Function at 0x18000fd80
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1800e7b20]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15d, dword [rsp + 0xf0]
xor esi, esi
xor edi, edi
mov r13, r9
mov r14d, r8d
mov rbp, rdx
mov qword [rdx], rsi
mov r12, rcx
test rcx, rcx
jne 0x18000fdca
lea esi, [rcx + 1]
jmp 0x18000fe53
xor eax, eax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x6c], 8
mov dword [rsp + 0x68], eax
test r8d, r8d
je 0x18000fe09
lea r9d, [rax + 2]
lea r8d, [rax + 0xc]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov edi, eax
test eax, eax
jne 0x18000fe09
lea esi, [rax + 2]
jmp 0x18000fe35
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [rsp + 0x6c]
lea ebx, [rax + rcx + 8]
mov ecx, ebx
call fcn.180039e84
mov qword [rbp], rax
test rax, rax
jne 0x18000fec0
lea esi, [rax + 3]
test edi, edi
jne 0x18000fe4b
mov rcx, qword [rbp]
test rcx, rcx
je 0x18000fe4b
call fcn.1800390b8
mov qword [rbp], 0
mov rbx, qword [rsp + 0x88]
cmp dword [0x1801030e0], 0
je 0x18000fe9e
mov rax, qword [rbp]
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, str.CKSecurity::CopyAcl_____Inner___ret:__d___myerror:__d___SrcAcl:__08x___DstAcl:__08x___b:__08x___Sid:__08x___Mask:__08x_
lea r8, [0x1800b2d18]
lea rcx, [0x1801027f8]
or edx, 0xffffffff
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call fcn.180072a80
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180038100
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
mov edx, ebx
lea r8d, [rcx + 2]
mov dword [rax], ecx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov edi, eax
test eax, eax
jne 0x18000fee2
lea esi, [rax + 4]
jmp 0x18000fe35
xor ebx, ebx
mov qword [rsp + 0x60], rsi
test r14d, r14d
je 0x18000ff66
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x18000ff66
nop word [rax + rax]
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_GetAce]
mov edi, eax
test eax, eax
je 0x18000ff93
mov rdx, qword [rsp + 0x60]
test byte [rdx + 1], 0x10
jne 0x18000ff66
add rdx, 8
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x18000ff5e
mov r9, qword [rsp + 0x60]
mov rcx, qword [rbp]
or r8d, 0xffffffff
movzx eax, word [r9 + 2]
mov edx, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AddAce]
mov edi, eax
test eax, eax
je 0x18000ff89
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x18000ff00
mov rcx, qword [rbp]
mov r9, r13
mov r8d, r15d
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
mov edi, eax
test eax, eax
jne 0x18000ff9d
lea esi, [rax + 7]
jmp 0x18000fe35
mov esi, 6
jmp 0x18000fe35
mov esi, 5
jmp 0x18000fe35
test r14d, r14d
je 0x18000fe31
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x18000fe31
cmp ebx, eax
jae 0x18000fe31
nop word [rax + rax]
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_GetAce]
mov edi, eax
test eax, eax
je 0x180010019
mov r9, qword [rsp + 0x60]
mov rcx, qword [rbp]
or r8d, 0xffffffff
movzx eax, word [r9 + 2]
mov edx, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AddAce]
mov edi, eax
test eax, eax
je 0x18001000f
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x18000ffc0
jmp 0x18000fe31
mov esi, 9
jmp 0x18000fe35
mov esi, 8
jmp 0x18000fe35