Function at 0x1400bd94c
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x190
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r12, rdx
mov r13, rcx
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssSidCollection::IsSidAllowedToFire
mov qword [rsp + 0x50], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x6e5
mov dword [rsp + 0x64], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x68], 0xff
xor r15d, r15d
mov dword [rbp - 0x18], 0x1000000
lea ebx, [r15 + 1]
xor edx, edx
lea r8d, [r15 + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.140003840
nop
mov dword [rbp + 0x70], r15d
xor eax, eax
mov qword [rbp + 0x74], rax
mov qword [rsp + 0x30], r15
mov sil, r15b
mov dil, r15b
lea r9d, [r15 + 2]
lea r8d, [r15 + 0xc]
lea rdx, [rbp + 0x70]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_GetAclInformation]
mov r14d, r15d
mov eax, dword [rbp + 0x70]
test eax, eax
je 0x1400bdac9
lea r8, [rsp + 0x30]
mov edx, r15d
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_GetAce]
mov r9, qword [rsp + 0x30]
movzx ecx, byte [r9]
test ecx, ecx
je 0x1400bda83
cmp ecx, 1
jne 0x1400bdaba
test r14d, r14d
jne 0x1400bda6c
lea rdx, [r9 + 8]
mov rcx, r12
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_EqualSid]
test eax, eax
jne 0x1400bdada
jmp 0x1400bdaba
add r9, 8
mov r8, r12
lea rdx, [rbp]
mov rcx, r13
call fcn.1400bcc50
test al, al
jmp 0x1400bda68
test r14d, r14d
jne 0x1400bda9e
lea rdx, [r9 + 8]
mov rcx, r12
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_EqualSid]
test eax, eax
je 0x1400bdaba
mov dil, bl
jmp 0x1400bdaba
add r9, 8
mov r8, r12
lea rdx, [rbp]
mov rcx, r13
call fcn.1400bcc50
movzx edi, dil
test al, al
cmovne edi, ebx
add r15d, ebx
mov eax, dword [rbp + 0x70]
cmp r15d, eax
jb 0x1400bda30
add r14d, ebx
cmp r14d, 2
jae 0x1400bdadd
xor r15d, r15d
jmp 0x1400bda28
mov sil, bl
mov edx, dword [rbp + 0x24]
lea rcx, [rbp]
call fcn.140004154
xor r13d, r13d
test eax, eax
je 0x1400bdbd6
mov qword [rsp + 0x40], r13
lea rax, [0x1400e53d8]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.14003ea08
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
test eax, eax
je 0x1400bdbcc
test dil, dil
je 0x1400bdb36
test sil, sil
lea r15, str.allowed
je 0x1400bdb3d
lea r15, str.denied
test dil, dil
jne 0x1400bdb4e
test sil, sil
lea r14, str.implicitely
je 0x1400bdb55
lea r14, str.explicitely
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssSidCollection::IsSidAllowedToFire
mov qword [rsp + 0x50], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x73f
mov dword [rsp + 0x64], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x40]
lea r8, str.WriterSid:__s_was__s__s_to_fire
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.1400037d0
lea rcx, [rsp + 0x38]
call fcn.14003e9d8
test dil, dil
je 0x1400bdbe0
test sil, sil
je 0x1400bdbe3
mov bl, r13b
mov dl, bl
lea rcx, [rbp]
call fcn.140013f94
mov bl, al
lea rcx, [rbp]
call fcn.140003960
mov al, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14001ff30
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret