Function at 0x140071068
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1400de638]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
mov rdi, rcx
test rcx, rcx
je 0x140071366
cmp word [rcx], r15w
je 0x140071366
lea rax, [rbp + 0x2f]
mov qword [rbp + 0x17], r15
mov qword [r11 - 0x70], rax
lea edx, [r15 + 1]
mov qword [r11 - 0x78], r15
lea rax, [rbp + 0x17]
mov qword [r11 - 0x80], rax
lea r8d, [r15 + 4]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov qword [rbp + 0x2f], r15
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
nop dword [rax + rax]
test eax, eax
je 0x140071101
mov rcx, qword [rbp + 0x5f]
lea edx, [r15 + 0x1c]
mov r9d, eax
call fcn.140073418
mov edi, eax
jmp 0x14007134d
lea rax, [rbp + 0x1f]
mov dword [rbp + 0x37], r15d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x37]
mov dword [rsp + 0x48], r15d
mov r9d, 1
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], r15d
mov dl, r8b
mov dword [rsp + 0x20], r15d
mov word [rbp + 0x3b], 0xf00
mov qword [rbp + 0x1f], r15
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
jne 0x14007115c
lea edx, [rax + 0x2c]
jmp 0x1400711cf
mov rcx, qword [rbp + 0x17]
mov esi, r15d
mov qword [rbp + 0x27], r15
cmp r15w, word [rcx + 4]
jae 0x1400711e6
lea r8, [rbp + 0x27]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_GetAce]
nop dword [rax + rax]
test eax, eax
je 0x1400711ca
mov rbx, qword [rbp + 0x27]
cmp byte [rbx], r15b
jne 0x1400711b4
test byte [rbx + 1], 8
jne 0x1400711b4
mov rdx, qword [rbp + 0x1f]
lea rcx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400711b4
test dword [rbx + 4], 0x120089
jne 0x1400711c2
mov rcx, qword [rbp + 0x17]
inc esi
movzx eax, word [rcx + 4]
cmp esi, eax
jmp 0x14007116c
mov edi, r15d
jmp 0x140071338
mov edx, 0x31
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmexprimerge.cpp
call fcn.1400029b8
mov edi, eax
jmp 0x140071338
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
nop dword [rax + rax]
lea edx, [rax + 0xc]
cmp edx, eax
jb 0x14007131b
mov rax, qword [rbp + 0x17]
movzx esi, word [rax + 2]
add esi, edx
cmp esi, edx
jb 0x140071314
mov r14d, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, esi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140071261
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmexprimerge.cpp
mov edi, 0x8007000e
lea edx, [rax + 0x48]
mov r9d, edi
call fcn.140002980
jmp 0x140071305
mov r8, qword [rbp + 0x17]
mov rdx, r14
mov rcx, rbx
movzx r9d, word [r8 + 2]
call qword [sym.imp.msvcrt.dll_memcpy_s]
nop dword [rax + rax]
mov edx, 2
mov word [rbx + 2], si
mov rax, qword [rbp + 0x1f]
mov r9d, 0x120089
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAceEx]
nop dword [rax + rax]
test eax, eax
jne 0x1400712c0
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmexprimerge.cpp
lea edx, [rax + 0x4d]
call fcn.1400029b8
jmp 0x1400712fe
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rbx
mov rcx, rdi
mov qword [rsp + 0x20], r15
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
nop dword [rax + rax]
test eax, eax
je 0x140071302
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
mov edx, 0x50
call fcn.140073418
mov edi, eax
jmp 0x140071305
mov edi, r15d
test rbx, rbx
je 0x140071338
mov rcx, rbx
call fcn.14006202c
jmp 0x140071338
mov edx, 0x45
jmp 0x140071320
mov edx, 0x44
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmexprimerge.cpp
mov edi, 0x80070216
mov r9d, edi
call fcn.140002980
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x14007134d
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x140071362
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov eax, edi
jmp 0x140071385
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmexprimerge.cpp
mov ebx, 0x80070057
mov edx, 0x14
mov r9d, ebx
call fcn.140002980
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400a0610
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret