Function at 0x1400c8b54
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x190
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14015d3e0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r12, rdx
mov r13, rcx
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssSidCollection::IsSidAllowedToFire
mov qword [rsp + 0x50], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x6e5
mov dword [rsp + 0x64], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x68], 0xff
xor r15d, r15d
mov dword [rbp - 0x18], 0x1000000
lea ebx, [r15 + 1]
xor edx, edx
lea r8d, [r15 + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.1400bec34
nop
xor eax, eax
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x78], eax
mov qword [rsp + 0x30], r15
mov sil, r15b
mov dil, r15b
lea r9d, [r15 + 2]
lea r8d, [r15 + 0xc]
lea rdx, [rbp + 0x70]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
nop dword [rax + rax]
mov r14d, r15d
mov eax, dword [rbp + 0x70]
test eax, eax
je 0x1400c8e4b
lea r8, [rsp + 0x30]
mov edx, r15d
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
nop dword [rax + rax]
mov r9, qword [rsp + 0x30]
movzx ecx, byte [r9]
test ecx, ecx
je 0x1400c8dff
cmp ecx, 1
jne 0x1400c8e3c
test r14d, r14d
jne 0x1400c8de5
lea rdx, [r9 + 8]
mov rcx, r12
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400c8e3c
mov sil, bl
mov edx, dword [rbp + 0x24]
lea rcx, [rbp]
call fcn.14000473c
xor r13d, r13d
test eax, eax
je 0x1400c8d95
mov qword [rsp + 0x40], r13
lea rax, [0x1400f6248]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.1400313a4
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
je 0x1400c8d8b
test dil, dil
je 0x1400c8cf5
test sil, sil
lea r15, str.allowed
je 0x1400c8cfc
lea r15, str.denied
test dil, dil
jne 0x1400c8d0d
test sil, sil
lea r14, str.implicitely
je 0x1400c8d14
lea r14, str.explicitely
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssSidCollection::IsSidAllowedToFire
mov qword [rsp + 0x50], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x73f
mov dword [rsp + 0x64], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x40]
lea r8, str.WriterSid:__s_was__s__s_to_fire
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.140009fb0
lea rcx, [rsp + 0x38]
call fcn.14002e4c8
test dil, dil
je 0x1400c8d9f
test sil, sil
je 0x1400c8da2
mov bl, r13b
mov dl, bl
lea rcx, [rbp]
call fcn.140031dac
mov bl, al
lea rcx, [rbp]
call fcn.140009990
mov al, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400164a0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
add r9, 8
mov r8, r12
lea rdx, [rbp]
mov rcx, r13
call fcn.1400c7218
test al, al
jmp 0x1400c8c8d
test r14d, r14d
jne 0x1400c8e20
lea rdx, [r9 + 8]
mov rcx, r12
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400c8e3c
mov dil, bl
jmp 0x1400c8e3c
add r9, 8
mov r8, r12
lea rdx, [rbp]
mov rcx, r13
call fcn.1400c7218
movzx edi, dil
test al, al
cmovne edi, ebx
add r15d, ebx
mov eax, dword [rbp + 0x70]
cmp r15d, eax
jb 0x1400c8c3d
add r14d, ebx
cmp r14d, 2
jae 0x1400c8c96
xor r15d, r15d
jmp 0x1400c8c35