Function at 0x180007650
Capabilities:
Compare security identifiers

Disassembly:
jmp 0x180007650
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor esi, esi
mov rbx, r8
mov r14, rdx
mov qword [rbp - 0x80], rbx
mov rdi, rcx
mov dword [rsp + 0x68], esi
xor edx, edx
mov qword [rsp + 0x58], rsi
lea r8d, [rsi + 0x4c]
mov qword [rsp + 0x50], rsi
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x48], rsi
mov r15d, esi
mov qword [rsp + 0x38], rsi
mov r12d, esi
mov r13d, esi
call sub.ntdll.dll_memset
mov qword [rbx], rsi
lea rax, [rsp + 0x6c]
lea rbx, [rsi - 6]
mov dword [rsp + 0x40], esi
mov rcx, rbx
mov dword [rsp + 0x70], esi
lea r9d, [rsi + 4]
mov qword [rsp + 0x78], rsi
lea r8, [rsp + 0x68]
mov qword [rsp + 0x60], rsi
lea edx, [rsi + 0x1d]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop dword [rax + rax]
test eax, eax
js 0x180007f0b
cmp dword [rsp + 0x68], esi
je 0x180007769
lea rax, [rsp + 0x6c]
mov dword [rsp + 0x6c], 0x4c
lea r9d, [rsi + 0x4c]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
mov rcx, rbx
lea edx, [rsi + 0x1f]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop dword [rax + rax]
test eax, eax
js 0x180007f0b
mov rsi, qword [rbp - 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlGetAppContainerSidType]
nop dword [rax + rax]
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x180007e2b
cmp dword [rsp + 0x40], 2
je 0x18002d53c
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNELBASE.dll_AppContainerLookupMoniker]
nop dword [rax + rax]
test eax, eax
js 0x18002d692
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlCreateEnvironmentEx]
nop dword [rax + rax]
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x180007e2b
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlGetAppContainerSidType]
nop dword [rax + rax]
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x180007e2b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
lea esi, [r10 + 0xc]
mov qword [rsp + 0x28], rax
mov r8d, esi
mov qword [rsp + 0x20], r10
xor r9d, r9d
lea rdx, str.LOCALAPPDATA
call qword [sym.imp.ntdll.dll_RtlQueryEnvironmentVariable]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xc0000023
jne 0x18002d66a
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x50]
add r8, r8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r10d, r10d
mov qword [rsp + 0x30], rax
mov r12, rax
test rax, rax
je 0x18002d55b
mov r8, qword [rsp + 0x50]
xor edx, edx
add r8, r8
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.LOCALAPPDATA
mov rax, qword [rsp + 0x50]
mov r9, r12
mov r8d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlQueryEnvironmentVariable]
nop dword [rax + rax]
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x180007e2b
cmp dword [rsp + 0x70], 2
je 0x180007f33
lea rdx, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlGetAppContainerParent]
nop dword [rax + rax]
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x180007e2b
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x60]
mov rcx, rdi
call fcn.180009650
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x180007e2b
mov rsi, qword [rsp + 0x60]
mov rcx, r12
mov rdx, rsi
call qword [sym.imp.ntdll.dll_wcsstr]
nop dword [rax + rax]
or rbx, 0xffffffffffffffff
lea r12, [0x1800851f8]
xor r10d, r10d
mov rdi, rax
cmp dword [rsp + 0x40], 2
lea r14d, [rbx + 2]
je 0x18002d58e
cmp dword [rsp + 0x40], r14d
jne 0x180007922
test rax, rax
jne 0x18002d5cd
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
lea rcx, [rax + rax]
test rdi, rdi
jne 0x18000794f
mov rdx, qword [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rdx + rax*2], r10w
jne 0x18000793d
lea rcx, [rcx + rax*2]
add rcx, 0x1e
inc rbx
cmp word [r9 + rbx*2], r10w
jne 0x18000794f
lea r13, [rcx + 0xa]
xor edx, edx
mov rcx, qword gs:[0x60]
lea r13, [r13 + rbx*2]
mov r8, r13
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r10d, r10d
mov r15, rax
test rax, rax
je 0x18002d56c
mov r8, qword [rsp + 0x30]
mov rdx, r13
mov rcx, rax
call fcn.18000760c
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x18002d571
mov esi, 0xc000000d
test rdi, rdi
jne 0x180007b52
mov rdi, r13
mov ebx, r10d
shr rdi, 1
lea rax, [rdi - 1]
cmp rax, 0x7ffffffe
cmova ebx, esi
test ebx, ebx
js 0x18002d63b
mov rcx, rdi
mov rax, r15
test rdi, rdi
je 0x1800079f2
cmp word [rax], r10w
je 0x1800079f2
add rax, 2
sub rcx, r14
jne 0x1800079e3
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, esi
test rcx, rcx
je 0x18002d63b
mov rdx, rdi
sub rdx, rcx
test ebx, ebx
js 0x18002d571
mov rcx, rdi
lea r8, [r15 + rdx*2]
sub rcx, rdx
je 0x180007a5a
mov r9, rcx
lea rax, str.Packages_
sub r9, rdi
add r9, 0x7ffffffe
add r9, rdx
sub rax, r8
test r9, r9
je 0x180007a5a
movzx edx, word [rax + r8]
test dx, dx
je 0x180007a5a
mov word [r8], dx
sub r9, r14
add r8, 2
sub rcx, r14
jne 0x180007a3b
test rcx, rcx
lea rax, [r8 - 2]
cmovne rax, r8
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x80000005
mov word [rax], r10w
test ebx, ebx
js 0x18002d571
mov r8, qword [rsp + 0x60]
mov rdx, r13
mov rcx, r15
call fcn.180008148
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x18002d571
lea rax, [rdi - 1]
mov ebx, r10d
cmp rax, 0x7ffffffe
cmova ebx, esi
test ebx, ebx
js 0x18002d643
mov rcx, rdi
mov rax, r15
test rdi, rdi
je 0x180007acd
cmp word [rax], r10w
je 0x180007acd
add rax, 2
sub rcx, r14
jne 0x180007abe
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, esi
test rcx, rcx
je 0x18002d643
mov rdx, rdi
sub rdx, rcx
test ebx, ebx
js 0x18002d571
mov rcx, rdi
lea r8, [r15 + rdx*2]
sub rcx, rdx
je 0x180007b2e
mov r9, rcx
sub r9, rdi
add r9, 0x7ffffffe
add r9, rdx
sub r12, r8
test r9, r9
je 0x180007b2e
movzx eax, word [r12 + r8]
test ax, ax
je 0x180007b2e
mov word [r8], ax
sub r9, r14
add r8, 2
sub rcx, r14
jne 0x180007b0f
test rcx, rcx
lea rax, [r8 - 2]
cmovne rax, r8
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x80000005
mov word [rax], r10w
test ebx, ebx
js 0x18002d571
mov r9, r13
mov r12d, 0x7ffffffe
shr r9, 1
mov ebx, r10d
lea rax, [r9 - 1]
cmp rax, r12
cmova ebx, esi
test ebx, ebx
js 0x18002d64b
mov rcx, r9
mov rax, r15
test r9, r9
je 0x180007b8d
cmp word [rax], r10w
je 0x180007b8d
add rax, 2
sub rcx, r14
jne 0x180007b7e
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, esi
test rcx, rcx
je 0x18002d64b
mov rdx, r9
sub rdx, rcx
test ebx, ebx
js 0x18002d65b
mov rcx, r9
lea r8, [r15 + rdx*2]
sub rcx, rdx
je 0x180007bf5
mov rax, rcx
sub rax, r9
lea r9, [rax + 0x7ffffffe]
add r9, rdx
lea rdx, [0x180085218]
sub rdx, r8
test r9, r9
je 0x180007bf5
movzx eax, word [rdx + r8]
test ax, ax
je 0x180007bf5
mov word [r8], ax
sub r9, r14
add r8, 2
sub rcx, r14
jne 0x180007bd6
test rcx, rcx
lea rax, [r8 - 2]
cmovne rax, r8
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x80000005
mov word [rax], r10w
test ebx, ebx
js 0x18002d65b
mov r8, qword [rsp + 0x58]
mov rdx, r13
mov rcx, r15
call fcn.180008148
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x18002d571
mov rdx, r15
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rdx, str.LOCALAPPDATA
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
nop dword [rax + rax]
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x18002d571
mov rcx, qword gs:[0x60]
lea rdi, [r13 + 0xe]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r10d, r10d
mov r13, rax
test rax, rax
je 0x18002d5be
mov r8, r15
mov rdx, rdi
mov rcx, rax
call fcn.18000760c
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x18002d5c3
shr rdi, 1
mov ebx, r10d
lea rax, [rdi - 1]
cmp rax, r12
cmova ebx, esi
test ebx, ebx
js 0x18002d653
mov rcx, rdi
mov rax, r13
test rdi, rdi
je 0x180007d04
cmp word [rax], r10w
je 0x180007d04
add rax, 2
sub rcx, r14
jne 0x180007cf5
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, esi
test rcx, rcx
je 0x18002d653
mov rdx, rdi
sub rdx, rcx
test ebx, ebx
js 0x18002d5c3
mov rcx, rdi
lea r8, [r13 + rdx*2]
sub rcx, rdx
je 0x180007d6d
lea r9, [rdx + 0x7ffffffe]
mov rax, rcx
sub rax, rdi
lea rdx, str.Temp
add r9, rax
sub rdx, r8
test r9, r9
je 0x180007d6d
movzx eax, word [r8 + rdx]
test ax, ax
je 0x180007d6d
mov word [r8], ax
sub r9, r14
add r8, 2
sub rcx, r14
jne 0x180007d4e
test rcx, rcx
lea rax, [r8 - 2]
cmovne rax, r8
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x80000005
mov word [rax], r10w
test ebx, ebx
js 0x18002d5c3
mov rdx, r13
lea rcx, [rbp - 0x68]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rdx, str.TEMP
lea rcx, [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
nop dword [rax + rax]
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x18002d5c3
lea rdx, [0x1800851d0]
lea rcx, [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
nop dword [rax + rax]
mov r12, qword [rsp + 0x30]
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x180007e2b
mov rcx, qword [rbp - 0x80]
mov rax, qword [rsp + 0x48]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180007e44
call qword [sym.imp.KERNELBASE.dll_AppContainerFreeMemory]
nop dword [rax + rax]
xor r10d, r10d
test r12, r12
je 0x180007e6a
mov rcx, qword gs:[0x60]
mov r8, r12
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r10d, r10d
cmp qword [rsp + 0x78], r10
je 0x180007e94
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r10d, r10d
cmp qword [rsp + 0x60], r10
je 0x180007ebb
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test r15, r15
je 0x180007ede
mov rcx, qword gs:[0x60]
mov r8, r15
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test r13, r13
je 0x180007f01
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
js 0x18002d672
mov eax, ebx
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0x188]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rsp + 0x58]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], r10w
jne 0x180007f3c
add rbx, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword gs:[0x60]
lea r13, [rbx*2 + 0x20]
mov rcx, qword [rcx + 0x30]
mov r8, r13
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r10d, r10d
mov r15, rax
test rax, rax
je 0x18002d565
mov r8, r12
mov rdx, r13
mov rcx, rax
call fcn.18000760c
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x18002d576
mov rdi, r13
lea r14d, [r10 + 1]
shr rdi, 1
mov r12d, 0x7ffffffe
mov ebx, r10d
mov esi, 0xc000000d
lea rax, [rdi - 1]
cmp rax, r12
cmova ebx, esi
test ebx, ebx
js 0x18002d57e
mov rdx, rdi
mov rax, r15
test rdi, rdi
je 0x180007fdf
cmp word [rax], r10w
je 0x180007fdf
add rax, 2
sub rdx, r14
jne 0x180007fd0
mov rax, rdx
neg rax
sbb ebx, ebx
not ebx
and ebx, esi
test rdx, rdx
je 0x18002d57e
mov rcx, rdi
sub rcx, rdx
test ebx, ebx
js 0x18002d571
mov rdx, rdi
lea r8, [r15 + rcx*2]
sub rdx, rcx
je 0x180008043
mov r9, rdx
lea rax, str.Packages_
sub r9, rdi
add r9, r12
add r9, rcx
sub rax, r8
test r9, r9
je 0x180008043
movzx ecx, word [rax + r8]
test cx, cx
je 0x180008043
mov word [r8], cx
sub r9, r14
add r8, 2
sub rdx, r14
jne 0x180008024
test rdx, rdx
lea rax, [r8 - 2]
cmovne rax, r8
neg rdx
sbb ebx, ebx
not ebx
and ebx, 0x80000005
mov word [rax], r10w
test ebx, ebx
js 0x18002d571
mov r8, qword [rsp + 0x58]
mov rdx, r13
mov rcx, r15
call fcn.180008148
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x18002d571
lea rax, [rdi - 1]
mov ebx, r10d
cmp rax, r12
cmova ebx, esi
test ebx, ebx
js 0x18002d586
mov rcx, rdi
mov rax, r15
test rdi, rdi
je 0x1800080b3
cmp word [rax], r10w
je 0x1800080b3
add rax, 2
sub rcx, r14
jne 0x1800080a4
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, esi
test rcx, rcx
je 0x18002d586
mov rdx, rdi
sub rdx, rcx
test ebx, ebx
js 0x18002d571
mov rcx, rdi
lea r8, [r15 + rdx*2]
sub rcx, rdx
je 0x18000811d
mov r9, rcx
sub r9, rdi
add r9, r12
lea r12, [0x1800851f8]
add r9, rdx
sub r12, r8
test r9, r9
je 0x180008117
movzx eax, word [r12 + r8]
test ax, ax
je 0x180008117
mov word [r8], ax
sub r9, r14
add r8, 2
sub rcx, r14
jne 0x1800080f8
mov r12d, 0x7ffffffe
test rcx, rcx
lea rax, [r8 - 2]
cmovne rax, r8
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x80000005
mov word [rax], r10w
test ebx, ebx
jmp 0x180007c30
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
jne 0x18002d62c
jmp 0x180007769
mov ebx, 0xc0000017
jmp 0x180007e2b
mov ebx, 0xc0000017
jmp 0x18002d576
mov ebx, 0xc0000017
mov r12, qword [rsp + 0x30]
mov r13, r10
jmp 0x180007e2b
mov rcx, r10
jmp 0x180007ffa
mov rdx, r10
jmp 0x1800080ce
test rdi, rdi
je 0x18002d5b7
mov rcx, rbx
inc rcx
cmp word [rsi + rcx*2], r10w
jne 0x18002d596
lea rcx, [rax + rcx*2]
mov rdx, r12
call sub.ntdll.dll_wcscmp
xor r10d, r10d
test eax, eax
je 0x180007922
mov ebx, 0xc000000d
jmp 0x18002d5c3
mov ebx, 0xc0000017
mov r12, qword [rsp + 0x30]
jmp 0x180007e2b
mov rcx, qword [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r10w
jne 0x18002d5d5
lea rsi, [rdi + rax*2]
mov rcx, rsi
lea rdx, str.AC_
call qword [sym.imp.ntdll.dll_wcsstr]
nop dword [rax + rax]
cmp rsi, rax
jne 0x18002d633
mov r9, qword [rsp + 0x58]
lea rax, [rsi + 0xc]
mov r8, r9
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x18002d621
add rax, 2
test edx, edx
jne 0x18002d60d
xor r10d, r10d
test ecx, ecx
jne 0x180007927
xor eax, eax
jmp 0x180007f0b
xor r10d, r10d
jmp 0x180007922
mov rdx, r10
jmp 0x180007a0d
mov rdx, r10
jmp 0x180007ae8
mov rdx, r10
jmp 0x180007ba8
mov rdx, r10
jmp 0x180007d1f
mov r12, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
jmp 0x180007e2b
xor r10d, r10d
jmp 0x180007e2b
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180007f09
call qword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
nop dword [rax + rax]
nop
jmp 0x180007f09
movzx ecx, ax
mov eax, 0xc0000001
cmp ecx, 2
lea edx, [rax + 0xe]
cmove eax, edx
jmp 0x180007f0b