Function at 0x10037f40
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b77b0
push 0x10070640
mov eax, dword fs:[0]
push eax
add esp, 0xfffffdd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x238]
mov ecx, 0x88
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10138e70]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], str.Everyone
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x138], 4
mov dword [ebp - 0x144], 0
mov dword [ebp - 4], 0
mov esi, esp
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x54]
push edx
lea eax, [ebp - 0x78]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x10038061
jmp 0x10038624
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.100705ff
cmp eax, 0x7a
je 0x1003807a
jmp 0x10038624
mov esi, esp
mov eax, dword [ebp - 0x78]
push eax
push 8
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp edi, esp
call fcn.100705ff
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x100380ad
jmp 0x10038624
mov eax, dword [ebp - 0x60]
shl eax, 1
mov esi, esp
push eax
push 8
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp edi, esp
call fcn.100705ff
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x100380e2
jmp 0x10038624
mov esi, esp
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x54]
push edx
lea eax, [ebp - 0x78]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x1003811f
jmp 0x10038624
mov esi, esp
lea eax, [ebp - 0x90]
push eax
push 0
mov ecx, dword [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x138]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x1003815f
jmp 0x10038624
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.100705ff
cmp eax, 0x7a
je 0x10038178
jmp 0x10038624
mov esi, esp
mov eax, dword [ebp - 0x90]
push eax
push 8
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp edi, esp
call fcn.100705ff
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x100381b4
jmp 0x10038624
mov esi, esp
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x90]
push ecx
mov edx, dword [ebp - 0x84]
push edx
mov eax, dword [ebp - 0x138]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x100381f7
jmp 0x10038624
mov esi, esp
push 1
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x10038218
jmp 0x10038624
mov esi, esp
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0xc4]
push edx
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x1003824c
jmp 0x10038624
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xe0], 8
cmp dword [ebp - 0xb8], 0
jne 0x1003827d
mov dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 0
je 0x100382b0
mov esi, esp
push 2
push 0xc
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0xb8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x100382b0
jmp 0x10038624
mov esi, esp
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
cmp esi, esp
call fcn.100705ff
mov ecx, dword [ebp - 0xe0]
lea edx, [ecx + eax + 8]
mov dword [ebp - 0xfc], edx
mov esi, esp
mov eax, dword [ebp - 0xfc]
push eax
push 8
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp edi, esp
call fcn.100705ff
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.100705ff
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jne 0x1003830f
jmp 0x10038624
mov esi, esp
push 2
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, dword [ebp - 0xf0]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x10038337
jmp 0x10038624
mov dword [ebp - 0x120], 0
cmp dword [ebp - 0xc4], 0
je 0x10038435
cmp dword [ebp - 0xe4], 0
je 0x10038435
mov dword [ebp - 0x114], 0
jmp 0x10038376
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0xe4]
jae 0x10038435
mov esi, esp
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetAce]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x100383b5
jmp 0x10038624
mov eax, dword [ebp - 0x108]
movzx ecx, byte [eax + 1]
and ecx, 0x10
je 0x100383c6
jmp 0x10038435
mov eax, dword [ebp - 0x108]
add eax, 8
mov esi, esp
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
cmp esi, esp
call fcn.100705ff
test eax, eax
je 0x100383ec
jmp 0x10038367
mov eax, dword [ebp - 0x108]
movzx ecx, word [eax + 2]
mov esi, esp
push ecx
mov edx, dword [ebp - 0x108]
push edx
push 0xffffffffffffffff
push 2
mov eax, dword [ebp - 0xf0]
push eax
call dword [sym.imp.ADVAPI32.dll_AddAce]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x10038421
jmp 0x10038624
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
jmp 0x10038367
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xf0]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.10039020
test eax, eax
jne 0x10038451
jmp 0x10038624
cmp dword [ebp - 0xc4], 0
je 0x100384f1
cmp dword [ebp - 0xe4], 0
je 0x100384f1
jmp 0x1003847c
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0xe4]
jae 0x100384f1
mov esi, esp
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetAce]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x100384b7
jmp 0x10038624
mov eax, dword [ebp - 0x108]
movzx ecx, word [eax + 2]
mov esi, esp
push ecx
mov edx, dword [ebp - 0x108]
push edx
push 0xffffffffffffffff
push 2
mov eax, dword [ebp - 0xf0]
push eax
call dword [sym.imp.ADVAPI32.dll_AddAce]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x100384ec
jmp 0x10038624
jmp 0x1003846d
mov esi, esp
push 0
mov eax, dword [ebp - 0xf0]
push eax
push 1
lea ecx, [ebp - 0xac]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x1003851b
jmp 0x10038624
xor eax, eax
mov word [ebp - 0x150], ax
xor eax, eax
mov word [ebp - 0x15c], ax
xor eax, eax
mov word [ebp - 0x168], ax
mov dword [ebp - 0x174], 0
mov esi, esp
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x168]
push ecx
mov edx, dword [ebp - 0x84]
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x1003856d
jmp 0x10038624
movzx eax, word [ebp - 0x168]
and eax, 0x400
je 0x10038597
mov eax, 0x500
mov word [ebp - 0x150], ax
mov ax, word [ebp - 0x150]
mov word [ebp - 0x15c], ax
jmp 0x100385bf
movzx eax, word [ebp - 0x168]
and eax, 0x1000
je 0x100385bf
mov eax, 0x1000
mov word [ebp - 0x150], ax
mov ax, word [ebp - 0x150]
mov word [ebp - 0x15c], ax
movzx eax, word [ebp - 0x150]
test eax, eax
je 0x100385f6
mov esi, esp
movzx eax, word [ebp - 0x15c]
push eax
movzx ecx, word [ebp - 0x150]
push ecx
lea edx, [ebp - 0xac]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorControl]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x100385f6
jmp 0x10038624
mov esi, esp
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
cmp esi, esp
call fcn.100705ff
test eax, eax
jne 0x1003861d
jmp 0x10038624
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.10038635
jmp 0x100386ee
mov eax, dword [ebp - 0x30]
push edx
mov ecx, ebp
push eax
lea edx, [0x10038730]
call fcn.100705a7
pop eax
pop edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1006f41a
add esp, 0x238
cmp ebp, esp
call fcn.100705ff
mov esp, ebp
pop ebp
ret 4