Function at 0x140002af0
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400c87d8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, r8
lea r9, [rsp + 0x48]
mov r14, rdx
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetSecurityDescriptorDacl]
nop dword [rax + rax]
test eax, eax
jne 0x140002b44
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140002e37
cmp dword [rsp + 0x30], 0
je 0x140002b5a
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x140002b64
call fcn.1400102b8
mov ebx, 0x57
jmp 0x140002e37
mov r9d, 2
lea rdx, [rsp + 0x58]
lea r8d, [r9 + 0xa]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
nop dword [rax + rax]
test eax, eax
je 0x140002b31
mov qword [rsp + 0x88], rbp
xor ebx, ebx
mov qword [rsp + 0x80], rsi
xor esi, esi
mov qword [rsp + 0x78], rdi
xor edi, edi
mov qword [rsp + 0x70], r12
cmp dword [rsp + 0x58], ebx
jbe 0x140002e18
lea r12d, [rsi + 1]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x50]
mov edx, edi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
nop dword [rax + rax]
test eax, eax
je 0x140002e08
mov rax, qword [rsp + 0x50]
cmp byte [rax], 0
jne 0x140002c26
mov rdx, qword [0x1400ca130]
lea rbp, [rax + 8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x140002bfe
mov esi, r12d
jmp 0x140002c1e
mov rdx, qword [0x1400ca128]
mov rcx, rbp
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
cmovne ebx, r12d
test esi, esi
je 0x140002c26
test ebx, ebx
jne 0x140002e18
inc edi
cmp edi, dword [rsp + 0x58]
jb 0x140002bb1
test esi, esi
je 0x140002e18
test ebx, ebx
jne 0x140002e18
mov rcx, qword [0x1400ca128]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov edi, dword [rsp + 0x5c]
mov ebx, 8
mov rcx, qword [0x1400ca110]
add edi, 0xc
add edi, eax
mov edx, ebx
mov r8d, edi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140002cc9
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400c82a8]
lea rax, [0x1400c82a8]
cmp rcx, rax
je 0x140002e1d
test byte [rcx + 0x44], 0x20
je 0x140002e1d
mov rcx, qword [rcx + 0x38]
lea edx, [rbx + 2]
mov r9d, edi
lea r8, [0x1400ab930]
call fcn.140016ccc
jmp 0x140002e1d
mov r8d, 2
mov edx, edi
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeAcl]
nop dword [rax + rax]
test eax, eax
je 0x140002de0
xor ebx, ebx
cmp dword [rsp + 0x58], ebx
jbe 0x140002da7
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
nop dword [rax + rax]
test eax, eax
je 0x140002de0
mov r9, qword [rsp + 0x40]
mov edx, 2
mov r8d, 0xffffffff
mov rcx, rsi
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAce]
nop dword [rax + rax]
test eax, eax
je 0x140002de0
mov rdi, qword [rsp + 0x40]
cmp byte [rdi], 0
jne 0x140002d9b
mov rdx, qword [0x1400ca130]
lea rcx, [rdi + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x140002d9b
mov rax, qword [rsp + 0x40]
mov edx, 2
mov r9d, dword [rdi + 4]
mov rcx, rsi
movzx r8d, byte [rax + 1]
mov rax, qword [0x1400ca128]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAccessAllowedAceEx]
nop dword [rax + rax]
test eax, eax
je 0x140002de0
inc ebx
cmp ebx, dword [rsp + 0x58]
jb 0x140002cf4
mov edx, r12d
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
je 0x140002de0
xor r9d, r9d
mov r8, rsi
mov edx, r12d
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorDacl]
nop dword [rax + rax]
test eax, eax
je 0x140002de0
mov qword [r15], rsi
xor ebx, ebx
jmp 0x140002e1d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x1400ca110]
mov r8, rsi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140002e1d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140002e1d
mov ebx, 0xb7
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x70]
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000e2c0
add rsp, 0x90
pop r15
pop r14
pop rbx
ret