Function at 0x1400f327c
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov rsi, r8
mov ebx, r12d
mov r14, rdx
mov rdi, rcx
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
lea r13d, [r12 + 1]
cmp rcx, r15
je 0x1400f32df
test byte [rcx + 0x1c], r13b
je 0x1400f32df
cmp byte [rcx + 0x19], 5
jb 0x1400f32df
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x11]
lea r8, [0x140153f88]
call fcn.1400049d8
mov rcx, qword [0x14016f048]
or rbp, 0xffffffffffffffff
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x88], r12
cmp rcx, r15
je 0x1400f3321
test byte [rcx + 0x1c], r13b
je 0x1400f3321
cmp byte [rcx + 0x19], 5
jb 0x1400f3321
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x13]
mov r9, rdi
lea r8, [0x140153f88]
call fcn.1400058d8
mov rcx, qword [0x14016f048]
test r14, r14
jne 0x1400f336c
test rsi, rsi
jne 0x1400f336c
mov ebx, 0x80070057
cmp rcx, r15
je 0x1400f3634
test byte [rcx + 0x1c], r13b
je 0x1400f3634
cmp byte [rcx + 0x19], 2
jb 0x1400f3634
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x13]
lea r8, [0x140153f88]
call fcn.1400049d8
mov rcx, qword [0x14016f048]
jmp 0x1400f3634
mov eax, 3
mov qword [rsp + 0x30], r12
mov r8d, eax
mov dword [rsp + 0x28], 0x2200000
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov edx, 0x60000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f33f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f3634
test byte [rcx + 0x1c], r13b
je 0x1400f3634
cmp byte [rcx + 0x19], 2
jb 0x1400f3634
lea edx, [rbp + 0x15]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140153f88]
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005938
jmp 0x1400f3360
test rsi, rsi
je 0x1400f3477
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8d, 0x80000004
mov edx, r13d
mov qword [rsp + 0x20], r12
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x1400f3477
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f3634
test byte [rcx + 0x1c], r13b
je 0x1400f3634
cmp byte [rcx + 0x19], 2
jb 0x1400f3634
mov rcx, qword [rcx + 0x10]
mov edx, 0x15
mov dword [rsp + 0x28], ebx
mov r9d, 0x80000004
mov qword [rsp + 0x20], rdi
call fcn.1400f2f54
jmp 0x1400f3360
test r14, r14
je 0x1400f36b6
lea rax, [rsp + 0x88]
mov r8d, r13d
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x98]
mov qword [rsp + 0x30], r12
mov edx, r13d
mov qword [rsp + 0x28], r12
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x1400f34f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f3634
test byte [rcx + 0x1c], r13b
je 0x1400f3634
cmp byte [rcx + 0x19], 2
jb 0x1400f3634
mov edx, 0x16
jmp 0x1400f33da
mov rcx, qword [rsp + 0x98]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400f36b6
mov rax, rsi
mov rcx, rbp
neg rax
sbb r15d, r15d
and r15d, 0x80000004
add r15d, r13d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
mov r8d, 3
mov rax, rsi
mov dword [rsp + 0x28], 0x2200000
neg rax
mov dword [rsp + 0x20], r8d
mov rcx, rdi
sbb edx, edx
xor r9d, r9d
and edx, 0x40000
add edx, 0xa0000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f35b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
cmp rcx, r15
je 0x1400f3634
test byte [rcx + 0x1c], r13b
je 0x1400f3634
cmp byte [rcx + 0x19], 2
jb 0x1400f3634
lea edx, [rbp + 0x18]
jmp 0x1400f33da
mov qword [rsp + 0x30], r12
mov r9, r14
mov qword [rsp + 0x28], rsi
mov r8d, r15d
mov edx, r13d
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x1400f36af
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x1400f362d
test byte [rcx + 0x1c], r13b
je 0x1400f362d
cmp byte [rcx + 0x19], 2
jb 0x1400f362d
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov dword [rsp + 0x28], ebx
mov r9d, r15d
mov qword [rsp + 0x20], rdi
call fcn.1400f2f54
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x1400f3659
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x14016f048]
mov qword [rsp + 0x88], r12
cmp rbp, 0xffffffffffffffff
je 0x1400f366f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f3695
test byte [rcx + 0x1c], r13b
je 0x1400f3695
cmp byte [rcx + 0x19], 5
jb 0x1400f3695
mov rcx, qword [rcx + 0x10]
lea r8, [0x140153f88]
mov edx, 0x1a
call fcn.1400049d8
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r15, [0x14016f048]
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400f3634
test byte [rcx + 0x1c], r13b
je 0x1400f3634
cmp byte [rcx + 0x19], 5
jb 0x1400f3634
mov rcx, qword [rcx + 0x10]
lea r8, [0x140153f88]
mov edx, 0x19
mov r9, rdi
call fcn.1400058d8
jmp 0x1400f3360