Function at 0x4135f0
Capabilities:
Compare security identifiers

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor ebx, ebx
xor eax, eax
mov qword [rbp + 0x60], rbx
mov r12, rcx
mov dword [rbp + 0x50], ebx
mov r13d, ebx
mov dword [rbp + 0x48], ebx
mov dword [rbp + 0x58], ebx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x10], eax
mov qword [rbp - 0x38], rbx
test rcx, rcx
je 0x41369d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x60]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41369d
mov rcx, qword [rbp + 0x60]
lea rax, [rbp + 0x50]
lea esi, [rbx + 2]
mov qword [rsp + 0x20], rax
mov edx, esi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x413679
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41369d
mov ecx, dword [rbp + 0x50]
lea r15, [0x0047b0a0]
mov rdx, r15
call fcn.0042267c
mov rcx, qword [rbp + 0x60]
mov rdi, rax
test rax, rax
jne 0x4136b0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9d, dword [rbp + 0x50]
lea rax, [rbp + 0x50]
mov r8, rdi
mov qword [rsp + 0x20], rax
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4136da
mov rcx, rdi
call fcn.00422660
mov rcx, qword [rbp + 0x60]
jmp 0x413697
mov rcx, qword [rbp + 0x60]
lea rax, [rbp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea r14d, [r9 + 1]
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x413709
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4136cc
mov ecx, dword [rbp + 0x50]
mov rdx, r15
call fcn.0042267c
mov qword [rbp - 0x28], rax
mov rsi, rax
test rax, rax
je 0x4136cc
mov r9d, dword [rbp + 0x50]
lea rax, [rbp + 0x50]
mov rcx, qword [rbp + 0x60]
mov r8, rsi
mov edx, r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x41374e
mov rcx, rdi
call fcn.00422660
mov rcx, rsi
jmp 0x4136cf
xor r9d, r9d
lea rax, [rbp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r12
lea edx, [r9 + 7]
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x413779
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x413741
mov ecx, dword [rbp + 0x50]
mov rdx, r15
call fcn.0042267c
mov qword [rbp - 0x20], rax
mov r15, rax
test rax, rax
je 0x413741
mov r9d, dword [rbp + 0x50]
lea rax, [rbp + 0x50]
mov r8, r15
mov qword [rsp + 0x20], rax
mov edx, 7
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x4137ca
mov rcx, rdi
call fcn.00422660
mov rcx, rsi
call fcn.00422660
mov rcx, r15
jmp 0x4136cf
lea r9, [rbp + 0x58]
mov rcx, r15
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x413809
mov rcx, qword [rbp - 0x30]
test rcx, rcx
jne 0x4137f1
mov bl, r14b
jmp 0x413809
mov r9d, 2
lea rdx, [rbp - 0x18]
lea r8d, [r9 + 0xa]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x413832
mov rcx, rdi
call fcn.00422660
mov rcx, rsi
call fcn.00422660
mov rcx, r15
call fcn.00422660
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x41369f
mov r12d, ebx
cmp dword [rbp - 0x18], ebx
jbe 0x41391e
mov rcx, qword [rbp - 0x30]
lea r8, [rbp - 0x38]
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x41390d
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x41390d
cmp byte [rcx], r14b
jne 0x4138c0
mov rdx, qword [rsi]
add rcx, 8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp - 0x38]
test eax, eax
je 0x413887
mov eax, dword [rbp + 0x48]
or eax, dword [rcx + 4]
mov dword [rbp + 0x48], eax
mov r15d, ebx
cmp dword [rdi], ebx
jbe 0x4138c0
mov esi, dword [rbp + 0x48]
mov edx, r15d
add rcx, 8
add rdx, rdx
mov rdx, qword [rdi + rdx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp - 0x38]
test eax, eax
je 0x4138b1
or esi, dword [rcx + 4]
add r15d, r14d
cmp r15d, dword [rdi]
jb 0x413891
mov dword [rbp + 0x48], esi
mov rsi, qword [rbp - 0x28]
cmp byte [rcx], bl
jne 0x41390d
mov rdx, qword [rsi]
add rcx, 8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp - 0x38]
test eax, eax
je 0x4138dd
or r13d, dword [rcx + 4]
mov r15d, ebx
cmp dword [rdi], ebx
jbe 0x41390d
mov edx, r15d
add rcx, 8
add rdx, rdx
mov rdx, qword [rdi + rdx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp - 0x38]
test eax, eax
je 0x413905
or r13d, dword [rcx + 4]
add r15d, r14d
cmp r15d, dword [rdi]
jb 0x4138e4
add r12d, r14d
cmp r12d, dword [rbp - 0x18]
jb 0x41383e
mov r15, qword [rbp - 0x20]
mov rcx, rdi
call fcn.00422660
mov rcx, rsi
call fcn.00422660
mov rcx, r15
call fcn.00422660
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1201b6
and r13d, eax
cmp r13d, eax
jne 0x413952
test dword [rbp + 0x48], eax
je 0x413955
mov r14b, bl
mov al, r14b
jmp 0x41369f