Function at 0x18005e9a8
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r12d, r12d
mov r15d, r8d
mov qword [rbp - 0x10], r12
mov rdi, rdx
mov qword [rbp - 8], r12
mov rsi, rcx
mov byte [rbp + 0x58], r12b
mov r14d, r12d
mov qword [rbp - 0x18], r12
lea r13d, [r12 + 1]
mov byte [rbp + 0x40], r13b
mov bl, r12b
mov qword [rbp - 0x20], r12
mov word [rbp - 0x2c], r12w
mov word [rbp - 0x30], r12w
mov dword [rbp - 0x28], r12d
test rcx, rcx
jne 0x18005ea0e
test rdx, rdx
jne 0x18005ea26
mov eax, r13d
jmp 0x18005ec15
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x2c]
call qword [sym.imp.ntdll.dll_RtlGetControlSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
jns 0x18005ea2b
mov word [rbp - 0x2c], r12w
test rdi, rdi
je 0x18005ea4b
lea r8, [rbp - 0x28]
mov rcx, rdi
lea rdx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_RtlGetControlSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
jns 0x18005ea50
mov word [rbp - 0x30], r12w
test r13b, r15b
je 0x18005eacf
test rsi, rsi
je 0x18005ea75
lea r8, [rbp + 0x58]
mov rcx, rsi
lea rdx, [rbp - 0x10]
call qword [sym.imp.ntdll.dll_RtlGetOwnerSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
jns 0x18005ea79
mov qword [rbp - 0x10], r12
test rdi, rdi
je 0x18005ea9f
lea r8, [rbp + 0x58]
mov rcx, rdi
lea rdx, [rbp - 8]
call qword [sym.imp.ntdll.dll_RtlGetOwnerSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
js 0x18005ea9f
mov rdx, qword [rbp - 8]
jmp 0x18005eaa6
mov rdx, r12
mov qword [rbp - 8], rdx
cmp qword [rbp - 0x10], r12
jne 0x18005eab3
test rdx, rdx
jne 0x18005eacc
jmp 0x18005eacf
test rdx, rdx
je 0x18005eacc
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
jne 0x18005eacf
mov r14d, r13d
test r15b, 4
je 0x18005eb62
movzx eax, word [rbp - 0x30]
mov ecx, 0x1000
xor ax, word [rbp - 0x2c]
test cx, ax
jne 0x18005eb5d
test rsi, rsi
je 0x18005eb15
lea r9, [rbp + 0x58]
mov rcx, rsi
lea r8, [rbp - 0x18]
lea rdx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
js 0x18005eb15
cmp byte [rbp + 0x40], r12b
jne 0x18005eb19
mov qword [rbp - 0x18], r12
test rdi, rdi
je 0x18005eb49
lea r9, [rbp + 0x58]
mov rcx, rdi
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
js 0x18005eb49
cmp byte [rbp + 0x40], r12b
je 0x18005eb49
mov rdx, qword [rbp - 0x20]
jmp 0x18005eb50
mov rdx, r12
mov qword [rbp - 0x20], rdx
mov rcx, qword [rbp - 0x18]
call fcn.18005e93c
test eax, eax
je 0x18005eb62
mov bl, 0x40
mov r14d, r13d
test r15b, 8
je 0x18005ec06
movzx eax, word [rbp - 0x30]
mov ecx, 0x2000
xor ax, word [rbp - 0x2c]
test cx, ax
je 0x18005eb86
or bl, 0x80
jmp 0x18005ec0b
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x20], r12
test rsi, rsi
je 0x18005ebb8
lea r9, [rbp + 0x58]
mov rcx, rsi
lea r8, [rbp - 0x18]
lea rdx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_RtlGetSaclSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
js 0x18005ebb8
cmp byte [rbp + 0x40], r12b
jne 0x18005ebbc
mov qword [rbp - 0x18], r12
test rdi, rdi
je 0x18005ebec
lea r9, [rbp + 0x58]
mov rcx, rdi
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_RtlGetSaclSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
js 0x18005ebec
cmp byte [rbp + 0x40], r12b
je 0x18005ebec
mov rdx, qword [rbp - 0x20]
jmp 0x18005ebf3
mov rdx, r12
mov qword [rbp - 0x20], rdx
mov rcx, qword [rbp - 0x18]
call fcn.18005e93c
test eax, eax
je 0x18005ec06
mov r14d, r13d
or bl, 0x80
test r14d, r14d
je 0x18005ec13
movzx eax, bl
or eax, r13d
jmp 0x18005ec15
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret