi, rdi
je 0x1400849ea
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi + 0x80]
test rax, rax
je 0x1400847cd
mov rdi, rax
jmp 0x1400847fa
mov rax, qword [rsp + 0x88]
mov rdi, qword [rax + rcx*8]
jmp 0x1400847a0
xor edx, edx
mov eax, dword [rdi + 0x88]
div dword [rsp + 0x98]
inc edx
xor edi, edi
cmp edx, dword [rsp + 0x98]
jae 0x1400847fa
mov rax, qword [rsp + 0x88]
mov rdi, qword [rax + rdx*8]
test rdi, rdi
je 0x1400847dc
cmp rbx, r12
jb 0x1400848d3
lea rdx, [rbx + 1]
cmp rdx, r12
jbe 0x1400848d3
lfence
test r14, r14
jne 0x14008484b
movsxd rax, dword [rsp + 0x48]
mov r12, rdx
cmp rax, rdx
cmova r12, rax
lea edx, [r14 + 0x78]
mov rcx, r12
call fcn.1400e5980
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140084ce8
mov rbx, qword [rsp + 0x38]
jmp 0x1400848bf
movsxd rcx, dword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
test rcx, rcx
jne 0x14008486d
mov rcx, r8
shr rcx, 1
mov rax, rdx
sub rax, r8
cmp rax, rcx
cmova rcx, rax
lea rax, [r8 + rcx]
mov r12, rdx
cmp rdx, rax
cmovb r12, rax
mov edx, 0x78
mov rcx, r12
call fcn.1400e5980
mov r14, rax
test rax, rax
je 0x140084ce8
mov rbx, qword [rsp + 0x38]
imul r8, rbx, 0x78
mov rsi, qword [rsp + 0x30]
test r8, r8
je 0x1400848b2
mov rdx, rsi
mov rcx, r14
call fcn.140145e60
mov rcx, rsi
call fcn.1400e5990
mov qword [rsp + 0x30], r14
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
imul rcx, rbx, 0x78
add rcx, r14
mov rdx, qword [rsp + 0x70]
call fcn.140081cc0
inc rbx
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x78]
mov dword [rsp + 0x70], eax
cmp rsi, r13
jb 0x1400849d9
lea rdx, [rsi + 1]
cmp rdx, r13
jbe 0x1400849d9
lfence
test r15, r15
jne 0x140084949
movsxd rax, dword [rsp + 0x68]
mov r13, rdx
cmp rax, rdx
cmova r13, rax
lea edx, [r15 + 4]
mov rcx, r13
call fcn.1400e5980
mov r15, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140084cf2
mov rsi, qword [rsp + 0x58]
jmp 0x1400849c1
movsxd rcx, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
test rcx, rcx
jne 0x14008496b
mov rcx, r8
shr rcx, 1
mov rax, rdx
sub rax, r8
cmp rax, rcx
cmova rcx, rax
lea rax, [r8 + rcx]
mov r13, rdx
cmp rdx, rax
cmovb r13, rax
mov edx, 4
mov rcx, r13
call fcn.1400e5980
mov r15, rax
test rax, rax
je 0x140084cf2
mov rsi, qword [rsp + 0x58]
lea r8, [rsi*4]
mov rbx, qword [rsp + 0x50]
test r8, r8
je 0x1400849b4
mov rdx, rbx
mov rcx, r15
call fcn.140145e60
mov rcx, rbx
call fcn.1400e5990
mov qword [rsp + 0x50], r15
mov eax, dword [rsp + 0x70]
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x60], r13
mov dword [r15 + rsi*4], eax
inc rsi
mov qword [rsp + 0x58], rsi
jmp 0x1400847a0
xor esi, esi
lea r12, vtable.ATL::CSid.0
mov edi, esi
cmp rdi, rbx
jae 0x140084b6c
mov dword [rsp + 0x20], 0x220
mov r9d, 0x20
lea r8d, [r9 - 0x1e]
lea rdx, [0x14026ddd8]
lea rcx, [rsp + 0xf0]
call fcn.140081af0
or dword [rsp + 0x78], 1
imul rax, rdi, 0x78
lea rbx, [r14 + 8]
add rbx, rax
je 0x140084a85
cmp byte [rax + r14 + 0x4c], 0
je 0x140084a85
lfence
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140084a85
cmp byte [rsp + 0x13c], 0
je 0x140084a85
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140084a85
lfence
lea rdx, [rsp + 0xf8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x140084a87
xor al, al
mov rbx, qword [rsp + 0xe0]
mov byte [rbx], al
mov qword [rsp + 0xf0], r12
mov rdx, qword [rsp + 0x160]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140084ac7
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140047d56.0]
mov rdx, qword [rsp + 0x158]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140084af5
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140047d56.0]
mov rdx, qword [rsp + 0x150]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140084b23
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140047d56.0]
mov rdx, qword [rsp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140084b51
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140047d56.0]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x50]
cmp byte [rbx], 0
mov rbx, qword [rsp + 0x38]
jne 0x140084b6c
inc esi
jmp 0x1400849f3
test r15, r15
je 0x140084b7a
mov rcx, r15
call fcn.1400e5990
nop
test r14, r14
je 0x140084bb4
test rbx, rbx
je 0x140084bab
mov rdi, r14
nop word [rax + rax]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x140047d56.0]
add rdi, 0x78
sub rbx, 1
jne 0x140084b90
mov rcx, r14
call fcn.1400e5990
nop
lea rax, vtable.ATL::CTokenGroups.0
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0xd0]
call fcn.1400e5990
lea rcx, [rsp + 0x88]
call fcn.140081e50
nop
lea rax, vtable.ATL::CAccessToken.0
mov qword [rsp + 0x178], rax
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
test rdx, rdx
je 0x140084c21
test rcx, rcx
je 0x140084c15
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x180]
xor edi, edi
mov qword [rsp + 0x188], rdi
jmp 0x140084c23
xor edi, edi
test rcx, rcx
je 0x140084c36
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x180], rdi
mov edx, 8
mov rcx, qword [rsp + 0x190]
call fcn.1401544b8
nop
xor eax, eax
jmp 0x140084cbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rsp + 0x178], rsi
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
test rdx, rdx
je 0x140084c8d
test rcx, rcx
je 0x140084c85
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x180]
mov qword [rsp + 0x188], rdi
test rcx, rcx
je 0x140084ca0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x180], rdi
mov edx, 8
mov rcx, qword [rsp + 0x190]
call fcn.1401544b8
mov eax, ebx
jmp 0x140084cbb
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140154650
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x8007000e
call fcn.140082560
mov ecx, 0x8007000e
call fcn.140082560
int3