Function at 0x4df4c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push str.advapi32.dll
mov dword [esi], 0x5e26a4
mov dword [esi + 4], ebx
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x4df4eb
cmp eax, 0xffffffff
jne 0x4df4ee
mov byte [esi + 8], bl
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp eax, ebx
mov dword [esi], 0x5e291c
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
je 0x4df55e
cmp eax, 0xffffffff
je 0x4df55e
push str.RegCreateKeyExW
push eax
call edi
mov ecx, eax
cmp ecx, ebx
jne 0x4df561
mov byte [esi + 8], bl
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 4]
xor eax, eax
cmp ecx, ebx
je 0x4df57e
cmp ecx, 0xffffffff
je 0x4df57e
push str.RegOpenKeyExW
push ecx
call edi
cmp eax, ebx
jne 0x4df581
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x10], eax
xor eax, eax
cmp ecx, ebx
je 0x4df59e
cmp ecx, 0xffffffff
je 0x4df59e
push str.RegDeleteKeyW
push ecx
call edi
cmp eax, ebx
jne 0x4df5a1
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
xor eax, eax
cmp ecx, ebx
je 0x4df5be
cmp ecx, 0xffffffff
je 0x4df5be
push str.RegDeleteValueW
push ecx
call edi
cmp eax, ebx
jne 0x4df5c1
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x18], eax
xor eax, eax
cmp ecx, ebx
je 0x4df5de
cmp ecx, 0xffffffff
je 0x4df5de
push str.RegQueryValueExW
push ecx
call edi
cmp eax, ebx
jne 0x4df5e1
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x1c], eax
xor eax, eax
cmp ecx, ebx
je 0x4df5fe
cmp ecx, 0xffffffff
je 0x4df5fe
push str.RegSetValueExW
push ecx
call edi
cmp eax, ebx
jne 0x4df601
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x20], eax
xor eax, eax
cmp ecx, ebx
je 0x4df61e
cmp ecx, 0xffffffff
je 0x4df61e
push str.AllocateAndInitializeSid
push ecx
call edi
cmp eax, ebx
jne 0x4df621
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x24], eax
xor eax, eax
cmp ecx, ebx
je 0x4df63e
cmp ecx, 0xffffffff
je 0x4df63e
push str.GetNamedSecurityInfoA
push ecx
call edi
cmp eax, ebx
jne 0x4df641
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x28], eax
xor eax, eax
cmp ecx, ebx
je 0x4df65a
cmp ecx, 0xffffffff
je 0x4df65a
push str.GetNamedSecurityInfoW
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x2c], eax
xor eax, eax
cmp ecx, ebx
je 0x4df677
cmp ecx, 0xffffffff
je 0x4df677
push str.GetSecurityInfo
push ecx
call edi
cmp eax, ebx
jne 0x4df67a
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x30], eax
xor eax, eax
cmp ecx, ebx
je 0x4df697
cmp ecx, 0xffffffff
je 0x4df697
push str.SetEntriesInAclA
push ecx
call edi
cmp eax, ebx
jne 0x4df69a
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x34], eax
xor eax, eax
cmp ecx, ebx
je 0x4df6b3
cmp ecx, 0xffffffff
je 0x4df6b3
push str.SetEntriesInAclW
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x38], eax
xor eax, eax
cmp ecx, ebx
je 0x4df6d0
cmp ecx, 0xffffffff
je 0x4df6d0
push str.SetNamedSecurityInfoA
push ecx
call edi
cmp eax, ebx
jne 0x4df6d3
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x3c], eax
xor eax, eax
cmp ecx, ebx
je 0x4df6ec
cmp ecx, 0xffffffff
je 0x4df6ec
push str.SetNamedSecurityInfoW
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x40], eax
xor eax, eax
cmp ecx, ebx
je 0x4df709
cmp ecx, 0xffffffff
je 0x4df709
push str.SetSecurityInfo
push ecx
call edi
cmp eax, ebx
jne 0x4df70c
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x44], eax
xor eax, eax
cmp ecx, ebx
je 0x4df729
cmp ecx, 0xffffffff
je 0x4df729
push str.FreeSid
push ecx
call edi
cmp eax, ebx
jne 0x4df72c
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x48], eax
xor eax, eax
cmp ecx, ebx
je 0x4df749
cmp ecx, 0xffffffff
je 0x4df749
push str.GetAclInformation
push ecx
call edi
cmp eax, ebx
jne 0x4df74c
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x4c], eax
xor eax, eax
cmp ecx, ebx
je 0x4df769
cmp ecx, 0xffffffff
je 0x4df769
push str.GetAce
push ecx
call edi
cmp eax, ebx
jne 0x4df76c
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x50], eax
xor eax, eax
cmp ecx, ebx
je 0x4df789
cmp ecx, 0xffffffff
je 0x4df789
push str.EqualSid
push ecx
call edi
cmp eax, ebx
jne 0x4df78c
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x54], eax
xor eax, eax
cmp ecx, ebx
je 0x4df7a9
cmp ecx, 0xffffffff
je 0x4df7a9
push str.DeleteAce
push ecx
call edi
cmp eax, ebx
jne 0x4df7ac
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x58], eax
xor eax, eax
cmp ecx, ebx
je 0x4df7c5
cmp ecx, 0xffffffff
je 0x4df7c5
push str.CreateWellKnownSid
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x5c], eax
xor eax, eax
cmp ecx, ebx
je 0x4df7e2
cmp ecx, 0xffffffff
je 0x4df7e2
push str.OpenProcessToken
push ecx
call edi
cmp eax, ebx
jne 0x4df7e5
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x60], eax
xor eax, eax
cmp ecx, ebx
je 0x4df802
cmp ecx, 0xffffffff
je 0x4df802
push str.GetTokenInformation
push ecx
call edi
cmp eax, ebx
jne 0x4df805
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x64], eax
xor eax, eax
cmp ecx, ebx
je 0x4df822
cmp ecx, 0xffffffff
je 0x4df822
push str.GetSidSubAuthority
push ecx
call edi
cmp eax, ebx
jne 0x4df825
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x68], eax
xor eax, eax
cmp ecx, ebx
je 0x4df842
cmp ecx, 0xffffffff
je 0x4df842
push str.GetSidSubAuthorityCount
push ecx
call edi
cmp eax, ebx
jne 0x4df845
mov byte [esi + 8], bl
mov dword [esi + 0x6c], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret