Function at 0x14000ec7c
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x14002a288]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, r9d
mov r14, rdx
mov r15, rcx
test rcx, rcx
jne 0x14000ecd2
mov edx, 0x1c9
mov rcx, qword [rbp + 0x5f]
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibusercontexthelpers_onecore.cpp
mov ebx, 0x80070057
mov r9d, ebx
call fcn.140002c38
jmp 0x14000eed2
test r14, r14
jne 0x14000ecde
mov edx, 0x1ca
jmp 0x14000ecb5
and qword [rbp - 0x31], 0
lea rcx, [rbp - 0x11]
and qword [rbp - 0x29], 0
xor edx, edx
lea r8d, [rdx + 0x38]
call sub.msvcrt.dll_memset
and dword [rbp - 0x39], 0
lea rax, [rbp + 0x1f]
and qword [rbp - 0x19], 0
xor edx, edx
mov rcx, r15
mov qword [rbp - 0x21], rax
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
mov rcx, rax
xor r9d, r9d
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x31]
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
and qword [rsp + 0x20], 0
lea r8d, [r9 + 4]
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_GetNamedSecurityInfoW]
test eax, eax
je 0x14000ed53
mov edx, 0x1ef
jmp 0x14000ee9b
mov rcx, qword [rbp - 0x31]
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x39]
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_GetExplicitEntriesFromAclW]
test eax, eax
je 0x14000ed73
mov edx, 0x1f7
jmp 0x14000ee9b
mov ecx, dword [rbp - 0x39]
xor edi, edi
test ecx, ecx
je 0x14000ee14
lea rbx, [rdi + rdi*2]
shl rbx, 4
add rbx, qword [rbp - 0x29]
cmp dword [rbx + 0x1c], 0
jne 0x14000ed98
mov rdx, qword [rbx + 0x28]
jmp 0x14000eda6
cmp dword [rbx + 0x1c], 3
jne 0x14000ee0a
mov rax, qword [rbx + 0x28]
mov rdx, qword [rax + 0x28]
test rdx, rdx
je 0x14000ee0a
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x14000ee07
cmp dword [rbx + 4], 1
jne 0x14000ee07
mov r8d, dword [rbx]
mov ecx, esi
btr ecx, 0x1f
mov eax, r8d
test r8d, r8d
cmovns ecx, esi
mov edx, ecx
btr edx, 0x1d
and eax, 0x20000000
mov eax, r8d
cmove edx, ecx
mov ecx, edx
btr ecx, 0x1e
and eax, 0x40000000
cmove ecx, edx
mov esi, ecx
btr esi, 0x1c
and r8d, 0x10000000
cmove esi, ecx
test esi, esi
je 0x14000eeb2
mov ecx, dword [rbp - 0x39]
inc edi
cmp edi, ecx
jb 0x14000ed80
test esi, esi
je 0x14000eeb2
mov r8, qword [rbp - 0x31]
lea r9, [rbp - 0x21]
and dword [rbp + 0xb], 0
lea rdx, [rbp - 0x11]
mov ecx, 1
mov dword [rbp - 0x11], esi
mov dword [rbp - 0xd], 2
mov dword [rbp - 9], 3
mov dword [rbp + 0xf], 5
mov qword [rbp + 0x17], r14
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_SetEntriesInAclW]
test eax, eax
je 0x14000ee5e
mov edx, 0x23b
jmp 0x14000ee9b
xor edx, edx
mov rcx, r15
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, rax
mov rax, qword [rbp - 0x21]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_SetNamedSecurityInfoW]
test eax, eax
je 0x14000eeb2
mov edx, 0x245
mov rcx, qword [rbp + 0x5f]
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibusercontexthelpers_onecore.cpp
mov r9d, eax
call fcn.14000d2e8
mov ebx, eax
jmp 0x14000eeb4
xor ebx, ebx
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14000eec3
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14000eed2
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14001ae30
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret