Function at 0x41b048
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
xor esi, esi
push edi
xor eax, eax
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x10], esi
cmp dword [ebp + 8], esi
jne 0x41b07d
xor al, al
jmp 0x41b330
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41b076
lea eax, [ebp - 8]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 2
push dword [ebp - 4]
call esi
test eax, eax
jne 0x41b0b6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41b076
push ebx
mov edi, 0x43f708
push edi
push dword [ebp - 8]
call fcn.00422ead
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41b1a3
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push 2
push dword [ebp - 4]
call esi
test eax, eax
je 0x41b114
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebp - 4]
call esi
test eax, eax
jne 0x41b102
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41b114
push edi
push dword [ebp - 8]
call fcn.00422ead
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x41b11c
push ebx
call fcn.00422a18
jmp 0x41b176
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
push eax
push 1
push dword [ebp - 4]
call esi
test eax, eax
je 0x41b167
mov esi, dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 7
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41b153
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41b167
push edi
push dword [ebp - 8]
call fcn.00422ead
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x28], edi
test edi, edi
jne 0x41b179
push ebx
call fcn.00422a18
push dword [ebp - 0xc]
call fcn.00422a18
pop ecx
pop ecx
jmp 0x41b1a3
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 7
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41b1b3
push ebx
call fcn.00422a18
push dword [ebp - 0xc]
call fcn.00422a18
push edi
call fcn.00422a18
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
jmp 0x41b32f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x41b1f6
mov byte [ebp + 0xb], 0
push ebx
call fcn.00422a18
push dword [ebp - 0xc]
call fcn.00422a18
push edi
call fcn.00422a18
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [ebp + 0xb]
jmp 0x41b32f
xor esi, esi
cmp dword [ebp - 0x1c], esi
jne 0x41b203
mov byte [ebp + 0xb], 1
jmp 0x41b1ce
push 2
push 0xc
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x41b1ca
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x34], esi
jbe 0x41b2f5
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x41b2e3
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41b2e3
cmp byte [eax], 1
jne 0x41b298
mov ecx, dword [ebp - 0xc]
push dword [ecx]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41b26a
mov ecx, dword [eax + 4]
or dword [ebp - 0x18], ecx
and dword [ebp + 8], 0
cmp dword [ebx], 0
jbe 0x41b298
lea esi, [ebx + 4]
push dword [esi]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41b28b
mov ecx, dword [eax + 4]
or dword [ebp - 0x18], ecx
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
add esi, 8
cmp ecx, dword [ebx]
jb 0x41b276
cmp byte [eax], 0
jne 0x41b2e3
mov ecx, dword [ebp - 0xc]
push dword [ecx]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41b2b5
mov ecx, dword [eax + 4]
or dword [ebp - 0x14], ecx
and dword [ebp + 8], 0
cmp dword [ebx], 0
jbe 0x41b2e3
lea esi, [ebx + 4]
push dword [esi]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41b2d6
mov ecx, dword [eax + 4]
or dword [ebp - 0x14], ecx
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
add esi, 8
cmp ecx, dword [ebx]
jb 0x41b2c1
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x34]
jb 0x41b22a
mov edi, dword [ebp - 0x28]
push ebx
call fcn.00422a18
push dword [ebp - 0xc]
call fcn.00422a18
push edi
call fcn.00422a18
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x14]
mov eax, 0x1201b6
and ecx, eax
cmp ecx, eax
jne 0x41b32d
test dword [ebp - 0x18], eax
jne 0x41b32d
xor eax, eax
inc eax
jmp 0x41b32f
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret