Function at 0x140001ea0
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400c77d8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, r8
lea r9, [rsp + 0x48]
mov r14, rdx
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetSecurityDescriptorDacl]
nop dword [rax + rax]
test eax, eax
jne 0x140001ef4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x1400021e7
cmp dword [rsp + 0x30], 0
je 0x140001f0a
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x140001f14
call fcn.14000e9d8
mov ebx, 0x57
jmp 0x1400021e7
mov r9d, 2
lea rdx, [rsp + 0x58]
lea r8d, [r9 + 0xa]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
nop dword [rax + rax]
test eax, eax
je 0x140001ee1
mov qword [rsp + 0x88], rbp
xor ebx, ebx
mov qword [rsp + 0x80], rsi
xor esi, esi
mov qword [rsp + 0x78], rdi
xor edi, edi
mov qword [rsp + 0x70], r12
cmp dword [rsp + 0x58], ebx
jbe 0x1400021c8
lea r12d, [rsi + 1]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x50]
mov edx, edi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
nop dword [rax + rax]
test eax, eax
je 0x1400021b8
mov rax, qword [rsp + 0x50]
cmp byte [rax], 0
jne 0x140001fd6
mov rdx, qword [0x1400c9098]
lea rbp, [rax + 8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x140001fae
mov esi, r12d
jmp 0x140001fce
mov rdx, qword [0x1400c9090]
mov rcx, rbp
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
cmovne ebx, r12d
test esi, esi
je 0x140001fd6
test ebx, ebx
jne 0x1400021c8
inc edi
cmp edi, dword [rsp + 0x58]
jb 0x140001f61
test esi, esi
je 0x1400021c8
test ebx, ebx
jne 0x1400021c8
mov rcx, qword [0x1400c9090]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov edi, dword [rsp + 0x5c]
mov ebx, 8
mov rcx, qword [0x1400c9078]
add edi, 0xc
add edi, eax
mov edx, ebx
mov r8d, edi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140002079
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x1400021cd
test byte [rcx + 0x44], 0x20
je 0x1400021cd
mov rcx, qword [rcx + 0x38]
lea edx, [rbx + 2]
mov r9d, edi
lea r8, [0x1400aa8c0]
call fcn.14001635c
jmp 0x1400021cd
mov r8d, 2
mov edx, edi
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeAcl]
nop dword [rax + rax]
test eax, eax
je 0x140002190
xor ebx, ebx
cmp dword [rsp + 0x58], ebx
jbe 0x140002157
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
nop dword [rax + rax]
test eax, eax
je 0x140002190
mov r9, qword [rsp + 0x40]
mov edx, 2
mov r8d, 0xffffffff
mov rcx, rsi
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAce]
nop dword [rax + rax]
test eax, eax
je 0x140002190
mov rdi, qword [rsp + 0x40]
cmp byte [rdi], 0
jne 0x14000214b
mov rdx, qword [0x1400c9098]
lea rcx, [rdi + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x14000214b
mov rax, qword [rsp + 0x40]
mov edx, 2
mov r9d, dword [rdi + 4]
mov rcx, rsi
movzx r8d, byte [rax + 1]
mov rax, qword [0x1400c9090]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAccessAllowedAceEx]
nop dword [rax + rax]
test eax, eax
je 0x140002190
inc ebx
cmp ebx, dword [rsp + 0x58]
jb 0x1400020a4
mov edx, r12d
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
je 0x140002190
xor r9d, r9d
mov r8, rsi
mov edx, r12d
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorDacl]
nop dword [rax + rax]
test eax, eax
je 0x140002190
mov qword [r15], rsi
xor ebx, ebx
jmp 0x1400021cd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x1400c9078]
mov r8, rsi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
jmp 0x1400021cd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x1400021cd
mov ebx, 0xb7
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x70]
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000d4b0
add rsp, 0x90
pop r15
pop r14
pop rbx
ret