Function at 0x160196c10
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov qword [rsp + 0xf0], 0xfffffffffffffffe
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
movzx eax, r8w
mov word [rsp + 0x38], ax
mov r12, rdx
mov qword [rsp + 0xd0], rdx
mov r13, rcx
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xe8], rdx
mov word [rsp + 0x60], ax
call fcn.160015f4c
mov ebx, eax
xor r14d, r14d
test eax, eax
js 0x1601975ba
lea rsi, [r13 + 0x18]
mov qword [rsp + 0xd8], rsi
mov rcx, rsi
call fcn.1600454bc
nop
cmp dword [r13 + 0xf8], r14d
jne 0x160196cb7
lea rcx, [r13 + 0x88]
call fcn.1600d33c0
test eax, eax
je 0x160196cb7
mov rcx, r13
call fcn.160196910
mov ebx, eax
lea rax, [r13 + 0xd8]
mov qword [rsp + 0x70], rax
add rax, 8
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r14
lea rcx, [rsp + 0xa8]
call fcn.16006035c
nop
lea rcx, [rsp + 0xb0]
call fcn.160060330
nop
test ebx, ebx
jns 0x160196d2a
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x160196d07
call fcn.160031c48
nop
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x160196d1a
call fcn.160031c48
nop
mov rcx, rsi
call fcn.160045454
nop
mov eax, ebx
jmp 0x1601975ba
mov rbx, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1601960c4
mov r15, qword [rax]
test r15, r15
je 0x160196d79
mov rdx, rbx
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x160196d3a
mov rdx, rdi
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x160196d3a
mov dword [r15 + 0xac], 1
jmp 0x160196d3a
mov eax, 0x200c
cmp word [r12], ax
jne 0x160196d8c
lea rax, [r12 + 8]
jmp 0x160196da1
mov eax, 0x600c
cmp word [r12], ax
jne 0x160197590
mov rax, qword [r12 + 8]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x3c]
mov edx, 1
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov r15d, eax
mov r12d, 0x80070057
test eax, eax
js 0x160196df3
cmp dword [rsp + 0x3c], r14d
cmovne r15d, r12d
test r15d, r15d
js 0x160196df3
lea r8, [rsp + 0x3c]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov r15d, eax
inc dword [rsp + 0x3c]
mov dword [rsp + 0x50], r14d
test r15d, r15d
js 0x160197566
lea r8, [rsp + 0x50]
mov edx, 2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov r15d, eax
test eax, eax
js 0x160197566
cmp dword [rsp + 0x50], r14d
cmovne r15d, r12d
test r15d, r15d
js 0x160197566
lea r8, [rsp + 0x50]
mov edx, 2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov r15d, eax
test eax, eax
js 0x160197566
cmp dword [rsp + 0x50], 1
cmovne r15d, r12d
test r15d, r15d
js 0x160197566
mov eax, r14d
mov dword [rsp + 0x68], eax
cmp eax, dword [rsp + 0x3c]
jge 0x1601972ae
mov dword [rsp + 0x6c], r14d
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x68]
mov r12, qword [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
mov r15d, eax
test eax, eax
js 0x160197291
mov dword [rsp + 0x6c], 1
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x68]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
mov r15d, eax
test eax, eax
js 0x160197291
cmp word [rsp + 0x90], r14w
je 0x160197291
cmp word [rsp + 0xb8], r14w
je 0x160197291
cmp word [rsp + 0x90], 8
jne 0x16019728b
cmp word [rsp + 0xb8], 3
jne 0x16019728b
lea rax, [rsp + 0x118]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], 0x41
mov word [rsp + 0x118], r14w
lea rax, str.04_r_
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x88], r14
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x88]
call fcn.1600d3578
nop
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x88]
call fcn.1600d3b88
mov r15d, eax
test eax, eax
jns 0x160196fb7
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x160196fa5
call fcn.160031c48
nop
lea rcx, [rsp + 0x100]
call fcn.1600d24b8
jmp 0x160197291
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x160196fd2
add rax, 8
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r14
lea rcx, [rsp + 0x70]
call fcn.1601960c4
mov r12, qword [rax]
test r12, r12
je 0x1601970a6
mov rdx, qword [rsp + 0x108]
mov rcx, qword [r12 + 0x10]
call fcn.160062ae8
test eax, eax
jne 0x160196fd2
mov dword [r12 + 0xac], r14d
mov eax, dword [rsp + 0xc0]
cmp dword [r12 + 0xa8], eax
je 0x160197242
mov dword [r12 + 0xa8], eax
lea rcx, [r13 + 0x88]
mov rdx, qword [r12]
call fcn.1600d3344
mov rcx, rax
test rax, rax
jne 0x160197097
mov eax, dword [r12 + 0xa8]
mov rcx, qword [r12]
mov byte [rsp + 0x30], r14b
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x58], rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov edx, 1
lea r12, [r13 + 0x88]
mov rcx, r12
call fcn.1600d26a0
lea rcx, [r13 + 0x90]
mov r8, qword [r12]
call fcn.1600d4484
jmp 0x160197242
mov eax, dword [rsp + 0xc0]
mov dword [rcx + 4], eax
jmp 0x160197242
mov ecx, 0xb0
mov rax, qword [0x1601c0fd0]
call qword [case.0x16003fc5a.0]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1601970df
mov r8d, dword [rsp + 0xc0]
mov rdx, qword [rsp + 0x108]
mov rcx, rax
call fcn.160195f5c
mov r12, rax
jmp 0x1601970e2
mov r12, r14
test r12, r12
jne 0x160197155
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1601970fa
call fcn.160031c48
nop
lea rcx, [rsp + 0x100]
call fcn.1600d24b8
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
test rdi, rdi
je 0x160197134
mov rcx, rdi
call fcn.160031c48
nop
test rbx, rbx
je 0x160197142
mov rcx, rbx
call fcn.160031c48
nop
mov rcx, rsi
call fcn.160045454
nop
mov eax, 0x8007000e
jmp 0x1601975ba
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidSid]
test eax, eax
je 0x16019723c
lea rcx, [r13 + 0x88]
mov rdx, qword [r12]
call fcn.1600d3344
mov ecx, dword [r12 + 0xa8]
test rax, rax
jne 0x160197237
mov rax, qword [r12]
mov byte [rsp + 0x30], r14b
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov edx, 1
lea rcx, [r13 + 0x88]
call fcn.1600d26a0
lea rcx, [r13 + 0x90]
mov r8, qword [r13 + 0x88]
call fcn.1600d4484
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rax, qword [0x1601c0fd0]
call qword [case.0x16003fc5a.0]
test rax, rax
je 0x1601971f7
mov qword [rax], r14
mov qword [rax + 8], r14
jmp 0x1601971fa
mov rax, r14
test rax, rax
jne 0x16019721e
mov rcx, qword [rsp + 0x1e8]
mov r9d, 0x8007000e
lea r8, str.onecoreuap_base_appmodel_search_searchcommoninclude_tpslist.hxx
mov edx, 0x12b
call fcn.1600b47d4
mov qword [rax + 8], r12
lea rcx, [r13 + 0xe0]
mov r8, rax
mov rdx, qword [rcx + 0x10]
call fcn.1600323a8
jmp 0x160197242
mov dword [rax + 4], ecx
jmp 0x160197242
mov r15d, 0x80070525
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x160197255
call fcn.160031c48
nop
lea rcx, [rsp + 0x100]
call fcn.1600d24b8
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [rsp + 0x68]
inc eax
jmp 0x160196e68
mov r15d, 0x80070057
lea rcx, [rsp + 0xb8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test r15d, r15d
jns 0x1601972e0
test rdi, rdi
je 0x1601972c1
mov rcx, rdi
call fcn.160031c48
nop
test rbx, rbx
je 0x1601972cf
mov rcx, rbx
call fcn.160031c48
nop
mov rcx, rsi
call fcn.160045454
nop
mov eax, r15d
jmp 0x1601975ba
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1601972fb
add rax, 8
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r14
lea rcx, [rsp + 0x70]
call fcn.1601960c4
mov r12, qword [rsp + 0x80]
mov rax, r12
neg rax
sbb rcx, rcx
and rcx, qword [rsp + 0x78]
jne 0x160197326
lea rcx, [0x1602740d8]
jmp 0x16019732a
add rcx, 8
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rcx
test rcx, rcx
je 0x16019742c
cmp dword [rcx + 0xac], r14d
je 0x1601972fb
mov r15, r14
mov qword [rsp + 0x48], r14
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1601973a2
test r12, r12
je 0x1601973a2
cmp qword [rsp + 0x78], r14
je 0x1601973a2
lea rcx, [rax + 8]
mov rdx, r12
call fcn.1600323c4
test rax, rax
je 0x160197384
mov r15, qword [rax + 8]
mov qword [rsp + 0x48], r15
mov rcx, rax
call fcn.160031c48
mov rcx, qword [r12]
mov rax, qword [rsp + 0x70]
add rax, 0x10
cmp rcx, rax
cmove rcx, r14
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], r15
mov rdx, qword [rcx]
lea rcx, [r13 + 0x88]
call fcn.1600d3ecc
lea rcx, [r13 + 0x90]
mov r8, qword [r13 + 0x88]
call fcn.1600d4484
nop
jmp 0x160197416
test r15, r15
je 0x16019730d
mov rcx, r15
call fcn.160196104
jmp 0x16019730d
mov rcx, r13
call fcn.160196134
lea rcx, [r13 + 0x90]
mov r8, qword [r13 + 0x88]
call fcn.1600d4484
mov rcx, r13
call fcn.160196b5c
mov r15d, eax
test eax, eax
js 0x1601974fa
cmp word [rsp + 0x38], 0xffff
jne 0x1601974fa
lea rax, [r13 + 0x100]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], r14
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x90]
call fcn.160019c18
test eax, eax
je 0x1601974fa
test r15d, r15d
js 0x1601974fa
mov rcx, r14
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0xa0]
neg rax
sbb r8, r8
and r8, qword [rsp + 0x98]
je 0x1601974d5
lea rdx, [rsp + 0x48]
mov rcx, r8
call fcn.160056f6c
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
movzx r8d, word [rsp + 0x38]
mov rdx, r12
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov r15d, eax
lea rcx, [rsp + 0x48]
call fcn.160002750
jmp 0x16019748d
jmp 0x160197521
test rdi, rdi
je 0x16019752f
mov rcx, rdi
call fcn.160031c48
nop
test rbx, rbx
je 0x16019753d
mov rcx, rbx
call fcn.160031c48
nop
mov rcx, rsi
call fcn.160045454
nop
test r15d, r15d
js 0x16019758b
mov rcx, qword [r13 + 0x128]
test rcx, rcx
je 0x16019758b
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x18]
call qword [case.0x16003fc5a.0]
jmp 0x16019758b
test rdi, rdi
je 0x160197574
mov rcx, rdi
call fcn.160031c48
nop
test rbx, rbx
je 0x160197582
mov rcx, rbx
call fcn.160031c48
nop
mov rcx, rsi
call fcn.160045454
nop
mov eax, r15d
jmp 0x1601975ba
test rdi, rdi
je 0x16019759e
mov rcx, rdi
call fcn.160031c48
nop
test rbx, rbx
je 0x1601975ac
mov rcx, rbx
call fcn.160031c48
nop
mov rcx, rsi
call fcn.160045454
nop
mov eax, 0x80070057
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret