Function at 0x417ae8
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov eax, 0x4b9694
call fcn.00498c30
mov edx, dword [0x4b9628]
mov dword [ebp - 0x54], edx
mov edx, dword [0x4b962c]
mov dword [ebp - 0x50], edx
mov edx, dword [0x4b9630]
mov dword [ebp - 0x4c], edx
mov word [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov dword [ebp - 0x34], edx
xor ecx, ecx
mov dword [ebp - 0x38], ecx
xor eax, eax
mov dword [ebp - 0x3c], eax
xor edx, edx
mov dword [ebp - 0x40], edx
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], 2
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0xc]
call fcn.004161e4
add esp, 8
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x417b66
mov word [ebp - 0x14], 0xc
jmp 0x417cbd
push 2
push 0xc
lea edx, [ebp - 0x54]
push edx
push dword [ebp + 8]
call sub.ADVAPI32.DLL_GetAclInformation
test eax, eax
jne 0x417b8d
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x40], eax
mov word [ebp - 0x14], 0xc
jmp 0x417cbd
mov ecx, dword [ebp - 0x54]
dec ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
jl 0x417cbd
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_GetAce
test eax, eax
jne 0x417bbe
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x40], eax
jmp 0x417cbd
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x44], edx
cmp dword [ebp + 0x10], 0
je 0x417bd0
cmp dword [ebp + 0x10], 0xffffffff
jne 0x417c16
mov ecx, dword [ebp - 0x44]
cmp byte [ecx], 0
jne 0x417c16
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
add edx, 8
push edx
push dword [ebp - 0x3c]
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
je 0x417cb0
mov ecx, dword [ebp - 0x30]
test dword [ecx + 4], 0xffff
je 0x417c0c
push dword [ebp - 0x28]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_DeleteAce
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x417cb0
cmp dword [ebp + 0x10], 1
je 0x417c22
cmp dword [ebp + 0x10], 0xffffffff
jne 0x417c63
mov edx, dword [ebp - 0x44]
xor ecx, ecx
mov cl, byte [edx]
dec ecx
jne 0x417c63
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
add edx, 8
push edx
push dword [ebp - 0x3c]
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
je 0x417cb0
mov ecx, dword [ebp - 0x34]
test dword [ecx + 4], 0xffff
je 0x417c5c
push dword [ebp - 0x28]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_DeleteAce
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x417cb0
cmp dword [ebp + 0x10], 2
je 0x417c6f
cmp dword [ebp + 0x10], 0xffffffff
jne 0x417cb0
mov edx, dword [ebp - 0x44]
xor ecx, ecx
mov cl, byte [edx]
cmp ecx, 2
jne 0x417cb0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
add edx, 8
push edx
push dword [ebp - 0x3c]
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
je 0x417cb0
mov ecx, dword [ebp - 0x38]
test dword [ecx + 4], 0xffff
je 0x417cab
push dword [ebp - 0x28]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_DeleteAce
xor eax, eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0
jge 0x417b9e
cmp dword [ebp - 0x3c], 0
je 0x417ccc
push dword [ebp - 0x3c]
call fcn.00497c78
pop ecx
cmp dword [ebp - 0x40], 0
jne 0x417cd8
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret