Function at 0x1800176a0
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15d, dword [rsp + 0xf0]
xor esi, esi
xor edi, edi
mov r13, r9
mov r14d, r8d
mov rbp, rdx
mov qword [rdx], rsi
mov r12, rcx
test rcx, rcx
jne 0x1800176ea
lea esi, [rcx + 1]
jmp 0x180017773
xor eax, eax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x6c], 8
mov dword [rsp + 0x68], eax
test r8d, r8d
je 0x180017729
lea r9d, [rax + 2]
lea r8d, [rax + 0xc]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov edi, eax
test eax, eax
jne 0x180017729
lea esi, [rax + 2]
jmp 0x180017755
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [rsp + 0x6c]
lea ebx, [rax + rcx + 8]
mov ecx, ebx
call fcn.180045488
mov qword [rbp], rax
test rax, rax
jne 0x1800177e2
lea esi, [rax + 3]
test edi, edi
jne 0x18001776b
mov rcx, qword [rbp]
test rcx, rcx
je 0x18001776b
call fcn.180045904
mov qword [rbp], 0
mov rbx, qword [rsp + 0x88]
cmp dword [0x1801340b0], 0
je 0x1800177c0
mov rax, qword [rbp]
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, str.CKSecurity::CopyAcl_____Inner___ret:__d___myerror:__d___SrcAcl:__08x___DstAcl:__08x___b:__08x___Sid:__08x___Mask:__08x_
lea r8, [0x1800d5c98]
lea rcx, [0x180133ff8]
mov edx, 0xf
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call fcn.18001ab50
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
mov edx, ebx
lea r8d, [rcx + 2]
mov dword [rax], ecx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov edi, eax
test eax, eax
jne 0x180017804
lea esi, [rax + 4]
jmp 0x180017755
xor ebx, ebx
mov qword [rsp + 0x60], rsi
test r14d, r14d
je 0x180017886
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180017886
nop dword [rax + rax]
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_GetAce]
mov edi, eax
test eax, eax
je 0x1800178b3
mov rdx, qword [rsp + 0x60]
test byte [rdx + 1], 0x10
jne 0x180017886
add rdx, 8
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x18001787e
mov r9, qword [rsp + 0x60]
mov rcx, qword [rbp]
or r8d, 0xffffffff
movzx eax, word [r9 + 2]
mov edx, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AddAce]
mov edi, eax
test eax, eax
je 0x1800178a9
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x180017820
mov rcx, qword [rbp]
mov r9, r13
mov r8d, r15d
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
mov edi, eax
test eax, eax
jne 0x1800178bd
lea esi, [rax + 7]
jmp 0x180017755
mov esi, 6
jmp 0x180017755
mov esi, 5
jmp 0x180017755
test r14d, r14d
je 0x180017751
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180017751
cmp ebx, eax
jae 0x180017751
nop word [rax + rax]
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_GetAce]
mov edi, eax
test eax, eax
je 0x180017939
mov r9, qword [rsp + 0x60]
mov rcx, qword [rbp]
or r8d, 0xffffffff
movzx eax, word [r9 + 2]
mov edx, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AddAce]
mov edi, eax
test eax, eax
je 0x18001792f
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x1800178e0
jmp 0x180017751
mov esi, 9
jmp 0x180017755
mov esi, 8
jmp 0x180017755