Function at 0x1001524a
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
push 0x7c
push 0x1026e0a8
call fcn.101d4020
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x60], esi
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x2c], edi
xor ebx, ebx
inc ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 4], edi
push str.everyone
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100152ea
mov byte [ebp - 0x24], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1f], bl
lea eax, [ebp - 0x2c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100152c2
xor eax, eax
mov esi, 0xffff
jmp 0x100152d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xffff
and eax, esi
or eax, 0x80070000
mov dword [ebp - 0x28], eax
cmp eax, edi
jl 0x100157cc
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x100153bd
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push edi
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10015315
xor eax, eax
mov esi, 0xffff
jmp 0x10015327
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xffff
and eax, esi
or eax, 0x80070000
mov dword [ebp - 0x28], eax
cmp eax, edi
jl 0x1001533a
mov dword [ebp - 0x28], 0x80070057
jmp 0x100157cc
and eax, esi
cmp eax, 0x7a
jne 0x100157cc
push dword [ebp - 0x38]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x3c]
add eax, eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x2c], edi
je 0x100157c5
cmp eax, edi
je 0x100157c5
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x60]
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x100153a3
xor eax, eax
jmp 0x100153b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, esi
or eax, 0x80070000
mov dword [ebp - 0x28], eax
cmp eax, edi
jl 0x100157cc
xor edi, edi
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push 4
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
je 0x100153d9
xor eax, eax
jmp 0x100153e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, esi
or eax, 0x81070000
mov dword [ebp - 0x28], eax
cmp eax, edi
jl 0x100153f9
mov dword [ebp - 0x28], 0x81070057
jmp 0x100157cc
and eax, esi
cmp eax, 0x7a
jne 0x100157cc
push dword [ebp - 0x54]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x10015425
mov dword [ebp - 0x28], 0x8107000e
jmp 0x100157cc
lea ecx, [ebp - 0x54]
push ecx
push dword [ebp - 0x54]
push eax
push 4
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
je 0x10015440
xor eax, eax
jmp 0x1001544d
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, esi
or eax, 0x81070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
push 1
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1001546f
xor eax, eax
jmp 0x1001547c
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, esi
or eax, 0x82070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x100154a8
xor eax, eax
jmp 0x100154b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, esi
or eax, 0x83070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
xor edi, edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], 8
cmp dword [ebp - 0x44], edi
jne 0x100154d7
mov dword [ebp - 0x58], edi
cmp dword [ebp - 0x58], edi
je 0x1001550d
push 2
push 0xc
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x100154f5
xor eax, eax
jmp 0x10015502
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, esi
or eax, 0x84070000
mov dword [ebp - 0x28], eax
cmp eax, edi
jl 0x100157cc
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [ebp - 0x6c]
lea edi, [eax + ecx + 8]
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov dword [ebp - 0x50], eax
test eax, eax
jne 0x1001553c
mov dword [ebp - 0x28], 0x8507000e
jmp 0x100157cc
push 2
push edi
mov ebx, dword [ebp - 0x50]
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10015557
xor eax, eax
jmp 0x10015560
call edi
and eax, esi
or eax, 0x86070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x58], eax
je 0x10015618
cmp dword [ebp - 0x70], eax
je 0x10015618
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x30], eax
jae 0x10015618
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x100155af
xor eax, eax
jmp 0x100155b8
call edi
and eax, esi
or eax, 0x87070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
mov eax, dword [ebp - 0x34]
test byte [eax + 1], 0x10
jne 0x10015618
add eax, 8
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10015610
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax + 2]
push ecx
push eax
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x100155f9
xor eax, eax
jmp 0x10015602
call edi
and eax, esi
or eax, 0x88070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
inc dword [ebp - 0x64]
inc dword [ebp - 0x30]
jmp 0x1001558b
push dword [ebp - 0x2c]
push dword [ebp + 0x10]
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x1001562f
xor eax, eax
jmp 0x10015638
call edi
and eax, esi
or eax, 0x89070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x64]
push ebx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1001565c
mov eax, dword [ebp - 0x34]
mov byte [eax + 1], 3
cmp dword [ebp - 0x58], 0
je 0x100156d1
cmp dword [ebp - 0x70], 0
je 0x100156d1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x30], eax
jae 0x100156d1
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x10015688
xor eax, eax
jmp 0x10015691
call edi
and eax, esi
or eax, 0x8a070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax + 2]
push ecx
push eax
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x100156b8
xor eax, eax
jmp 0x100156c1
call edi
and eax, esi
or eax, 0x8b070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
inc dword [ebp - 0x30]
jmp 0x10015668
push 0
push ebx
push 1
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x100156eb
xor eax, eax
jmp 0x100156f4
call edi
and eax, esi
or eax, 0x8c070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
push str.SetSecurityDescriptorControl
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x1001579b
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x60], ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
je 0x10015741
xor eax, eax
jmp 0x1001574a
call edi
and eax, esi
or eax, 0x8d070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
test dword [ebp - 0x40], 0x400
je 0x10015761
mov eax, 0x500
jmp 0x1001576b
mov eax, 0x1000
test dword [ebp - 0x40], eax
je 0x10015770
mov dword [ebp - 0x38], eax
mov ebx, eax
test bx, bx
je 0x1001579b
push dword [ebp - 0x38]
push ebx
lea eax, [ebp - 0x8c]
push eax
call dword [ebp - 0x3c]
test eax, eax
je 0x1001578b
xor eax, eax
jmp 0x10015794
call edi
and eax, esi
or eax, 0x8e070000
mov dword [ebp - 0x28], eax
test eax, eax
jl 0x100157cc
lea eax, [ebp - 0x8c]
push eax
push 4
pop eax
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
je 0x100157b7
xor eax, eax
jmp 0x100157c0
call edi
and eax, esi
or eax, 0x8f070000
mov dword [ebp - 0x28], eax
jmp 0x100157cc
mov dword [ebp - 0x28], 0x8007000e
mov dword [ebp - 4], 0xfffffffe
call fcn.100157fc
cmp dword [ebp - 0x28], 0
jge 0x1001586b
push dword [ebp - 0x28]
push dword [ebp - 0x4c]
push str.AIL:AddAccessRightsToFile__s__err0x_x
push 1
call fcn.101d1209
add esp, 0x10
jmp 0x1001587d
push dword [ebp - 0x4c]
push str.AIL:AARTF__s_ok
push 3
call fcn.101d1209
add esp, 0xc
mov eax, dword [ebp - 0x28]
call fcn.101d4068
ret