Function at 0x180017cf0
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15d, dword [rsp + 0xf0]
xor esi, esi
xor edi, edi
mov r13, r9
mov r14d, r8d
mov rbp, rdx
mov qword [rdx], rsi
mov r12, rcx
test rcx, rcx
jne 0x180017d3a
lea esi, [rcx + 1]
jmp 0x180017dc3
xor eax, eax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x6c], 8
mov dword [rsp + 0x68], eax
test r8d, r8d
je 0x180017d79
lea r9d, [rax + 2]
lea r8d, [rax + 0xc]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov edi, eax
test eax, eax
jne 0x180017d79
lea esi, [rax + 2]
jmp 0x180017da5
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [rsp + 0x6c]
lea ebx, [rax + rcx + 8]
mov ecx, ebx
call fcn.18006f3c0
mov qword [rbp], rax
test rax, rax
jne 0x180017e30
lea esi, [rax + 3]
test edi, edi
jne 0x180017dbb
mov rcx, qword [rbp]
test rcx, rcx
je 0x180017dbb
call fcn.18006f310
mov qword [rbp], 0
mov rbx, qword [rsp + 0x88]
cmp dword [0x180153b70], 0
je 0x180017e0e
mov rax, qword [rbp]
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, str.CKSecurity::CopyAcl_____Inner___ret:__d___myerror:__d___SrcAcl:__08x___DstAcl:__08x___b:__08x___Sid:__08x___Mask:__08x_
lea r8, [0x1800e5490]
lea rcx, [0x180153288]
or edx, 0xffffffff
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call fcn.18006d360
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
mov edx, ebx
lea r8d, [rcx + 2]
mov dword [rax], ecx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov edi, eax
test eax, eax
jne 0x180017e52
lea esi, [rax + 4]
jmp 0x180017da5
xor ebx, ebx
mov qword [rsp + 0x60], rsi
test r14d, r14d
je 0x180017ed6
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180017ed6
nop word [rax + rax]
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_GetAce]
mov edi, eax
test eax, eax
je 0x180017f03
mov rdx, qword [rsp + 0x60]
test byte [rdx + 1], 0x10
jne 0x180017ed6
add rdx, 8
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x180017ece
mov r9, qword [rsp + 0x60]
mov rcx, qword [rbp]
or r8d, 0xffffffff
movzx eax, word [r9 + 2]
mov edx, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AddAce]
mov edi, eax
test eax, eax
je 0x180017ef9
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x180017e70
mov rcx, qword [rbp]
mov r9, r13
mov r8d, r15d
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
mov edi, eax
test eax, eax
jne 0x180017f0d
lea esi, [rax + 7]
jmp 0x180017da5
mov esi, 6
jmp 0x180017da5
mov esi, 5
jmp 0x180017da5
test r14d, r14d
je 0x180017da1
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180017da1
cmp ebx, eax
jae 0x180017da1
nop word [rax + rax]
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_GetAce]
mov edi, eax
test eax, eax
je 0x180017f89
mov r9, qword [rsp + 0x60]
mov rcx, qword [rbp]
or r8d, 0xffffffff
movzx eax, word [r9 + 2]
mov edx, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AddAce]
mov edi, eax
test eax, eax
je 0x180017f7f
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x180017f30
jmp 0x180017da1
mov esi, 9
jmp 0x180017da5
mov esi, 8
jmp 0x180017da5