Function at 0x1400c3c70
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x190
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401563f0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r12, rdx
mov r13, rcx
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssSidCollection::IsSidAllowedToFire
mov qword [rsp + 0x50], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x6e5
mov dword [rsp + 0x64], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x68], 0xff
xor r15d, r15d
mov dword [rbp - 0x18], 0x1000000
lea ebx, [r15 + 1]
xor edx, edx
lea r8d, [r15 + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.1400ba170
nop
xor eax, eax
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x78], eax
mov qword [rsp + 0x30], r15
mov sil, r15b
mov dil, r15b
lea r9d, [r15 + 2]
lea r8d, [r15 + 0xc]
lea rdx, [rbp + 0x70]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
mov r14d, r15d
mov eax, dword [rbp + 0x70]
test eax, eax
je 0x1400c3f48
lea r8, [rsp + 0x30]
mov edx, r15d
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
mov r9, qword [rsp + 0x30]
movzx ecx, byte [r9]
test ecx, ecx
je 0x1400c3f02
cmp ecx, 1
jne 0x1400c3f39
test r14d, r14d
jne 0x1400c3ee8
lea rdx, [r9 + 8]
mov rcx, r12
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x1400c3f39
mov sil, bl
mov edx, dword [rbp + 0x24]
lea rcx, [rbp]
call fcn.140003e1c
xor r13d, r13d
test eax, eax
je 0x1400c3e99
mov qword [rsp + 0x40], r13
lea rax, [0x1400ef1c8]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.14002db8c
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
test eax, eax
je 0x1400c3e8f
test dil, dil
je 0x1400c3df9
test sil, sil
lea r15, str.allowed
je 0x1400c3e00
lea r15, str.denied
test dil, dil
jne 0x1400c3e11
test sil, sil
lea r14, str.implicitely
je 0x1400c3e18
lea r14, str.explicitely
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x48], rax
lea rax, str.CVssSidCollection::IsSidAllowedToFire
mov qword [rsp + 0x50], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x73f
mov dword [rsp + 0x64], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x68], 0xff
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x40]
lea r8, str.WriterSid:__s_was__s__s_to_fire
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.140006ed0
lea rcx, [rsp + 0x38]
call fcn.14002ad0c
test dil, dil
je 0x1400c3ea3
test sil, sil
je 0x1400c3ea6
mov bl, r13b
mov dl, bl
lea rcx, [rbp]
call fcn.14002e56c
mov bl, al
lea rcx, [rbp]
call fcn.14000f940
mov al, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400140f0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
add r9, 8
mov r8, r12
lea rdx, [rbp]
mov rcx, r13
call fcn.1400c23dc
test al, al
jmp 0x1400c3d97
test r14d, r14d
jne 0x1400c3f1d
lea rdx, [r9 + 8]
mov rcx, r12
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x1400c3f39
mov dil, bl
jmp 0x1400c3f39
add r9, 8
mov r8, r12
lea rdx, [rbp]
mov rcx, r13
call fcn.1400c23dc
movzx edi, dil
test al, al
cmovne edi, ebx
add r15d, ebx
mov eax, dword [rbp + 0x70]
cmp r15d, eax
jb 0x1400c3d53
add r14d, ebx
cmp r14d, 2
jae 0x1400c3da0
xor r15d, r15d
jmp 0x1400c3d4b