Function at 0x1400131d0
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebx, ebx
mov rsi, rcx
mov qword [rax - 0x30], rbx
mov ebp, ebx
mov qword [rax + 0x10], rbx
mov edi, ebx
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbx
test rdx, rdx
je 0x140013200
mov rcx, qword [rdx]
jmp 0x140013203
mov rcx, rbx
call fcn.14005d4a0
mov r14, rax
test rax, rax
je 0x140013403
mov rcx, rsi
call fcn.14005e740
mov rbp, rax
test rax, rax
je 0x140013400
lea rax, [rsp + 0x48]
mov edx, 1
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x88]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov rcx, rbp
lea r8d, [rdx + 4]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_GetNamedSecurityInfoW]
test eax, eax
je 0x140013289
mov r8d, eax
lea rcx, str.failed_to_retrieve_the_owner_sid_and_dacl_of_file__S_with_error_code:__d
mov rdx, rbp
call fcn.140002e50
call fcn.1400826c8
mov dword [rax], 0x83
jmp 0x140013400
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidSid]
mov esi, eax
test eax, eax
je 0x1400133ef
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidAcl]
mov edi, eax
test eax, eax
je 0x1400133ef
mov rcx, qword [rsp + 0x88]
mov edx, 0x1a
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsWellKnownSid]
test eax, eax
jne 0x14001330e
mov rcx, qword [rsp + 0x88]
lea edx, [rax + 0x16]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsWellKnownSid]
test eax, eax
jne 0x14001330e
mov rcx, qword [rsp + 0x88]
mov rdx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x14001330e
mov rdx, rbp
lea rcx, str.Bad_owner_on__S
call fcn.140002e50
jmp 0x140013400
mov rcx, qword [rsp + 0x90]
mov edi, ebx
cmp bx, word [rcx + 4]
jae 0x140013403
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov edx, edi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
je 0x1400133d6
mov rax, qword [rsp + 0x40]
cmp byte [rax], bl
jne 0x14001337b
lea rsi, [rax + 8]
mov edx, 0x1a
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsWellKnownSid]
test eax, eax
jne 0x14001337b
lea edx, [rax + 0x16]
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsWellKnownSid]
test eax, eax
jne 0x14001337b
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x14001338f
mov rcx, qword [rsp + 0x90]
inc edi
movzx eax, word [rcx + 4]
cmp edi, eax
jb 0x140013322
jmp 0x140013403
lea rdx, [rsp + 0x98]
mov rcx, rsi
or ebx, 0xffffffff
call qword [sym.imp.api_ms_win_security_sddl_ansi_l1_1_0.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x1400133bd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.ConvertSidToSidString_failed_with__d.
call fcn.140002e50
jmp 0x140013403
mov rdx, qword [rsp + 0x98]
lea rcx, str.Bad_permissions._Try_removing_permissions_for_user:__s_on_file__S.
mov r8, rbp
call fcn.140002e50
jmp 0x140013403
lea rcx, [0x1400c58b8]
call fcn.140002e50
call fcn.1400826c8
mov dword [rax], 0x83
jmp 0x140013400
mov r8d, edi
lea rcx, [0x1400c5880]
mov edx, esi
call fcn.140002e50
or ebx, 0xffffffff
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140013416
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140013426
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test r14, r14
je 0x140013433
mov rcx, r14
call fcn.140078000
test rbp, rbp
je 0x140013440
mov rcx, rbp
call fcn.140078000
mov eax, ebx
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret