Function at 0x18006e4a0
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0xb0], rcx
xor ebx, ebx
mov r13d, ebx
mov qword [rsp + 0x90], rbx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x44], ebx
mov r12d, ebx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x60], rbx
mov edi, ebx
mov dword [rsp + 0x5c], ebx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x54]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x18006ea87
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18006ea73
mov ebx, dword [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
lea edx, [r12 + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x18006e58d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.HeapAlloc___failed._Error__d_n
jmp 0x18006ea80
mov ebx, dword [rsp + 0x50]
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x18006e5cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.HeapAlloc___failed._Error__d_n
jmp 0x18006ea80
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x54]
mov r8, qword [rsp + 0x48]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x18006ea73
mov r15d, 1
mov edx, r15d
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x18006e63a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeSecurityDescriptor___failed.Error__d_n
call fcn.18006efe0
jmp 0x18006ea8d
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x44]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x18006e672
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorDacl___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8d
xor ebx, ebx
mov dword [rsp + 0xe8], ebx
mov qword [rsp + 0xec], 8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x18006e697
mov dword [rsp + 0x44], ebx
jmp 0x18006e6d2
cmp dword [rsp + 0x44], ebx
je 0x18006e6d2
mov r9d, 2
lea r8d, [r9 + 0xa]
lea rdx, [rsp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x18006e6d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAclInformation___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, dword [rsp + 0xec]
add esi, 8
add esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, esi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x18006e729
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8d
mov r8d, 2
mov edx, esi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x18006e757
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeAcl___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8d
xor esi, esi
mov dword [rsp + 0x84], ebx
cmp dword [rsp + 0x44], ebx
je 0x18006e82f
mov eax, dword [rsp + 0xe8]
test eax, eax
je 0x18006e82f
mov edi, esi
mov dword [rsp + 0x58], esi
nop
cmp edi, eax
jae 0x18006e82f
lea r8, [rsp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x18006e7b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8f
mov rdx, qword [rsp + 0x60]
test byte [rdx + 1], 0x10
jne 0x18006e82f
add rdx, 8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x18006e7d7
jmp 0x18006e81d
mov r9, qword [rsp + 0x60]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x18006e814
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8f
inc ebx
mov dword [rsp + 0x84], ebx
inc edi
mov dword [rsp + 0x58], edi
mov eax, dword [rsp + 0xe8]
jmp 0x18006e780
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AddAccessAllowedAceEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 2
test rax, rax
je 0x18006e88c
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x10000000
lea r8d, [rdx + 1]
mov rcx, r12
call rax
test eax, eax
jne 0x18006e8bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAceEx___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8f
mov r9, qword [rsp + 0x48]
mov r8d, 0x10000000
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x18006e8bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAce___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8f
cmp dword [rsp + 0x44], esi
je 0x18006e951
mov eax, dword [rsp + 0xe8]
test eax, eax
je 0x18006e951
cmp edi, eax
jae 0x18006e951
lea r8, [rsp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x18006e905
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8f
mov r9, qword [rsp + 0x60]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x18006e942
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8f
inc edi
mov dword [rsp + 0x58], edi
mov eax, dword [rsp + 0xe8]
jmp 0x18006e8d2
xor r9d, r9d
mov r8, r12
mov edx, r15d
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x18006e985
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorDacl___failed._Error__d_n
call fcn.18006efe0
jmp 0x18006ea8f
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetSecurityDescriptorControl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18006ea44
test r14, r14
je 0x18006ea44
mov word [rsp + 0x40], si
mov dword [rsp + 0x88], esi
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x18006e9f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorControl___failed.Error__d_n
call fcn.18006efe0
jmp 0x18006ea8f
movzx eax, word [rsp + 0x40]
mov ecx, 0x400
test cx, ax
je 0x18006ea0c
mov eax, 0x500
jmp 0x18006ea19
mov ecx, 0x1000
test cx, ax
je 0x18006ea44
movzx eax, cx
movzx r8d, ax
movzx edx, ax
lea rcx, [rsp + 0xc0]
call rbx
test eax, eax
jne 0x18006ea44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorControl___failed.Error__d_n
call fcn.18006efe0
jmp 0x18006ea8f
mov dword [rsp + 0x5c], r15d
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rsp + 0xd0]
movups xmmword [r14 + 0x10], xmm1
movsd xmm0, qword [rsp + 0xe0]
movsd qword [r14 + 0x20], xmm0
jmp 0x18006ea8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LookupAccountName___failed._Error__d_n
mov edx, eax
call fcn.18006efe0
mov r15d, 1
xor esi, esi
lea rbx, [r14 + 0x40]
lea rcx, [rsp + 0x48]
call fcn.18005bae0
mov rdi, rax
mov rcx, rbx
call fcn.18006edf0
cmp rdi, qword [rax]
jae 0x18006eaba
call fcn.18005bae0
cmp qword [rax], rdi
mov eax, r15d
jbe 0x18006eabc
mov eax, esi
mov rcx, rbx
test al, al
je 0x18006eb1f
call fcn.18005bae0
mov r14, rax
sub rdi, qword [rax]
sar rdi, 3
call fcn.18006edf0
mov rsi, rax
call fcn.18006ede0
mov rcx, qword [rax]
cmp qword [rsi], rcx
jne 0x18006eaef
mov rcx, rbx
call fcn.18006ee00
mov rdx, qword [rsi]
mov rcx, qword [r14]
lea rcx, [rcx + rdi*8]
call fcn.18005bae0
mov rcx, rax
call fcn.18005bae0
test rdx, rdx
je 0x18006eb19
mov rcx, rax
call fcn.18005bae0
mov rcx, qword [rax]
mov qword [rdx], rcx
add qword [rsi], 8
jmp 0x18006eb68
call fcn.18006edf0
mov rdi, rax
call fcn.18006ede0
mov rcx, qword [rax]
cmp qword [rdi], rcx
jne 0x18006eb3c
mov rcx, rbx
call fcn.18006ee00
mov rdx, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.18005bae0
mov rcx, rax
call fcn.18005bae0
test rdx, rdx
je 0x18006eb64
mov rcx, rax
call fcn.18005bae0
mov rcx, qword [rax]
mov qword [rdx], rcx
add qword [rdi], 8
mov qword [rsp + 0x70], r13
lea rcx, [rsp + 0x70]
call fcn.18005bae0
mov rdi, rax
mov rcx, rbx
call fcn.18006edf0
cmp rdi, qword [rax]
jae 0x18006eb96
call fcn.18005bae0
cmp qword [rax], rdi
ja 0x18006eb96
mov eax, r15d
jmp 0x18006eb98
xor eax, eax
mov rcx, rbx
test al, al
je 0x18006ebfb
call fcn.18005bae0
mov r14, rax
sub rdi, qword [rax]
sar rdi, 3
call fcn.18006edf0
mov rsi, rax
call fcn.18006ede0
mov rcx, qword [rax]
cmp qword [rsi], rcx
jne 0x18006ebcb
mov rcx, rbx
call fcn.18006ee00
mov rdx, qword [rsi]
mov rcx, qword [r14]
lea rcx, [rcx + rdi*8]
call fcn.18005bae0
mov rcx, rax
call fcn.18005bae0
test rdx, rdx
je 0x18006ebf5
mov rcx, rax
call fcn.18005bae0
mov rcx, qword [rax]
mov qword [rdx], rcx
add qword [rsi], 8
jmp 0x18006ec44
call fcn.18006edf0
mov rdi, rax
call fcn.18006ede0
mov rcx, qword [rax]
cmp qword [rdi], rcx
jne 0x18006ec18
mov rcx, rbx
call fcn.18006ee00
mov rdx, qword [rdi]
lea rcx, [rsp + 0x70]
call fcn.18005bae0
mov rcx, rax
call fcn.18005bae0
test rdx, rdx
je 0x18006ec40
mov rcx, rax
call fcn.18005bae0
mov rcx, qword [rax]
mov qword [rdx], rcx
add qword [rdi], 8
mov qword [rsp + 0x78], r12
lea rcx, [rsp + 0x78]
call fcn.18005bae0
mov rdi, rax
mov rcx, rbx
call fcn.18006edf0
cmp rdi, qword [rax]
jae 0x18006ec6d
call fcn.18005bae0
cmp qword [rax], rdi
jbe 0x18006ec70
xor r15d, r15d
mov rcx, rbx
test r15b, r15b
je 0x18006ecd1
call fcn.18005bae0
mov r14, rax
sub rdi, qword [rax]
sar rdi, 3
call fcn.18006edf0
mov rsi, rax
call fcn.18006ede0
mov rdx, qword [rax]
cmp qword [rsi], rdx
jne 0x18006eca1
call fcn.18006ee00
mov rdx, qword [rsi]
mov rcx, qword [r14]
lea rcx, [rcx + rdi*8]
call fcn.18005bae0
mov rcx, rax
call fcn.18005bae0
test rdx, rdx
je 0x18006eccb
mov rcx, rax
call fcn.18005bae0
mov rcx, qword [rax]
mov qword [rdx], rcx
add qword [rsi], 8
jmp 0x18006ed1a
call fcn.18006edf0
mov rdi, rax
call fcn.18006ede0
mov rcx, qword [rax]
cmp qword [rdi], rcx
jne 0x18006ecee
mov rcx, rbx
call fcn.18006ee00
mov rdx, qword [rdi]
lea rcx, [rsp + 0x78]
call fcn.18005bae0
mov rcx, rax
call fcn.18005bae0
test rdx, rdx
je 0x18006ed16
mov rcx, rax
call fcn.18005bae0
mov rcx, qword [rax]
mov qword [rdx], rcx
add qword [rdi], 8
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret