Function at 0x404a20
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x44
mov eax, dword [0x41a2b4]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x4c]
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x50]
push edi
mov edi, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], ecx
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 1
cmp edi, ebx
jne 0x404a76
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00404cda
add esp, 0x44
ret
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
push str.advapi32.dll
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x41bea0], eax
cmp eax, ebx
je 0x404a62
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AllocateAndInitializeSid
push eax
call esi
mov edx, dword [0x41bea0]
push str.SetEntriesInAclW
push edx
mov dword [esp + 0x28], eax
call esi
mov dword [esp + 0x1c], eax
mov eax, dword [0x41bea0]
push str.InitializeSecurityDescriptor
push eax
call esi
mov ecx, dword [0x41bea0]
push str.SetSecurityDescriptorDacl
push ecx
mov dword [esp + 0x20], eax
call esi
mov edx, dword [0x41bea0]
push str.FreeSid
push edx
mov dword [esp + 0x1c], eax
call esi
mov ecx, dword [esp + 0x20]
mov dword [0x41bea4], eax
cmp ecx, ebx
je 0x404c2f
cmp dword [esp + 0x1c], ebx
je 0x404c2f
cmp dword [esp + 0x18], ebx
je 0x404c2f
cmp dword [esp + 0x14], ebx
je 0x404c2f
cmp eax, ebx
je 0x404c2f
push ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [esp + 0x70]
push eax
call ecx
test eax, eax
je 0x404bc8
mov esi, dword [esp + 0x24]
mov edx, dword [ebp]
xor eax, eax
push esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
push ebx
lea eax, [esp + 0x30]
push eax
push 1
mov dword [esp + 0x38], 0x1f0003
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 3
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 5
mov dword [esp + 0x54], edx
call dword [esp + 0x2c]
test eax, eax
jne 0x404c25
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
cmp eax, ebx
jne 0x404bd1
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp]
push eax
call dword [0x41bea4]
mov ecx, dword [0x41bea0]
push ecx
jmp 0x404c36
push 1
push eax
call dword [esp + 0x20]
mov edx, dword [esp + 0x10]
test eax, eax
mov eax, dword [edx]
jne 0x404c02
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
call edi
mov ecx, dword [esi]
push ecx
call edi
mov edx, dword [ebp]
push edx
call dword [0x41bea4]
mov eax, dword [0x41bea0]
push eax
jmp 0x404c36
mov ecx, dword [esi]
push ebx
push ecx
push 1
push eax
call dword [esp + 0x24]
test eax, eax
jne 0x404c5d
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
push edx
call edi
mov eax, dword [esi]
push eax
call edi
mov ecx, dword [ebp]
push ecx
call dword [0x41bea4]
mov edx, dword [0x41bea0]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
pop ebp
mov dword [0x41bea4], ebx
mov dword [0x41bea0], ebx
xor al, al
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00404cda
add esp, 0x44
ret
mov eax, dword [esp + 0x10]
mov dword [edi], 0xc
mov ecx, dword [eax]
pop esi
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x4c]
mov dword [edi + 8], ebx
pop edi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.00404cda
add esp, 0x44
ret