Function at 0x431660
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x478834]
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0xc], ebx
test eax, eax
jne 0x4318d3
push esi
cmp byte [0x478838], bl
jne 0x4317e7
push str.advapi32.dll
mov byte [0x478838], 1
call fcn.00434ff0
add esp, 4
mov dword [0x47883c], eax
test eax, eax
je 0x4317de
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetSecurityInfo
push eax
call esi
mov dword [0x479a14], eax
test eax, eax
je 0x4317de
mov eax, dword [0x47883c]
test eax, eax
je 0x4317d8
push str.SetSecurityInfo
push eax
call esi
mov dword [0x479a10], eax
test eax, eax
je 0x4317de
mov eax, dword [0x47883c]
test eax, eax
je 0x4317c9
push str.OpenProcessToken
push eax
call esi
mov dword [0x479a24], eax
test eax, eax
je 0x4317de
mov eax, dword [0x47883c]
test eax, eax
je 0x4317ba
push str.GetTokenInformation
push eax
call esi
mov dword [0x479a20], eax
test eax, eax
je 0x4317de
mov eax, dword [0x47883c]
test eax, eax
je 0x4317ab
push str.InitializeSecurityDescriptor
push eax
call esi
mov dword [0x479a1c], eax
test eax, eax
je 0x4317de
mov eax, dword [0x47883c]
test eax, eax
je 0x43179c
push str.SetSecurityDescriptorOwner
push eax
call esi
mov dword [0x479a18], eax
test eax, eax
je 0x4317de
mov eax, dword [0x47883c]
test eax, eax
je 0x43178d
push str.SetEntriesInAclA
push eax
call esi
mov dword [0x479a0c], eax
test eax, eax
je 0x4317de
mov al, 1
mov byte [0x478839], al
jmp 0x4317ec
xor al, al
mov dword [0x479a0c], ebx
mov byte [0x478839], al
jmp 0x4317ec
xor al, al
mov dword [0x479a18], ebx
mov byte [0x478839], al
jmp 0x4317ec
xor al, al
mov dword [0x479a1c], ebx
mov byte [0x478839], al
jmp 0x4317ec
xor al, al
mov dword [0x479a20], ebx
mov byte [0x478839], al
jmp 0x4317ec
xor al, al
mov dword [0x479a24], ebx
mov byte [0x478839], al
jmp 0x4317ec
mov dword [0x479a10], ebx
xor al, al
mov byte [0x478839], al
jmp 0x4317ec
mov al, byte [0x478839]
test al, al
je 0x4318a9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4318a9
lea ecx, [ebp - 4]
push ecx
push 8
push eax
call dword [0x479a24]
test eax, eax
je 0x4318a0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebp - 4]
call dword [0x479a20]
test eax, eax
jne 0x431846
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4318a0
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4318a0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push 1
push dword [ebp - 4]
call dword [0x479a20]
test eax, eax
je 0x4318a0
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
mov esi, eax
push 1
push esi
call fcn.004344b0
add esp, 0xc
mov edi, eax
push dword [ebx]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x4318a0
mov dword [0x478834], edi
mov dword [ebp - 0xc], edi
xor edi, edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
test eax, eax
je 0x4318b8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4318c3
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x4318d0
push edi
call fcn.00434320
add esp, 4
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret