Function at 0x1400609d0
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x20], r9d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov r14, r8
xor esi, esi
mov r15, rsi
mov qword [rax - 0x70], rsi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x40], rsi
mov qword [rax - 0x80], rsi
mov r13, rsi
mov qword [rax - 0x68], rsi
mov qword [rsp + 0x60], rsi
mov edi, esi
xor bl, bl
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140060a48
mov edx, eax
lea rcx, str.RegOpenKeyEx___failed._Error__d_n
call fcn.14006943c
jmp 0x140060f69
lea r9, [rsp + 0x38]
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
je 0x140060f69
cmp eax, 0x7a
je 0x140060a7f
mov edx, eax
lea rcx, str.RegGetKeySecurity___failed._Error__d_n
call fcn.14006943c
jmp 0x140060f69
mov ebx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140060ac2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
lea r9, [rsp + 0x38]
mov r8, rax
mov edx, 4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
je 0x140060af3
mov edx, eax
lea rcx, str.RegGetKeySecurity___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
mov edx, 1
lea rcx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x140060b25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeSecurityDescriptor___failed.Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x34]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x140060b5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorDacl___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x54], 8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x140060b7f
mov dword [rsp + 0x34], esi
jmp 0x140060bba
cmp dword [rsp + 0x34], 0
je 0x140060bba
mov r9d, 2
lea r8d, [r9 + 0xa]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x140060bba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAclInformation___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [rsp + 0x54]
lea r12d, [rax + rcx + 8]
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r12d
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x140060c11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
mov r8d, 2
mov edx, r12d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x140060c42
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeAcl___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
mov ebx, esi
mov dword [rsp + 0x74], ebx
cmp dword [rsp + 0x34], ebx
je 0x140060d0f
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140060d0f
mov edi, esi
mov dword [rsp + 0x48], esi
cmp edi, eax
jae 0x140060d0f
lea r8, [rsp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x140060c9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
mov rdx, qword [rsp + 0x60]
test byte [rdx + 1], 0x10
jne 0x140060d0f
add rdx, 8
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x140060cbb
jmp 0x140060d00
mov r9, qword [rsp + 0x60]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x140060cfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
inc ebx
mov dword [rsp + 0x74], ebx
inc edi
mov dword [rsp + 0x48], edi
mov eax, dword [rsp + 0x50]
jmp 0x140060c64
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AddAccessAllowedAceEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140060d6b
mov qword [rsp + 0x20], r14
mov r9d, dword [rsp + 0x108]
mov edx, 2
lea r8d, [rdx + 1]
mov rcx, r13
call rax
test al, al
jne 0x140060da3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
mov r9, r14
mov r8d, dword [rsp + 0x108]
mov edx, 2
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x140060da3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAccessAllowedAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
cmp dword [rsp + 0x34], 0
je 0x140060e40
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140060e40
nop word [rax + rax]
cmp edi, eax
jae 0x140060e40
lea r8, [rsp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x140060df5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
mov r9, qword [rsp + 0x60]
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
or r8d, 0xffffffff
mov edx, 2
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x140060e34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AddAce___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
inc edi
mov dword [rsp + 0x48], edi
mov eax, dword [rsp + 0x50]
jmp 0x140060dc0
xor r9d, r9d
mov r8, r13
lea edx, [r9 + 1]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x140060e77
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorDacl___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetSecurityDescriptorControl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140060f39
mov bx, si
mov word [rsp + 0x30], si
mov dword [rsp + 0x70], esi
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x140060ede
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSecurityDescriptorControl___failed.Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
movzx eax, word [rsp + 0x30]
mov ecx, 0x400
test cx, ax
je 0x140060ef7
mov ebx, 0x500
mov si, bx
jmp 0x140060f07
mov ecx, 0x1000
test cx, ax
je 0x140060f07
mov si, cx
mov bx, cx
test si, si
je 0x140060f39
movzx r8d, bx
movzx edx, si
lea rcx, [rsp + 0x90]
call rdi
test al, al
jne 0x140060f39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetSecurityDescriptorControl___failed.Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
lea r8, [rsp + 0x90]
mov edx, 4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x140060f67
mov edx, eax
lea rcx, str.RegSetKeySecurity___failed._Error__d_n
call fcn.14006943c
xor bl, bl
jmp 0x140060f69
mov bl, 1
test r15, r15
je 0x140060f82
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x140060f9b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140060fab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret