Function at 0x4034c0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
dec eax
je 0x403810
dec eax
je 0x4036b4
dec eax
jne 0x4039d7
mov ebx, dword [esp + 0x18]
push edi
lea eax, [esp + 0x18]
push edi
push eax
push edi
push edi
push 4
push 4
push ebx
mov dword [esp + 0x34], edi
call sub.ADVAPI32.dll_GetNamedSecurityInfoW
mov ebp, eax
cmp ebp, edi
jne 0x40352e
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
jne 0x403609
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 0x538
jne 0x40360d
mov ebp, 5
mov al, byte [0x411042]
test al, al
jne 0x403544
mov al, byte [0x411041]
test al, al
je 0x4039d7
mov eax, dword [0x41e04c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
je 0x4035cf
push str.DALS
push 0x41de54
call fcn.0040762a
add esp, 8
or ecx, 0xffffffff
xor eax, eax
push edi
mov edi, 0x41de54
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
call esi
mov eax, dword [0x41e04c]
test eax, eax
je 0x4035cf
push ebx
push str._from_key__ls
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push edx
call esi
mov eax, dword [0x41e04c]
cmp ebp, 2
je 0x4036a2
cmp ebp, 3
je 0x4036a2
cmp ebp, 5
jne 0x403682
test eax, eax
je 0x4039d7
push str.____FAILED__Error__ERROR_ACCESS_DENIED_r_n
push 0x41de54
call fcn.0040762a
add esp, 8
jmp 0x403971
xor ebp, ebp
jmp 0x403615
cmp ebp, edi
jne 0x40352e
mov al, byte [0x411042]
test al, al
je 0x4039d7
cmp dword [0x41e04c], edi
je 0x4039d7
push str.DALS
push 0x41de54
call fcn.0040762a
add esp, 8
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x41e04c]
push edi
mov edi, 0x41de54
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x41e048
not ecx
dec ecx
push ecx
push 0x41de54
push edx
call esi
mov eax, dword [0x41e04c]
test eax, eax
je 0x4039d7
push ebx
push str._from_key__ls____OK_r_n
jmp 0x403964
test eax, eax
je 0x4039d7
push ebp
push str.____FAILED__Error___d_r_n
push 0x41de54
call fcn.0040762a
add esp, 0xc
jmp 0x4039b2
test eax, eax
je 0x4039d7
push str.____NOT_FOUND__OK__r_n
jmp 0x403918
mov ebx, dword [esp + 0x18]
push edi
push edi
lea eax, [esp + 0x1c]
push edi
push eax
push edi
push 2
push 4
push ebx
mov dword [esp + 0x34], edi
call sub.ADVAPI32.dll_GetNamedSecurityInfoW
mov ebp, eax
cmp ebp, edi
jne 0x4036f8
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x4037b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, edi
je 0x4039d7
mov al, byte [0x411042]
test al, al
jne 0x40370e
mov al, byte [0x411041]
test al, al
je 0x4039d7
mov eax, dword [0x41e04c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
je 0x403798
push str.GROUP
push 0x41de54
call fcn.0040762a
add esp, 8
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x41e04c]
push edi
mov edi, 0x41de54
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push edx
call esi
mov eax, dword [0x41e04c]
test eax, eax
je 0x403798
push ebx
push str._from_key__ls
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push 0x41de54
push eax
call esi
mov eax, dword [0x41e04c]
cmp ebp, 2
je 0x4037f1
cmp ebp, 3
je 0x4037f1
cmp ebp, 5
jne 0x4037d1
test eax, eax
je 0x4039d7
push str.____FAILED__Error__ERROR_ACCESS_DENIED_r_n
jmp 0x4039a5
mov eax, dword [esp + 0x14]
cmp eax, edi
jne 0x4037c8
push edi
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor ebp, ebp
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
test eax, eax
je 0x4039d7
push ebp
push str.____FAILED__Error___d_r_n
push 0x41de54
call fcn.0040762a
add esp, 0xc
jmp 0x403925
test eax, eax
je 0x4039d7
push str.____NOT_FOUND__OK__r_n
push 0x41de54
call fcn.0040762a
add esp, 8
jmp 0x403971
mov ebx, dword [esp + 0x18]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push edi
push ecx
push 1
push 4
push ebx
mov dword [esp + 0x34], edi
call sub.ADVAPI32.dll_GetNamedSecurityInfoW
mov ebp, eax
cmp ebp, edi
jne 0x403854
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x403951
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, edi
je 0x4039d7
mov al, byte [0x411042]
test al, al
jne 0x40386a
mov al, byte [0x411041]
test al, al
je 0x4039d7
mov eax, dword [0x41e04c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
je 0x4038f4
push str.OWNER
push 0x41de54
call fcn.0040762a
add esp, 8
or ecx, 0xffffffff
xor eax, eax
push edi
mov edi, 0x41de54
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0x41e048
not ecx
dec ecx
push ecx
push 0x41de54
push eax
call esi
mov eax, dword [0x41e04c]
test eax, eax
je 0x4038f4
push ebx
push str._from_key__ls
push 0x41de54
call fcn.0040762a
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
call esi
mov eax, dword [0x41e04c]
cmp ebp, 2
je 0x40399c
cmp ebp, 3
je 0x40399c
cmp ebp, 5
jne 0x40395a
test eax, eax
je 0x4039d7
push str.____FAILED__Error__ERROR_ACCESS_DENIED_r_n
push 0x41de54
call fcn.0040762a
add esp, 8
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x41e04c]
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0x41e048
push ecx
push 0x41de54
push edx
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
jmp 0x4037bd
test eax, eax
je 0x4039d7
push ebp
push str.____FAILED__Error___d_r_n
push 0x41de54
call fcn.0040762a
add esp, 0xc
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0x41e048
not ecx
dec ecx
push ecx
push 0x41de54
push eax
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
test eax, eax
je 0x4039d7
push str.____NOT_FOUND__OK__r_n
push 0x41de54
call fcn.0040762a
add esp, 8
mov edi, 0x41de54
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push 0x41de54
push ecx
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret