Function at 0x4debf0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push str.advapi32.dll
mov dword [esi], 0x5e263c
mov dword [esi + 4], ebx
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x4dec1b
cmp eax, 0xffffffff
jne 0x4dec1e
mov byte [esi + 8], bl
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp eax, ebx
mov dword [esi], 0x5e2850
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
je 0x4dec82
cmp eax, 0xffffffff
je 0x4dec82
push str.RegCreateKeyExW
push eax
call edi
mov ecx, eax
cmp ecx, ebx
jne 0x4dec85
mov byte [esi + 8], bl
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 4]
xor eax, eax
cmp ecx, ebx
je 0x4deca2
cmp ecx, 0xffffffff
je 0x4deca2
push str.RegOpenKeyExW
push ecx
call edi
cmp eax, ebx
jne 0x4deca5
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x10], eax
xor eax, eax
cmp ecx, ebx
je 0x4decc2
cmp ecx, 0xffffffff
je 0x4decc2
push str.RegDeleteKeyW
push ecx
call edi
cmp eax, ebx
jne 0x4decc5
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
xor eax, eax
cmp ecx, ebx
je 0x4dece2
cmp ecx, 0xffffffff
je 0x4dece2
push str.RegDeleteValueW
push ecx
call edi
cmp eax, ebx
jne 0x4dece5
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x18], eax
xor eax, eax
cmp ecx, ebx
je 0x4ded02
cmp ecx, 0xffffffff
je 0x4ded02
push str.RegQueryValueExW
push ecx
call edi
cmp eax, ebx
jne 0x4ded05
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x1c], eax
xor eax, eax
cmp ecx, ebx
je 0x4ded22
cmp ecx, 0xffffffff
je 0x4ded22
push str.RegSetValueExW
push ecx
call edi
cmp eax, ebx
jne 0x4ded25
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x20], eax
xor eax, eax
cmp ecx, ebx
je 0x4ded42
cmp ecx, 0xffffffff
je 0x4ded42
push str.AllocateAndInitializeSid
push ecx
call edi
cmp eax, ebx
jne 0x4ded45
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x24], eax
xor eax, eax
cmp ecx, ebx
je 0x4ded62
cmp ecx, 0xffffffff
je 0x4ded62
push str.GetNamedSecurityInfoA
push ecx
call edi
cmp eax, ebx
jne 0x4ded65
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x28], eax
xor eax, eax
cmp ecx, ebx
je 0x4ded7e
cmp ecx, 0xffffffff
je 0x4ded7e
push str.GetNamedSecurityInfoW
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x2c], eax
xor eax, eax
cmp ecx, ebx
je 0x4ded9b
cmp ecx, 0xffffffff
je 0x4ded9b
push str.GetSecurityInfo
push ecx
call edi
cmp eax, ebx
jne 0x4ded9e
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x30], eax
xor eax, eax
cmp ecx, ebx
je 0x4dedbb
cmp ecx, 0xffffffff
je 0x4dedbb
push str.SetEntriesInAclA
push ecx
call edi
cmp eax, ebx
jne 0x4dedbe
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x34], eax
xor eax, eax
cmp ecx, ebx
je 0x4dedd7
cmp ecx, 0xffffffff
je 0x4dedd7
push str.SetEntriesInAclW
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x38], eax
xor eax, eax
cmp ecx, ebx
je 0x4dedf4
cmp ecx, 0xffffffff
je 0x4dedf4
push str.SetNamedSecurityInfoA
push ecx
call edi
cmp eax, ebx
jne 0x4dedf7
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x3c], eax
xor eax, eax
cmp ecx, ebx
je 0x4dee10
cmp ecx, 0xffffffff
je 0x4dee10
push str.SetNamedSecurityInfoW
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x40], eax
xor eax, eax
cmp ecx, ebx
je 0x4dee2d
cmp ecx, 0xffffffff
je 0x4dee2d
push str.SetSecurityInfo
push ecx
call edi
cmp eax, ebx
jne 0x4dee30
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x44], eax
xor eax, eax
cmp ecx, ebx
je 0x4dee4d
cmp ecx, 0xffffffff
je 0x4dee4d
push str.FreeSid
push ecx
call edi
cmp eax, ebx
jne 0x4dee50
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x48], eax
xor eax, eax
cmp ecx, ebx
je 0x4dee6d
cmp ecx, 0xffffffff
je 0x4dee6d
push str.GetAclInformation
push ecx
call edi
cmp eax, ebx
jne 0x4dee70
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x4c], eax
xor eax, eax
cmp ecx, ebx
je 0x4dee8d
cmp ecx, 0xffffffff
je 0x4dee8d
push str.GetAce
push ecx
call edi
cmp eax, ebx
jne 0x4dee90
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x50], eax
xor eax, eax
cmp ecx, ebx
je 0x4deead
cmp ecx, 0xffffffff
je 0x4deead
push str.EqualSid
push ecx
call edi
cmp eax, ebx
jne 0x4deeb0
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x54], eax
xor eax, eax
cmp ecx, ebx
je 0x4deecd
cmp ecx, 0xffffffff
je 0x4deecd
push str.DeleteAce
push ecx
call edi
cmp eax, ebx
jne 0x4deed0
mov byte [esi + 8], bl
mov dword [esi + 0x58], eax
mov eax, dword [esi + 4]
xor ecx, ecx
cmp eax, ebx
je 0x4deef2
cmp eax, 0xffffffff
je 0x4deef2
push str.CreateWellKnownSid
push eax
call edi
mov dword [esi + 0x5c], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
pop edi
mov dword [esi + 0x5c], ecx
mov eax, esi
pop esi
pop ebx
ret