Function at 0x41abd9
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
xor esi, esi
push edi
xor eax, eax
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x10], esi
cmp dword [ebp + 8], esi
jne 0x41ac0e
xor al, al
jmp 0x41aec1
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41ac07
lea eax, [ebp - 8]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 2
push dword [ebp - 4]
call esi
test eax, eax
jne 0x41ac47
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41ac07
push ebx
mov edi, 0x4407c8
push edi
push dword [ebp - 8]
call fcn.00421e0b
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41ad34
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push 2
push dword [ebp - 4]
call esi
test eax, eax
je 0x41aca5
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebp - 4]
call esi
test eax, eax
jne 0x41ac93
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41aca5
push edi
push dword [ebp - 8]
call fcn.00421e0b
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x41acad
push ebx
call fcn.00421976
jmp 0x41ad07
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
push eax
push 1
push dword [ebp - 4]
call esi
test eax, eax
je 0x41acf8
mov esi, dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 7
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41ace4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41acf8
push edi
push dword [ebp - 8]
call fcn.00421e0b
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x28], edi
test edi, edi
jne 0x41ad0a
push ebx
call fcn.00421976
push dword [ebp - 0xc]
call fcn.00421976
pop ecx
pop ecx
jmp 0x41ad34
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 7
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41ad44
push ebx
call fcn.00421976
push dword [ebp - 0xc]
call fcn.00421976
push edi
call fcn.00421976
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
jmp 0x41aec0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x41ad87
mov byte [ebp + 0xb], 0
push ebx
call fcn.00421976
push dword [ebp - 0xc]
call fcn.00421976
push edi
call fcn.00421976
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [ebp + 0xb]
jmp 0x41aec0
xor esi, esi
cmp dword [ebp - 0x1c], esi
jne 0x41ad94
mov byte [ebp + 0xb], 1
jmp 0x41ad5f
push 2
push 0xc
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x41ad5b
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x34], esi
jbe 0x41ae86
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x41ae74
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41ae74
cmp byte [eax], 1
jne 0x41ae29
mov ecx, dword [ebp - 0xc]
push dword [ecx]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41adfb
mov ecx, dword [eax + 4]
or dword [ebp - 0x18], ecx
and dword [ebp + 8], 0
cmp dword [ebx], 0
jbe 0x41ae29
lea esi, [ebx + 4]
push dword [esi]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41ae1c
mov ecx, dword [eax + 4]
or dword [ebp - 0x18], ecx
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
add esi, 8
cmp ecx, dword [ebx]
jb 0x41ae07
cmp byte [eax], 0
jne 0x41ae74
mov ecx, dword [ebp - 0xc]
push dword [ecx]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41ae46
mov ecx, dword [eax + 4]
or dword [ebp - 0x14], ecx
and dword [ebp + 8], 0
cmp dword [ebx], 0
jbe 0x41ae74
lea esi, [ebx + 4]
push dword [esi]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41ae67
mov ecx, dword [eax + 4]
or dword [ebp - 0x14], ecx
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
add esi, 8
cmp ecx, dword [ebx]
jb 0x41ae52
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x34]
jb 0x41adbb
mov edi, dword [ebp - 0x28]
push ebx
call fcn.00421976
push dword [ebp - 0xc]
call fcn.00421976
push edi
call fcn.00421976
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x14]
mov eax, 0x1201b6
and ecx, eax
cmp ecx, eax
jne 0x41aebe
test dword [ebp - 0x18], eax
jne 0x41aebe
xor eax, eax
inc eax
jmp 0x41aec0
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret