Function at 0x1800010d0
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x54], r8d
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x98], rcx
xor ebx, ebx
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x5c], ebx
mov r13d, ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x50], ebx
mov r15d, ebx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x60], rbx
mov edi, ebx
mov dword [rsp + 0x40], ebx
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1800016cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800016b8
mov ebx, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
lea edx, [r15 + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1800011bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.HeapAlloc___failed._Error__d_n
jmp 0x1800016c5
mov ebx, dword [rsp + 0x5c]
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x1800011fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.HeapAlloc___failed._Error__d_n
jmp 0x1800016c5
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
mov r8, r13
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1800016b8
mov r14d, 1
mov edx, r14d
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x180001268
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1801eb230]
call fcn.1800b5390
jmp 0x1800016d2
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x1800012a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorDacl___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
mov qword [rsp + 0xd4], 8
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x1800012c5
mov dword [rsp + 0x50], ebx
jmp 0x180001300
cmp dword [rsp + 0x50], ebx
je 0x180001300
mov r9d, 2
lea r8d, [r9 + 0xa]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x180001300
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAclInformation___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, dword [rsp + 0xd4]
add esi, 8
add esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, esi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x180001355
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
mov r8d, 2
mov edx, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x180001383
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeAcl___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
mov dword [rsp + 0x8c], ebx
cmp dword [rsp + 0x50], ebx
je 0x18000145d
mov eax, dword [rsp + 0xd0]
test eax, eax
je 0x18000145d
xor edi, edi
mov dword [rsp + 0x68], edi
nop dword [rax]
cmp edi, eax
jae 0x18000145d
lea r8, [rsp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x1800013e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
mov rdx, qword [rsp + 0x60]
test byte [rdx + 1], 0x10
jne 0x18000145d
add rdx, 8
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x180001405
jmp 0x18000144b
mov r9, qword [rsp + 0x60]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x180001442
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
inc ebx
mov dword [rsp + 0x8c], ebx
inc edi
mov dword [rsp + 0x68], edi
mov eax, dword [rsp + 0xd0]
jmp 0x1800013b0
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AddAccessAllowedAceEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 2
mov rcx, r15
test rax, rax
je 0x1800014b4
mov qword [rsp + 0x20], r13
mov r9d, dword [rsp + 0x54]
lea r8d, [rdx + 1]
call rax
test eax, eax
jne 0x1800014df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAceEx___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
mov r9, r13
mov r8d, dword [rsp + 0x54]
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x1800014df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAce___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
cmp dword [rsp + 0x50], 0
je 0x180001574
mov eax, dword [rsp + 0xd0]
test eax, eax
je 0x180001574
cmp edi, eax
jae 0x180001574
lea r8, [rsp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x180001528
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
mov r9, qword [rsp + 0x60]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x180001565
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
inc edi
mov dword [rsp + 0x68], edi
mov eax, dword [rsp + 0xd0]
jmp 0x1800014f5
xor r9d, r9d
mov r8, r15
mov edx, r14d
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x1800015a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorDacl___failed._Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetSecurityDescriptorControl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x180001673
test r12, r12
je 0x180001673
xor eax, eax
movzx ebx, ax
movzx edi, ax
mov word [rsp + 0x54], ax
mov dword [rsp + 0x78], eax
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x54]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x18000161b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorControl___failed.Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
movzx eax, word [rsp + 0x54]
mov ecx, 0x400
test cx, ax
je 0x180001633
mov ebx, 0x500
mov edi, ebx
jmp 0x180001643
mov ecx, 0x1000
test cx, ax
je 0x180001643
movzx ebx, cx
movzx edi, cx
test bx, bx
je 0x180001673
movzx r8d, di
movzx edx, bx
lea rcx, [rsp + 0xa8]
call rsi
test eax, eax
jne 0x180001673
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorControl___failed.Error__d_n
call fcn.1800b5390
jmp 0x1800016d2
mov esi, r14d
mov rax, qword [rsp + 0xa8]
mov qword [r12], rax
mov rax, qword [rsp + 0xb0]
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0xb8]
mov qword [r12 + 0x10], rax
mov rax, qword [rsp + 0xc0]
mov qword [r12 + 0x18], rax
mov rax, qword [rsp + 0xc8]
mov qword [r12 + 0x20], rax
jmp 0x1800016d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LookupAccountName___failed._Error__d_n
mov edx, eax
call fcn.1800b5390
mov r14d, 1
mov esi, dword [rsp + 0x40]
lea rbx, [r12 + 0x40]
mov rax, qword [rbx + 8]
lea rcx, [rsp + 0x48]
cmp rcx, rax
jae 0x1800016fb
lea rcx, [rsp + 0x48]
cmp qword [rbx], rcx
ja 0x1800016fb
mov ecx, r14d
xor r12d, r12d
jmp 0x180001701
xor r12d, r12d
mov ecx, r12d
test cl, cl
je 0x180001731
lea rdi, [rsp + 0x48]
sub rdi, qword [rbx]
sar rdi, 3
cmp rax, qword [rbx + 0x10]
jne 0x18000171f
mov rcx, rbx
call fcn.180001900
mov rax, qword [rbx]
lea r8, [rax + rdi*8]
mov rdx, qword [rbx + 8]
call fcn.180001a40
jmp 0x18000174b
cmp rax, qword [rbx + 0x10]
jne 0x18000173f
mov rcx, rbx
call fcn.180001900
mov rax, qword [rbx + 8]
test rax, rax
je 0x18000174b
mov qword [rax], r13
add qword [rbx + 8], 8
mov rax, qword [rbx + 8]
mov rdi, qword [rsp + 0x80]
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x48]
cmp rcx, rax
jae 0x180001778
lea rcx, [rsp + 0x48]
cmp qword [rbx], rcx
mov ecx, r14d
jbe 0x18000177b
mov ecx, r12d
test cl, cl
je 0x1800017ab
lea rdi, [rsp + 0x48]
sub rdi, qword [rbx]
sar rdi, 3
cmp rax, qword [rbx + 0x10]
jne 0x180001799
mov rcx, rbx
call fcn.180001900
mov rax, qword [rbx]
lea r8, [rax + rdi*8]
mov rdx, qword [rbx + 8]
call fcn.180001a40
jmp 0x1800017c5
cmp rax, qword [rbx + 0x10]
jne 0x1800017b9
mov rcx, rbx
call fcn.180001900
mov rax, qword [rbx + 8]
test rax, rax
je 0x1800017c5
mov qword [rax], rdi
add qword [rbx + 8], 8
mov rax, qword [rbx + 8]
mov qword [rsp + 0x48], r15
lea rcx, [rsp + 0x48]
cmp rcx, rax
jae 0x1800017e7
lea rcx, [rsp + 0x48]
cmp qword [rbx], rcx
jbe 0x1800017ea
mov r14d, r12d
test r14b, r14b
je 0x18000181b
lea rdi, [rsp + 0x48]
sub rdi, qword [rbx]
sar rdi, 3
cmp rax, qword [rbx + 0x10]
jne 0x180001809
mov rcx, rbx
call fcn.180001900
mov rax, qword [rbx]
lea r8, [rax + rdi*8]
mov rdx, qword [rbx + 8]
call fcn.180001a40
jmp 0x180001835
cmp rax, qword [rbx + 0x10]
jne 0x180001829
mov rcx, rbx
call fcn.180001900
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001835
mov qword [rcx], r15
add qword [rbx + 8], 8
mov eax, esi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret