Function at 0x478030
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
sub esp, 0x40
mov eax, 1
push ebx
push edi
xor edi, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4c]
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
cmp eax, edi
je 0x478269
push esi
mov esi, dword [esp + 0x54]
cmp esi, edi
je 0x478271
lea ecx, [esp + 0x1c]
push ecx
push 0x1f6
push eax
push edi
call sub.NETAPI32.dll_NetShareGetInfo
test eax, eax
jne 0x478236
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
je 0x478236
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
mov edx, dword [ecx + 0x24]
lea eax, [esp + 0x2c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x478236
mov eax, dword [esp + 0xc]
cmp word [eax + 4], di
jbe 0x478236
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
lea eax, [esp + 0x28]
push eax
push edi
push esi
push edi
call ebp
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x478235
cmp dword [esp + 0x14], ebx
jbe 0x478235
push eax
call fcn.0048690e
mov edi, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048690e
mov ebx, eax
mov eax, dword [esp + 0x24]
push eax
push 0
push edi
call fcn.00487630
mov ecx, dword [esp + 0x28]
lea edx, [ecx + ecx]
push edx
push 0
push ebx
call fcn.00487630
add esp, 0x20
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
lea edx, [esp + 0x28]
push edx
push edi
push esi
push 0
call ebp
test eax, eax
je 0x478235
mov eax, dword [esp + 0x10]
xor ecx, ecx
xor esi, esi
cmp cx, word [eax + 4]
jae 0x478235
mov ebp, dword [sym.imp.ADVAPI32.dll_GetAce]
lea edx, [esp + 0x30]
push edx
push esi
push eax
call ebp
test eax, eax
je 0x478235
mov eax, dword [esp + 0x30]
test byte [eax + 1], 0x10
jne 0x478235
add eax, 8
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4781c0
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 4]
inc esi
cmp esi, ecx
jl 0x478183
jmp 0x478235
mov edx, dword [esp + 0x10]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
mov dword [esp + 0x18], 0
test eax, eax
je 0x478235
push 1
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x478235
mov ecx, dword [esp + 0x10]
push 0
push ecx
push 1
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x478235
mov edx, dword [esp + 0x54]
push 0
lea ecx, [esp + 0x38]
push ecx
push 0x5dd
push edx
lea eax, [esp + 0x4c]
push 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
call sub.NETAPI32.dll_NetShareSetInfo
test eax, eax
jne 0x478235
mov dword [esp + 0x18], 1
pop ebp
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x478244
push eax
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
je 0x478251
push edi
call fcn.00487d04
add esp, 4
test ebx, ebx
je 0x47825e
push ebx
call fcn.00487d04
add esp, 4
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
add esp, 0x40
ret
pop edi
mov eax, ecx
pop ebx
add esp, 0x40
ret
pop esi
pop edi
mov eax, ecx
pop ebx
add esp, 0x40
ret