Function at 0x410296d0
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov r14d, r8d
mov rsi, rdx
mov r12, rcx
xor ebx, ebx
mov qword [rax - 0x78], rbx
mov dword [rsp + 0x44], ebx
mov r13, rbx
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x48], ebx
mov qword [rax - 0x88], rbx
mov dword [rsp + 0x40], ebx
mov r15, rbx
mov qword [rax - 0x68], rbx
mov qword [rsp + 0x68], rbx
mov edi, ebx
mov dword [rsp + 0x60], ebx
lea rax, [rax - 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x41029d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4102978a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LookupAccountName___failed._Error__d_n
call fcn.41211fb0
lea esi, [rbx + 1]
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
mov ebx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x410297d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc___failed._Error__d_n
call fcn.41211fb0
lea esi, [r13 + 1]
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
mov ebx, dword [rsp + 0x44]
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x41029829
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc___failed._Error__d_n
call fcn.41211fb0
lea esi, [rbx + 1]
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
lea rax, [rsp + 0xac]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
mov r8, r13
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x41029882
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LookupAccountName___failed._Error__d_n
call fcn.41211fb0
mov esi, 1
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
mov esi, 1
mov edx, esi
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x410298bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeSecurityDescriptor___failed.Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x410298ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorDacl___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
xor ebx, ebx
mov dword [rsp + 0x80], ebx
mov dword [rsp + 0x88], ebx
mov dword [rsp + 0x84], 8
mov rcx, qword [rsp + 0x90]
test rcx, rcx
jne 0x4102992d
mov dword [rsp + 0x40], ebx
jmp 0x41029970
cmp dword [rsp + 0x40], ebx
je 0x41029970
mov r9d, 2
lea r8d, [r9 + 0xa]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x41029970
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAclInformation___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [rsp + 0x84]
lea r12d, [rax + rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r12d
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
mov qword [rsp + 0xb0], rax
test rax, rax
jne 0x410299cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
mov r8d, 2
mov edx, r12d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x41029a04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeAcl___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
mov dword [rsp + 0xa8], ebx
cmp dword [rsp + 0x40], ebx
je 0x41029af0
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x41029af0
xor edi, edi
mov dword [rsp + 0x70], edi
nop
nop
cmp edi, eax
jae 0x41029af0
lea r8, [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x41029a72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
mov rdx, qword [rsp + 0x68]
test byte [rdx + 1], 0x10
jne 0x41029af0
add rdx, 8
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x41029a90
jmp 0x41029ade
mov r9, qword [rsp + 0x68]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x41029ad5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
add ebx, esi
mov dword [rsp + 0xa8], ebx
add edi, esi
mov dword [rsp + 0x70], edi
mov eax, dword [rsp + 0x80]
jmp 0x41029a30
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AddAccessAllowedAceEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x41029b4d
mov qword [rsp + 0x20], r13
mov r9d, r14d
mov edx, 2
lea r8d, [rdx + 1]
mov rcx, r15
call rax
test eax, eax
jne 0x41029b86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAceEx___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
mov r9, r13
mov r8d, r14d
mov edx, 2
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x41029b86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAce___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
cmp dword [rsp + 0x40], 0
je 0x41029c39
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x41029c39
cmp edi, eax
jae 0x41029c39
lea r8, [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x41029be2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
mov r9, qword [rsp + 0x68]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x41029c27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
add edi, esi
mov dword [rsp + 0x70], edi
mov eax, dword [rsp + 0x80]
jmp 0x41029ba0
xor r9d, r9d
mov r8, r15
mov edx, esi
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x41029c74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorDacl___failed._Error__d_n
call fcn.41211fb0
mov r14, qword [rsp + 0x120]
jmp 0x41029d9d
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetSecurityDescriptorControl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x41029d54
mov r14, qword [rsp + 0x120]
test r14, r14
je 0x41029d5c
xor bx, bx
xor di, di
mov word [rsp + 0x138], bx
mov dword [rsp + 0x98], 0
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x138]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x41029cfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorControl___failed.Error__d_n
call fcn.41211fb0
jmp 0x41029d9d
movzx eax, word [rsp + 0x138]
bt ax, 0xa
jae 0x41029d15
mov bx, 0x500
movzx edi, bx
jmp 0x41029d23
bt ax, 0xc
jae 0x41029d23
mov bx, 0x1000
mov di, bx
test bx, bx
je 0x41029d5c
movzx r8d, di
movzx edx, bx
lea rcx, [rsp + 0xc0]
call r12
test eax, eax
jne 0x41029d5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorControl___failed.Error__d_n
call fcn.41211fb0
jmp 0x41029d9d
mov r14, qword [rsp + 0x120]
mov dword [rsp + 0x60], esi
lea rcx, [rsp + 0xc0]
mov rax, qword [rcx]
mov qword [r14], rax
mov rax, qword [rcx + 8]
mov qword [r14 + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [r14 + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [r14 + 0x18], rax
mov rax, qword [rcx + 0x20]
mov qword [r14 + 0x20], rax
jmp 0x41029d9d
mov esi, 1
mov r14, qword [rsp + 0x120]
lea rbx, [r14 + 0x40]
mov rdx, qword [rbx + 8]
test rdx, rdx
jne 0x41029dae
xor eax, eax
jmp 0x41029db9
mov rax, qword [rbx + 0x10]
sub rax, rdx
sar rax, 3
test rdx, rdx
jne 0x41029dc2
xor ecx, ecx
jmp 0x41029dcd
mov rcx, qword [rbx + 0x18]
sub rcx, rdx
sar rcx, 3
cmp rax, rcx
jae 0x41029dfa
mov rdx, qword [rbx + 0x10]
mov rax, rsi
mov rcx, rdx
nop
mov qword [rcx], r13
add rcx, 8
sub rax, 1
jne 0x41029de0
lea rax, [rdx + 8]
mov qword [rbx + 0x10], rax
jmp 0x41029e84
mov rdi, qword [rbx + 0x10]
cmp rdx, rdi
jbe 0x41029e08
call fcn.41211d60
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov r12, qword [rbx + 8]
test r12, r12
je 0x41029e3e
mov rcx, qword [rbx + 0x10]
mov rax, rcx
sub rax, r12
sar rax, 3
je 0x41029e3e
cmp r12, rcx
jbe 0x41029e35
call fcn.41211d60
sub rdi, r12
sar rdi, 3
jmp 0x41029e40
xor edi, edi
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x78]
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.410d76c0
mov r12, qword [rbx + 8]
cmp r12, qword [rbx + 0x10]
jbe 0x41029e6f
call fcn.41211d60
lea rax, [r12 + rdi*8]
cmp rax, qword [rbx + 0x10]
ja 0x41029e7f
cmp rax, qword [rbx + 8]
jae 0x41029e84
call fcn.41211d60
mov r8, qword [rsp + 0xa0]
mov qword [rsp + 0x138], r8
lea rbx, [r14 + 0x40]
mov rdx, qword [rbx + 8]
test rdx, rdx
jne 0x41029ea5
xor eax, eax
jmp 0x41029eb0
mov rax, qword [rbx + 0x10]
sub rax, rdx
sar rax, 3
test rdx, rdx
jne 0x41029eb9
xor ecx, ecx
jmp 0x41029ec4
mov rcx, qword [rbx + 0x18]
sub rcx, rdx
sar rcx, 3
cmp rax, rcx
jae 0x41029eed
mov rdx, qword [rbx + 0x10]
mov rax, rsi
mov rcx, rdx
mov qword [rcx], r8
add rcx, 8
sub rax, 1
jne 0x41029ed3
lea rax, [rdx + 8]
mov qword [rbx + 0x10], rax
jmp 0x41029f7a
mov rdi, qword [rbx + 0x10]
cmp rdx, rdi
jbe 0x41029efb
call fcn.41211d60
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov r12, qword [rbx + 8]
test r12, r12
je 0x41029f31
mov rcx, qword [rbx + 0x10]
mov rax, rcx
sub rax, r12
sar rax, 3
je 0x41029f31
cmp r12, rcx
jbe 0x41029f28
call fcn.41211d60
sub rdi, r12
sar rdi, 3
jmp 0x41029f33
xor edi, edi
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x138]
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.410d76c0
mov r12, qword [rbx + 8]
cmp r12, qword [rbx + 0x10]
jbe 0x41029f65
call fcn.41211d60
lea rax, [r12 + rdi*8]
cmp rax, qword [rbx + 0x10]
ja 0x41029f75
cmp rax, qword [rbx + 8]
jae 0x41029f7a
call fcn.41211d60
mov qword [rsp + 0x138], r15
lea rbx, [r14 + 0x40]
mov rdx, qword [rbx + 8]
test rdx, rdx
jne 0x41029f93
xor eax, eax
jmp 0x41029f9e
mov rax, qword [rbx + 0x10]
sub rax, rdx
sar rax, 3
test rdx, rdx
jne 0x41029fa7
xor ecx, ecx
jmp 0x41029fb2
mov rcx, qword [rbx + 0x18]
sub rcx, rdx
sar rcx, 3
cmp rax, rcx
jae 0x41029fda
mov rcx, qword [rbx + 0x10]
mov rax, rcx
nop
mov qword [rax], r15
add rax, 8
sub rsi, 1
jne 0x41029fc0
lea rax, [rcx + 8]
mov qword [rbx + 0x10], rax
jmp 0x4102a067
mov rdi, qword [rbx + 0x10]
cmp rdx, rdi
jbe 0x41029fe8
call fcn.41211d60
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov r12, qword [rbx + 8]
test r12, r12
je 0x4102a01e
mov rcx, qword [rbx + 0x10]
mov rax, rcx
sub rax, r12
sar rax, 3
je 0x4102a01e
cmp r12, rcx
jbe 0x4102a015
call fcn.41211d60
sub rdi, r12
sar rdi, 3
jmp 0x4102a020
xor edi, edi
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x138]
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.410d76c0
mov rsi, qword [rbx + 8]
cmp rsi, qword [rbx + 0x10]
jbe 0x4102a052
call fcn.41211d60
lea rcx, [rsi + rdi*8]
cmp rcx, qword [rbx + 0x10]
ja 0x4102a062
cmp rcx, qword [rbx + 8]
jae 0x4102a067
call fcn.41211d60
mov eax, dword [rsp + 0x60]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret