Function at 0x18000f2a0
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15d, dword [rsp + 0xf0]
xor esi, esi
xor edi, edi
mov r13, r9
mov r14d, r8d
mov rbp, rdx
mov qword [rdx], rsi
mov r12, rcx
test rcx, rcx
jne 0x18000f2ea
lea esi, [rcx + 1]
jmp 0x18000f373
xor eax, eax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x6c], 8
mov dword [rsp + 0x68], eax
test r8d, r8d
je 0x18000f329
lea r9d, [rax + 2]
lea r8d, [rax + 0xc]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov edi, eax
test eax, eax
jne 0x18000f329
lea esi, [rax + 2]
jmp 0x18000f355
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [rsp + 0x6c]
lea ebx, [rax + rcx + 8]
mov ecx, ebx
call fcn.18003783c
mov qword [rbp], rax
test rax, rax
jne 0x18000f3e2
lea esi, [rax + 3]
test edi, edi
jne 0x18000f36b
mov rcx, qword [rbp]
test rcx, rcx
je 0x18000f36b
call fcn.180038270
mov qword [rbp], 0
mov rbx, qword [rsp + 0x88]
cmp dword [0x1801161a0], 0
je 0x18000f3c0
mov rax, qword [rbp]
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, str.CKSecurity::CopyAcl_____Inner___ret:__d___myerror:__d___SrcAcl:__08x___DstAcl:__08x___b:__08x___Sid:__08x___Mask:__08x_
lea r8, [0x1800c48d8]
lea rcx, [0x1801160e8]
mov edx, 0xf
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call fcn.180011c50
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180036980
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
mov edx, ebx
lea r8d, [rcx + 2]
mov dword [rax], ecx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov edi, eax
test eax, eax
jne 0x18000f404
lea esi, [rax + 4]
jmp 0x18000f355
xor ebx, ebx
mov qword [rsp + 0x60], rsi
test r14d, r14d
je 0x18000f486
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x18000f486
nop dword [rax + rax]
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_GetAce]
mov edi, eax
test eax, eax
je 0x18000f4b3
mov rdx, qword [rsp + 0x60]
test byte [rdx + 1], 0x10
jne 0x18000f486
add rdx, 8
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x18000f47e
mov r9, qword [rsp + 0x60]
mov rcx, qword [rbp]
or r8d, 0xffffffff
movzx eax, word [r9 + 2]
mov edx, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AddAce]
mov edi, eax
test eax, eax
je 0x18000f4a9
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x18000f420
mov rcx, qword [rbp]
mov r9, r13
mov r8d, r15d
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
mov edi, eax
test eax, eax
jne 0x18000f4bd
lea esi, [rax + 7]
jmp 0x18000f355
mov esi, 6
jmp 0x18000f355
mov esi, 5
jmp 0x18000f355
test r14d, r14d
je 0x18000f351
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x18000f351
cmp ebx, eax
jae 0x18000f351
nop word [rax + rax]
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_GetAce]
mov edi, eax
test eax, eax
je 0x18000f539
mov r9, qword [rsp + 0x60]
mov rcx, qword [rbp]
or r8d, 0xffffffff
movzx eax, word [r9 + 2]
mov edx, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AddAce]
mov edi, eax
test eax, eax
je 0x18000f52f
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x18000f4e0
jmp 0x18000f351
mov esi, 9
jmp 0x18000f355
mov esi, 8
jmp 0x18000f355