Function at 0x1400611b0
Capabilities:
Compare security identifiers

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov r14, rdx
mov r12, rcx
xor esi, esi
mov r15, rsi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x58], rsi
mov r13, rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x40], rsi
mov edi, esi
xor bl, bl
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 4]
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x140061733
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140061235
xor edx, edx
lea rcx, str.GetFileSecurity___failed._Error__d_n
call fcn.14006943c
jmp 0x140061733
mov ebx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x140061278
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, r15
mov edx, 4
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x1400612b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetFileSecurity___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
mov edx, 1
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x1400612e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeSecurityDescriptor___failed.Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x34]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x140061320
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorDacl___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x4c], 8
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x140061340
mov dword [rsp + 0x34], esi
jmp 0x14006137b
cmp dword [rsp + 0x34], 0
je 0x14006137b
mov r9d, 2
lea r8d, [r9 + 0xa]
lea rdx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x14006137b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAclInformation___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [rsp + 0x4c]
lea r12d, [rax + rcx + 8]
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r12d
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x1400613cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
mov r8d, 2
mov edx, r12d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x140061400
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeAcl___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
mov ebx, esi
mov dword [rsp + 0x64], ebx
cmp dword [rsp + 0x34], ebx
je 0x1400614cd
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400614cd
mov edi, esi
mov dword [rsp + 0x38], esi
cmp edi, eax
jae 0x1400614cd
lea r8, [rsp + 0x40]
mov edx, edi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x14006145b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
mov rdx, qword [rsp + 0x40]
test byte [rdx + 1], 0x10
jne 0x1400614cd
add rdx, 8
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x140061479
jmp 0x1400614be
mov r9, qword [rsp + 0x40]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x1400614b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
inc ebx
mov dword [rsp + 0x64], ebx
inc edi
mov dword [rsp + 0x38], edi
mov eax, dword [rsp + 0x48]
jmp 0x140061422
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AddAccessAllowedAceEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140061529
mov qword [rsp + 0x20], r14
mov r9d, dword [rsp + 0x100]
mov edx, 2
lea r8d, [rdx + 1]
mov rcx, r13
call rax
test al, al
jne 0x140061561
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
mov r9, r14
mov r8d, dword [rsp + 0x100]
mov edx, 2
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x140061561
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
cmp dword [rsp + 0x34], 0
je 0x1400615f8
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400615f8
cmp edi, eax
jae 0x1400615f8
lea r8, [rsp + 0x40]
mov edx, edi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x1400615ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
mov r9, qword [rsp + 0x40]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x1400615ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
inc edi
mov dword [rsp + 0x38], edi
mov eax, dword [rsp + 0x48]
jmp 0x140061578
xor r9d, r9d
mov r8, r13
lea edx, [r9 + 1]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x14006162f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorDacl___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetSecurityDescriptorControl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400616fa
mov bx, si
mov word [rsp + 0x108], si
mov dword [rsp + 0x60], esi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x108]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x14006169c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorControl___failed.Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
movzx eax, word [rsp + 0x108]
mov ecx, 0x400
test cx, ax
je 0x1400616b8
mov ebx, 0x500
mov si, bx
jmp 0x1400616c8
mov ecx, 0x1000
test cx, ax
je 0x1400616c8
mov si, cx
mov bx, cx
test si, si
je 0x1400616fa
movzx r8d, bx
movzx edx, si
lea rcx, [rsp + 0x80]
call rdi
test al, al
jne 0x1400616fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorControl___failed.Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
lea r8, [rsp + 0x80]
mov edx, 4
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x140061731
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.RegSetKeySecurity___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140061733
mov bl, 1
test r15, r15
je 0x14006174c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x140061765
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret