Function at 0x18020c97c
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov dword [rsp + 0x50], r9d
mov rsi, r8
mov r14, rdx
mov qword [rsp + 0xa8], rdx
xor ecx, ecx
mov ebx, ecx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x5c], ecx
mov r12d, ecx
mov qword [rsp + 0x88], rcx
mov dword [rsp + 0x60], ecx
mov r13d, ecx
mov qword [rsp + 0x90], rcx
mov dword [rsp + 0x54], ecx
mov qword [rsp + 0x68], rcx
mov r15d, ecx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x70], rcx
mov edi, ecx
mov dword [rsp + 0x40], ecx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x18020cf88
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x18020ca50
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LookupAccountName___failed._Error__d_n
mov edx, eax
call fcn.18006efe0
jmp 0x18020cf88
mov ebx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
mov qword [rsp + 0x88], rax
test rax, rax
jne 0x18020ca99
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.HeapAlloc___failed._Error__d_n
mov edx, eax
call fcn.18006efe0
mov rbx, qword [rsp + 0x48]
jmp 0x18020cf88
mov ebx, dword [rsp + 0x5c]
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x18020cad6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.HeapAlloc___failed._Error__d_n
jmp 0x18020ca44
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x60]
mov r8, r12
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x18020ca37
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea esi, [r9 + 4]
mov edx, esi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x18020cf88
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x18020cb4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetFileSecurity___failed._Error__d_n
jmp 0x18020ca44
mov ebx, dword [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
mov ebx, 8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x18020ca7b
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x54]
mov r8, r13
mov edx, esi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
xor r14d, r14d
test eax, eax
jne 0x18020cbb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetFileSecurity___failed._Error__d_n
jmp 0x18020ca88
mov edx, 1
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x18020cbde
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.InitializeSecurityDescriptor___failed.Error__d_n
jmp 0x18020ca88
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x18020cc0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x18020ca88
mov dword [rsp + 0xd8], r14d
mov qword [rsp + 0xdc], rbx
mov rax, qword [rsp + 0x68]
neg rax
sbb ecx, ecx
and ecx, dword [rsp + 0x58]
mov dword [rsp + 0x58], ecx
mov esi, 2
je 0x18020cc68
mov r9d, esi
lea r8d, [rsi + 0xa]
lea rdx, [rsp + 0xd8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x18020cc68
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetAclInformation___failed._Error__d_n
jmp 0x18020ca88
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov r14d, dword [rsp + 0xdc]
add r14d, ebx
add r14d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r14d
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
mov qword [rsp + 0x98], rax
test rax, rax
je 0x18020ca7b
mov r8d, esi
mov edx, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xor r14d, r14d
test eax, eax
jne 0x18020cccf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.InitializeAcl___failed._Error__d_n
jmp 0x18020ca88
mov ebx, r14d
mov dword [rsp + 0x7c], ebx
cmp dword [rsp + 0x58], r14d
je 0x18020cd91
mov eax, dword [rsp + 0xd8]
test eax, eax
je 0x18020cd91
mov edi, r14d
mov dword [rsp + 0x64], r14d
cmp edi, eax
jae 0x18020cd91
lea r8, [rsp + 0x70]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x18020cd28
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetAce___failed._Error__d_n
jmp 0x18020ca88
mov rdx, qword [rsp + 0x70]
test byte [rdx + 1], 0x10
jne 0x18020cd91
add rdx, 8
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x18020cd46
jmp 0x18020cd7f
mov r9, qword [rsp + 0x70]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, esi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x18020cd79
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.AddAce___failed._Error__d_n
jmp 0x18020ca88
inc ebx
mov dword [rsp + 0x7c], ebx
inc edi
mov dword [rsp + 0x64], edi
mov eax, dword [rsp + 0xd8]
jmp 0x18020ccf8
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AddAccessAllowedAceEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, esi
mov rcx, r15
test rax, rax
je 0x18020cde0
mov qword [rsp + 0x20], r12
mov r9d, dword [rsp + 0x50]
mov r8d, 3
call rax
test eax, eax
jne 0x18020ce04
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.AddAccessAllowedAceEx___failed._Error__d_n
jmp 0x18020ca88
mov r9, r12
mov r8d, dword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x18020ce04
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.AddAccessAllowedAce___failed._Error__d_n
jmp 0x18020ca88
cmp dword [rsp + 0x58], r14d
je 0x18020ce68
mov eax, dword [rsp + 0xd8]
test eax, eax
je 0x18020ce68
cmp edi, eax
jae 0x18020ce68
lea r8, [rsp + 0x70]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x18020cd16
mov r9, qword [rsp + 0x70]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, esi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x18020cd67
inc edi
mov dword [rsp + 0x64], edi
mov eax, dword [rsp + 0xd8]
jmp 0x18020ce16
xor r9d, r9d
mov r8, r15
lea edx, [r9 + 1]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x18020ce96
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x18020ca88
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetSecurityDescriptorControl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18020cf4b
movzx ebx, r14w
mov word [rsp + 0x50], r14w
mov dword [rsp + 0x80], r14d
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x18020cefd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSecurityDescriptorControl___failed.Error__d_n
jmp 0x18020ca88
mov eax, 0x400
test word [rsp + 0x50], ax
je 0x18020cf10
mov ebx, 0x500
jmp 0x18020cf24
mov eax, 0x1000
test word [rsp + 0x50], ax
je 0x18020cf1f
movzx ebx, ax
test bx, bx
je 0x18020cf4b
movzx r8d, bx
movzx edx, bx
lea rcx, [rsp + 0xb0]
call rdi
test eax, eax
jne 0x18020cf4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetSecurityDescriptorControl___failed.Error__d_n
jmp 0x18020ca88
lea r8, [rsp + 0xb0]
mov edx, 4
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x18020cf7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetFileSecurity___failed._Error__d_n
jmp 0x18020ca88
mov edi, 1
mov rbx, qword [rsp + 0x48]
jmp 0x18020cf8c
mov edi, dword [rsp + 0x40]
test r12, r12
je 0x18020cfa5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x18020cfbe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x18020cfd7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r15, r15
je 0x18020cff0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret