Function at 0x421cc0
Capabilities:
Check if file exists
Compare security identifiers
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
push eax
mov byte [ebp - 3], 0
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ebx
call fcn.00410cf0
add esp, 4
mov esi, eax
push esi
call fcn.0040b550
push 0x44dbe8
mov edi, eax
call fcn.0040b550
add esp, 8
cmp eax, edi
jg 0x421d87
push ebx
push eax
push ebx
push 0x44dbe8
push eax
sub edi, eax
push edi
push esi
call fcn.0040b840
add esp, 0x1c
test eax, eax
sete al
test al, al
je 0x421d87
push esi
call fcn.0040b550
push 0x444c54
mov edi, eax
call fcn.0040b550
add esp, 8
cmp eax, edi
jg 0x421d87
push ebx
push eax
push ebx
push 0x444c54
push eax
sub edi, eax
push edi
push esi
call fcn.0040b840
add esp, 0x1c
test eax, eax
sete al
test al, al
je 0x421d87
push esi
call fcn.0040b550
dec eax
push eax
push ebx
push esi
call fcn.0040b780
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0x14
mov esi, edi
jmp 0x421cf7
push 1
push esi
call fcn.004110e0
mov edi, eax
add esp, 8
push edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x421f9a
test al, 0x10
je 0x421f9a
test eax, 0x400
jne 0x421f9a
lea ecx, [ebp - 0xc]
push ecx
call fcn.00421bf0
add esp, 4
test al, al
je 0x421f86
lea edx, [ebp - 0x10]
push edx
call fcn.00421ad0
add esp, 4
test al, al
je 0x421f86
lea eax, [ebp - 0x1c]
push eax
push ebx
lea ecx, [ebp - 0x18]
push ecx
push ebx
lea edx, [ebp - 0x14]
push edx
push 5
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
je 0x421e15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.W32Util_IsDirectorySafe
push str._s:_GetNamedSecurityInfoW_failed:__d_n
jmp 0x421fa5
cmp dword [ebp - 0x18], ebx
jne 0x421e2a
push esi
push str.W32Util_IsDirectorySafe
push str._s:_Failed_DACL_presence_check____s__n
jmp 0x421fa5
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x421e60
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
push eax
mov eax, dword [ebp - 0x10]
push eax
call edi
test eax, eax
jne 0x421e60
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
push ecx
push edx
call edi
test eax, eax
jne 0x421e60
push esi
push str.W32Util_IsDirectorySafe
push str._s:_Failed_owner_SID_match____s__n
jmp 0x421fa5
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x421e8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.W32Util_IsDirectorySafe
push str._s:_GetSecurityDescriptorControl_failed:__d_n
jmp 0x421fa5
test dword [ebp - 0x28], 0x1000
jne 0x421ea5
push esi
push str.W32Util_IsDirectorySafe
push str._s:_Failed_DACL_inherit_check____s__n
jmp 0x421fa5
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclW]
test eax, eax
je 0x421ed1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.W32Util_IsDirectorySafe
push str._s:_GetExplicitEntriesFromAclW_failed:__d_n
jmp 0x421fa5
cmp dword [ebp - 0x24], 2
je 0x421ee7
push esi
push str.W32Util_IsDirectorySafe
push str._s:_Failed_DACL_num_entries_check____s__n
jmp 0x421fa5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], ebx
xor edi, edi
jmp 0x421ef3
xor ebx, ebx
cmp dword [edi + eax + 0x14], ebx
jne 0x421f6c
mov ebx, dword [edi + eax + 0x1c]
mov eax, dword [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x421f25
mov eax, dword [ebp - 8]
cmp dword [edi + eax + 4], 1
jne 0x421f4b
test dword [edi + eax], 0x20000
je 0x421f4b
mov byte [ebp - 2], 1
jmp 0x421f4b
mov ecx, dword [ebp - 0x10]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
mov eax, dword [ebp - 8]
je 0x421f4b
cmp dword [edi + eax + 4], 1
jne 0x421f4b
test dword [edi + eax], 0x20000
je 0x421f4b
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x20]
inc ecx
add edi, 0x20
mov dword [ebp - 0x20], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x421ef1
cmp byte [ebp - 1], 0
je 0x421f79
cmp byte [ebp - 2], 0
je 0x421f79
mov byte [ebp - 3], 1
jmp 0x421fad
push esi
push str.W32Util_IsDirectorySafe
push str._s:_Failed_trustee_SID_identity_check____s__n
jmp 0x421fa5
push esi
push str.W32Util_IsDirectorySafe
push str._s:_Failed_cur_user_and_admin_ACE_presence_check____s__n
jmp 0x421fa5
push str.W32Util_IsDirectorySafe
push str._s:_Couldnt_get_local_admin_or_user_SID_n
call fcn.00412850
add esp, 8
jmp 0x421fad
push esi
push str.W32Util_IsDirectorySafe
push str._s:_Failed_directory_attributes_check____s__n
call fcn.00412850
add esp, 0xc
push esi
mov esi, dword [sym.imp.MSVCR90.dll_free]
call esi
mov edx, dword [ebp - 0x2c]
push edx
call esi
mov eax, dword [ebp - 0xc]
push eax
call esi
mov ecx, dword [ebp - 0x10]
push ecx
call esi
mov edx, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x10
push edx
call esi
mov eax, dword [ebp - 8]
push eax
call esi
mov al, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret