Function at 0x1600d3f78
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov qword [rax - 0x280], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x80], rcx
xor r14d, r14d
and dword [rdx + 0x18], r14d
mov edx, 0xdebaca99
mov rcx, rdi
call fcn.1600d25ec
lea r9d, [r14 + 2]
lea r8d, [r14 + 0xc]
lea rdx, [rsp + 0x98]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
test eax, eax
jne 0x1600d4002
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1600d3ffd
movzx eax, ax
or eax, 0x80070000
jmp 0x1600d43dd
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
test eax, eax
jne 0x1600d4035
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1600d4030
movzx eax, ax
or eax, 0x80070000
jmp 0x1600d43dd
mov edx, dword [rsp + 0x98]
mov rcx, rdi
call fcn.1600d25ec
mov edx, dword [rsp + 0x48]
mov rcx, rdi
call fcn.1600d25ec
lea rcx, [rsp + 0x40]
call fcn.160060330
nop
lea rcx, [rsp + 0x38]
call fcn.16006035c
nop
lea rcx, [rsp + 0x30]
call fcn.1600d2460
nop
lea rcx, [rsp + 0x28]
call fcn.1600d248c
nop
mov rcx, rbx
call fcn.1600d33c0
mov dword [rsp + 0x24], eax
xor r12d, r12d
mov dword [rsp + 0x20], r12d
cmp r12d, eax
jae 0x1600d4393
lea r8, [rsp + 0x50]
mov edx, r12d
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
jne 0x1600d4109
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1600d40c3
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1600d40d3
call fcn.160031c48
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1600d40e3
call fcn.160031c48
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1600d40f3
call fcn.160031c48
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1600d4102
call fcn.160031c48
mov eax, ebx
jmp 0x1600d43dd
mov rbx, qword [rsp + 0x50]
movzx edx, byte [rbx]
mov rcx, rdi
call fcn.1600d25ec
movzx edx, byte [rbx + 1]
mov rcx, rdi
call fcn.1600d25ec
movzx ecx, byte [rbx]
test ecx, ecx
je 0x1600d4143
cmp ecx, 1
jne 0x1600d415c
mov rbx, qword [rsp + 0x50]
mov edx, dword [rbx + 4]
mov rcx, rdi
call fcn.1600d25ec
jmp 0x1600d4153
mov rbx, qword [rsp + 0x50]
mov edx, dword [rbx + 4]
mov rcx, rdi
call fcn.1600d25ec
lea r15, [rbx + 8]
test r15, r15
jne 0x1600d41a5
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1600d416c
call fcn.160031c48
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1600d417c
call fcn.160031c48
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1600d418c
call fcn.160031c48
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1600d419b
call fcn.160031c48
mov eax, 0x8000ffff
jmp 0x1600d43dd
and qword [rsp + 0x60], 0
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.1600603a8
nop
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x1600d41d4
xor edx, edx
jmp 0x1600d4204
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x1600d41ed
mov edx, 1
jmp 0x1600d4204
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x1600d4209
mov edx, 2
mov rcx, rdi
jmp 0x1600d4223
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
mov rcx, rdi
test eax, eax
je 0x1600d422d
mov edx, 4
call fcn.1600d25ec
jmp 0x1600d4372
mov edx, 6
call fcn.1600d25ec
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x68], rax
and qword [rsp + 0x70], 0
mov byte [rsp + 0x78], 1
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
mov dword [rsp + 0x4c], eax
cmp byte [rsp + 0x78], 0
je 0x1600d4291
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
mov rcx, qword [r13]
cmp r12, rcx
je 0x1600d4291
test rcx, rcx
je 0x1600d428d
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [rsp + 0x4c]
mov qword [r13], r12
test eax, eax
je 0x1600d4345
lea rax, [0x1601bbdf0]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc0], 0x100
or r8d, 0xffffffff
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xb0]
call fcn.160034fa0
lea rax, str._4_r_
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call fcn.1600d2568
mov rcx, r15
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
mov r12d, eax
mov edx, eax
mov rcx, rdi
call fcn.1600d25ec
mov r13d, dword [rdi + 8]
add r13d, r12d
mov edx, r13d
mov rcx, rdi
call fcn.1600c6488
mov r8d, r12d
mov ecx, dword [rdi + 8]
add rcx, qword [rdi + 0x10]
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov dword [rdi + 8], r13d
lea rcx, [rsp + 0xb0]
call fcn.1600d24f4
jmp 0x1600d435d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test eax, eax
jle 0x1600d435d
movzx r14d, ax
or r14d, 0x80070000
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1600d436d
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov r12d, dword [rsp + 0x20]
test rbx, rbx
je 0x1600d437f
mov rcx, rbx
call fcn.160031c48
inc r12d
mov rbx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x24]
jmp 0x1600d408b
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1600d43a3
call fcn.160031c48
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1600d43b3
call fcn.160031c48
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1600d43c3
call fcn.160031c48
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1600d43d3
call fcn.160031c48
nop
jmp 0x1600d43da
mov eax, r14d
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x320]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
ret