Function at 0x1400b9e20
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
lea rbp, [r11 - 0x5f]
sub rsp, 0xa8
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x17], rax
cmp qword [rdx + 0x10], 0
mov rdi, r8
mov r14, rdx
mov rsi, rcx
je 0x1400ba0fd
cmp qword [r8 + 0x10], 0
je 0x1400ba0fd
mov qword [r11 - 0x30], r12
mov qword [r11 - 0x38], r15
xor r15b, r15b
call fcn.1400ba110
xor r12d, r12d
cmp qword [rdi + 0x18], 8
mov dword [rbp - 0x25], r12d
mov dword [rbp - 0x21], r12d
jb 0x1400b9e87
mov rdx, qword [rdi]
jmp 0x1400b9e8a
mov rdx, rdi
mov r8, qword [rsi + 0x10]
lea rax, [rbp - 0x19]
lea r9, [rbp - 0x21]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x25]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1400ba0f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400ba0f9
mov qword [rsp + 0xa0], rbx
mov ebx, dword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi + 0x10], rax
test rax, rax
je 0x1400ba0f5
mov ebx, dword [rbp - 0x25]
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi + 0x18], rax
test rax, rax
je 0x1400ba0f5
cmp qword [rdi + 0x18], 8
jb 0x1400b9f2f
mov rdi, qword [rdi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x19]
lea r9, [rbp - 0x21]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x25]
mov rdx, rdi
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1400ba0f5
cmp qword [r14 + 0x18], 8
mov dword [rbp - 0x29], r12d
jb 0x1400b9f71
mov rcx, qword [r14]
jmp 0x1400b9f74
mov rcx, r14
mov r8, qword [rsi + 0x20]
xor r9d, r9d
lea rax, [rbp - 0x29]
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x1400ba0f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400ba0f5
mov ebx, dword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi + 0x20], rax
test rax, rax
je 0x1400ba0f5
cmp qword [r14 + 0x18], 8
jb 0x1400b9fd6
mov r14, qword [r14]
mov r9d, dword [rbp - 0x29]
lea rcx, [rbp - 0x29]
mov r8, rax
mov qword [rsp + 0x20], rcx
mov rcx, r14
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
je 0x1400ba0f5
mov rcx, qword [rsi + 0x20]
lea r9, [rbp - 1]
lea r8, [rbp - 0x11]
lea rdx, [rbp - 0x1d]
mov qword [rbp - 0x11], r12
mov dword [rbp - 0x1d], r12d
mov dword [rbp - 1], r12d
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x1400ba0f5
mov rcx, qword [rbp - 0x11]
mov dword [rbp + 7], r12d
mov qword [rbp + 0xb], 8
test rcx, rcx
je 0x1400ba0c0
cmp dword [rbp - 0x1d], r12d
je 0x1400ba0c0
mov r9d, 2
lea rdx, [rbp + 7]
lea r8d, [r9 + 0xa]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x1400ba0f5
cmp dword [rbp - 0x1d], r12d
je 0x1400ba0c0
mov eax, dword [rbp + 7]
test eax, eax
je 0x1400ba0c0
mov ebx, r12d
mov rcx, qword [rbp - 0x11]
lea r8, [rbp - 9]
mov edx, ebx
mov qword [rbp - 9], r12
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1400ba0f5
mov rdx, qword [rbp - 9]
mov rcx, qword [rsi + 0x10]
add rdx, 8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400ba0a8
inc ebx
cmp ebx, dword [rbp + 7]
jb 0x1400ba071
jmp 0x1400ba0c0
mov rax, qword [rbp - 9]
movzx r15d, r15b
mov ecx, 1
cmp dword [rax + 4], 0x1f01ff
cmove r15d, ecx
movzx eax, r15b
mov rbx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x98]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x1400ba0c4
xor al, al
jmp 0x1400ba0cc
xor al, al
jmp 0x1400ba0dc