Function at 0x4016b0
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x3020
call fcn.00444620
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3030]
push edi
xor edi, edi
cmp esi, edi
mov dword [esp + 0x18], edi
je 0x4016dd
cmp byte [esi], 0
jne 0x4016dd
mov dword [esp + 0x3034], edi
mov esi, edi
mov ebx, dword [esp + 0x3038]
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
je 0x401a97
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x401a97
cmp dword [esp + 0x20], edi
je 0x401a97
mov eax, dword [esp + 0x18]
cmp eax, edi
jne 0x401762
push esi
push 0x445570
call fcn.00401370
mov ecx, dword [esp + 0x3048]
mov edx, dword [esp + 0x304c]
add esp, 8
mov dword [ecx], eax
mov dword [edx], eax
mov eax, dword [esp + 0x3048]
mov dword [eax], edi
mov dword [ecx + 4], edi
mov dword [edx + 4], edi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x3020
ret
xor ebp, ebp
xor ecx, ecx
cmp word [eax + 4], di
mov dword [esp + 0x14], ecx
jbe 0x4018dd
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov ebx, dword [esp + 0x1c]
mov al, byte [ebx]
test al, al
je 0x401793
cmp al, 1
jne 0x4018c2
test byte [ebx + 1], 8
jne 0x4018c2
add ebx, 8
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x4018c2
mov esi, dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0x445580
push ebx
call esi
test eax, eax
je 0x4017f3
mov edx, dword [esp + 0x3038]
lea eax, [esp + 0x24]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
test eax, eax
je 0x4018c2
mov ebx, dword [esp + 0x10]
cmp ebx, edi
je 0x4018c2
jmp 0x40182f
push 0x445590
push ebx
call esi
test eax, eax
je 0x40182f
mov edx, dword [esp + 0x3038]
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
test eax, eax
je 0x4018c2
mov ebx, dword [esp + 0x10]
cmp ebx, edi
je 0x4018c2
cmp dword [0x453014], edi
jne 0x401843
push 0x4455a0
push ebx
call esi
test eax, eax
jne 0x4018c2
test ebp, ebp
jbe 0x401869
lea esi, [esp + 0x30]
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x401865
inc edi
add esi, 0xc
cmp edi, ebp
jb 0x40184b
jmp 0x401869
cmp edi, ebp
jb 0x40189e
lea eax, [ebp + 1]
cmp eax, 0x400
jae 0x401940
mov edx, dword [esp + 0x3034]
lea esi, [edi + edi*2]
push edx
push ebx
mov ebp, eax
shl esi, 2
call fcn.00401370
add esp, 8
mov dword [esp + esi + 0x30], eax
xor eax, eax
mov dword [esp + esi + 0x34], eax
mov dword [esp + esi + 0x38], eax
mov ecx, dword [esp + 0x1c]
cmp byte [ecx], 0
jne 0x4018b0
lea eax, [edi + edi*2]
lea eax, [esp + eax*4 + 0x34]
jmp 0x4018b7
lea edx, [edi + edi*2]
lea eax, [esp + edx*4 + 0x38]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
or edx, ecx
xor edi, edi
mov dword [eax], edx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
xor edx, edx
inc ecx
mov dx, word [eax + 4]
mov dword [esp + 0x14], ecx
cmp ecx, edx
jl 0x401774
cmp ebp, edi
jbe 0x40192e
mov edi, dword [esp + 0x303c]
lea esi, [esp + 0x34]
mov dword [esp + 0x14], ebp
mov eax, dword [esi]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 4]
mov edx, dword [edi]
mov bl, al
mov eax, dword [esi]
mov ecx, edi
neg bl
sbb ebx, ebx
push eax
and ebx, 0x80000000
call dword [edx + 8]
neg al
sbb eax, eax
add esi, 0xc
and eax, 0x40000000
or ebx, eax
mov eax, dword [esp + 0x14]
mov dword [esi - 0xc], ebx
dec eax
mov dword [esp + 0x14], eax
jne 0x4018f0
xor edi, edi
cmp ebp, edi
mov dword [esp + 0x10], edi
jbe 0x4019c9
lea ebx, [esp + 0x38]
jmp 0x401967
mov eax, dword [0x453020]
push 0x10
push str.Share_Enum
push str.Internal_error:_Too_many_accounts_in_ACL
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x3020
ret
xor edi, edi
lea esi, [esp + 0x30]
cmp dword [esp + 0x10], edi
je 0x4019af
mov ecx, dword [esi]
mov eax, dword [ecx + 0x18]
cmp eax, 2
je 0x401985
cmp eax, 5
je 0x401985
cmp eax, 4
jne 0x4019af
mov ecx, dword [ecx]
push 0x445570
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4019af
mov edx, dword [esi + 4]
mov eax, dword [ebx - 4]
not edx
and eax, edx
mov dword [ebx - 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [ebx]
not eax
and ecx, eax
mov dword [ebx], ecx
inc edi
add esi, 0xc
cmp edi, ebp
jb 0x40196b
mov eax, dword [esp + 0x10]
add ebx, 0xc
inc eax
cmp eax, ebp
mov dword [esp + 0x10], eax
jb 0x401965
xor edi, edi
push 0x401680
push 0xc
lea ecx, [esp + 0x38]
push ebp
push ecx
call dword [sym.imp.MSVCRT.dll_qsort]
add esp, 0x10
mov dword [esp + 0x10], edi
test ebp, ebp
mov dword [esp + 0x18], edi
jbe 0x401a58
mov edx, dword [esp + 0x3048]
mov esi, dword [esp + 0x3044]
mov ebx, dword [esp + 0x3040]
lea eax, [esp + 0x30]
mov dword [esp + 0x14], ebp
mov ecx, dword [eax + 4]
test ecx, 0x80000000
je 0x401a23
mov ebp, dword [eax]
mov dword [ebx], ebp
mov ebp, dword [esp + 0x10]
inc ebp
add ebx, 4
mov dword [esp + 0x10], ebp
test ecx, 0x40000000
je 0x401a3b
mov ebp, dword [esp + 0x18]
mov ecx, dword [eax]
inc ebp
mov dword [esi], ecx
mov dword [esp + 0x18], ebp
add esi, 4
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x401a4a
mov ecx, dword [eax]
inc edi
mov dword [edx], ecx
add edx, 4
mov ecx, dword [esp + 0x14]
add eax, 0xc
dec ecx
mov dword [esp + 0x14], ecx
jne 0x401a08
mov edx, dword [esp + 0x3040]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x3044]
mov dword [edx + eax*4], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x3048]
mov dword [ecx + edx*4], 0
mov dword [eax + edi*4], 0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x3020
ret
mov eax, dword [esp + 0x3040]
mov ecx, dword [esp + 0x3044]
mov edx, dword [esp + 0x3048]
mov dword [eax], 0xffffffff
mov dword [ecx], 0xffffffff
mov dword [edx], 0xffffffff
mov dword [eax + 4], edi
mov dword [ecx + 4], edi
mov dword [edx + 4], edi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x3020
ret