Function at 0x18000e1e8
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r15, qword [rbp + 0x68]
xor r11d, r11d
mov qword [rbp - 0x18], r11
mov r14, r9
mov qword [rbp - 8], r11
mov rsi, r8
mov qword [rbp - 0x28], r11
mov r12d, r11d
mov qword [rbp - 0x30], r11
test r15, r15
jne 0x18000e235
lea eax, [r11 + 1]
jmp 0x18000e526
test rsi, rsi
jne 0x18000e24c
test r14, r14
jne 0x18000e24c
lea edi, [rsi + 1]
xor eax, eax
mov byte [r15], dil
jmp 0x18000e526
mov byte [r15], r11b
test rsi, rsi
je 0x18000e272
lea r8, [rbp - 0x10]
mov rcx, rsi
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntdll.dll_RtlGetControlSecurityDescriptor]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
jns 0x18000e277
mov word [rbp - 0x38], r11w
test r14, r14
je 0x18000e2a1
lea r8, [rbp - 0x10]
mov rcx, r14
lea rdx, [rbp - 0x3c]
call qword [sym.imp.ntdll.dll_RtlGetControlSecurityDescriptor]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
js 0x18000e2a1
movzx r10d, word [rbp - 0x3c]
jmp 0x18000e2a9
mov r10d, r11d
mov word [rbp - 0x3c], r11w
movzx r9d, word [rbp - 0x38]
mov eax, 0x1000
movzx ecx, r9w
movzx edx, r10w
and cx, ax
and dx, ax
movzx eax, cx
mov r13d, r11d
sub ax, dx
mov edi, 1
neg ax
sbb al, al
and al, 0x40
movzx r8d, al
mov eax, 0x2000
and r10w, ax
and r9w, ax
cmp cx, dx
mov al, r8b
setne r13b
cmp r9w, r10w
cmovne r13d, edi
or al, 0x80
cmp r9w, r10w
movzx ebx, al
cmove ebx, r8d
mov dword [rbp - 0x20], ebx
test byte [rbp + 0x60], dil
je 0x18000e396
test rsi, rsi
je 0x18000e336
lea r8, [rbp - 0x40]
mov rcx, rsi
lea rdx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlGetOwnerSecurityDescriptor]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
jns 0x18000e33a
mov qword [rbp - 0x18], r11
test r14, r14
je 0x18000e363
lea r8, [rbp - 0x40]
mov rcx, r14
lea rdx, [rbp - 8]
call qword [sym.imp.ntdll.dll_RtlGetOwnerSecurityDescriptor]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
js 0x18000e363
mov rdx, qword [rbp - 8]
jmp 0x18000e36a
mov rdx, r11
mov qword [rbp - 8], rdx
cmp qword [rbp - 0x18], r11
jne 0x18000e377
test rdx, rdx
jne 0x18000e393
jmp 0x18000e396
test rdx, rdx
je 0x18000e393
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
jne 0x18000e396
mov r13d, edi
mov cl, byte [rbp - 0x20]
shr cl, 6
test byte [rbp + 0x60], 4
not cl
setne al
and cl, al
test dil, cl
je 0x18000e456
test rsi, rsi
je 0x18000e3dd
lea r9, [rbp - 0x40]
mov rcx, rsi
lea r8, [rbp - 0x28]
lea rdx, [rbp + 0x68]
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
js 0x18000e3dd
cmp byte [rbp + 0x68], r11b
jne 0x18000e3e1
mov qword [rbp - 0x28], r11
test r14, r14
je 0x18000e414
lea r9, [rbp - 0x40]
mov rcx, r14
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x68]
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
js 0x18000e414
cmp byte [rbp + 0x68], r11b
je 0x18000e414
mov r9, qword [rbp - 0x30]
jmp 0x18000e41b
mov r9, r11
mov qword [rbp - 0x30], r11
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x34]
mov edx, dword [rbp + 0x48]
mov ecx, dword [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x34], r11d
call fcn.18000dff4
xor r11d, r11d
mov r12d, eax
test eax, eax
jne 0x18000e523
mov eax, dword [rbp - 0x20]
mov bl, al
cmp dword [rbp - 0x34], r11d
je 0x18000e456
mov r13d, edi
or bl, 0x40
mov cl, bl
not cl
shr cl, 7
test byte [rbp + 0x60], 8
setne al
test al, cl
je 0x18000e511
mov qword [rbp - 0x28], r11
mov qword [rbp - 0x30], r11
test rsi, rsi
je 0x18000e4a1
lea r9, [rbp - 0x40]
mov rcx, rsi
lea r8, [rbp - 0x28]
lea rdx, [rbp + 0x68]
call qword [sym.imp.ntdll.dll_RtlGetSaclSecurityDescriptor]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
js 0x18000e4a1
cmp byte [rbp + 0x68], r11b
jne 0x18000e4a5
mov qword [rbp - 0x28], r11
test r14, r14
je 0x18000e4d8
lea r9, [rbp - 0x40]
mov rcx, r14
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x68]
call qword [sym.imp.ntdll.dll_RtlGetSaclSecurityDescriptor]
nop dword [rax + rax]
xor r11d, r11d
test eax, eax
js 0x18000e4d8
cmp byte [rbp + 0x68], r11b
je 0x18000e4d8
mov r9, qword [rbp - 0x30]
jmp 0x18000e4df
mov r9, r11
mov qword [rbp - 0x30], r11
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x34]
mov edx, dword [rbp + 0x48]
mov ecx, dword [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x34], r11d
call fcn.18000dff4
xor r11d, r11d
mov r12d, eax
test eax, eax
jne 0x18000e523
cmp dword [rbp - 0x34], r11d
je 0x18000e511
mov r13d, edi
or bl, 0x80
test r13d, r13d
je 0x18000e523
mov byte [r15], dil
test bl, bl
je 0x18000e523
or bl, dil
mov byte [r15], bl
mov eax, r12d
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret