Function at 0x1001abfc
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get user security identifier

Disassembly:
push 0x620
mov eax, 0x1008cffd
call fcn.1004606d
mov ebx, ecx
mov dword [ebp - 0x620], ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x62c]
push eax
push str.SeSecurityPrivilege
push ecx
mov dword [ebp - 0x5fc], ecx
mov dword [ebp - 0x5f4], ecx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
or esi, 0xffffffff
test eax, eax
jne 0x1001ac55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LookupPrivilegeValue_error:__u_n
call fcn.10020e18
pop ecx
jmp 0x1001acda
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x61c]
push eax
push 0x28
mov dword [ebp - 0x384], 1
mov dword [ebp - 0x378], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ecx, ecx
lea eax, [ebp - 0x384]
push ecx
push ecx
push 0x10
push eax
push ecx
push dword [ebp - 0x61c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1001acc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AdjustTokenPrivileges_error:__u_n
jmp 0x1001ac4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x1001ace4
push str.The_token_does_not_have_the_specified_privilege.__n
call fcn.10020e18
xor eax, eax
pop ecx
mov esi, eax
jmp 0x1001ad74
cmp dword [ebp + 0x20], 0
lea eax, [ebp - 0x50]
push esi
je 0x1001ad03
push str.Everyone
push 0x20
push eax
call fcn.10021c86
push esi
push str.ANONYMOUS_LOGON
jmp 0x1001ad16
push str.ANONYMOUS_LOGON
push 0x20
push eax
call fcn.10021c86
push esi
push str.Everyone
lea eax, [ebp - 0x30]
push 0x20
push eax
call fcn.10021c86
add esp, 0x20
lea edx, [ebp + 8]
lea ecx, [ebp - 0x39c]
push str..
call fcn.1001b59a
pop ecx
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x1001ad44
mov eax, dword [eax]
lea ecx, [ebp - 0x5e4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x624], edi
mov byte [ebp - 4], al
lea ecx, [ebp - 0x39c]
push eax
push 1
call fcn.10002c1a
cmp edi, esi
jne 0x1001ad7b
xor esi, esi
inc esi
xor ebx, ebx
jmp 0x1001b464
lea eax, [ebp - 0x5b8]
push eax
lea ecx, [ebp - 0x374]
call fcn.10015553
mov byte [ebp - 4], 2
test byte [ebp - 0x5e4], 0x10
je 0x1001ae88
push 0x100addb8
call fcn.1000e2d9
pop ecx
push eax
push 0x100addb8
push dword [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x374]
call fcn.1001b513
test eax, eax
je 0x1001ae54
push 0x100addbc
call fcn.1000e2d9
pop ecx
push eax
push 0x100addbc
push dword [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x374]
call fcn.1001b513
test eax, eax
je 0x1001ae54
push dword [ebp + 0x20]
lea edx, [ebp + 8]
push 0x100addc0
lea ecx, [ebp - 0x45c]
call fcn.1001b59a
mov byte [ebp - 4], 3
sub esp, 0x14
lea edx, [ebp - 0x374]
mov dword [ebp - 0x60c], esp
mov ecx, esp
push edx
mov edx, eax
call fcn.1001b613
pop ecx
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
mov ecx, ebx
call fcn.1001abfc
test eax, eax
sete bl
mov byte [ebp - 4], 2
xor eax, eax
lea ecx, [ebp - 0x45c]
push eax
push 1
call fcn.10002c1a
test bl, bl
jne 0x1001b414
xor ebx, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x374]
push ebx
push 1
call fcn.10002c1a
lea eax, [ebp - 0x5e4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1001b461
mov ebx, dword [ebp - 0x620]
jmp 0x1001ad7b
push 0x100addc0
lea edx, [ebp + 8]
lea ecx, [ebp - 0x3cc]
call fcn.1001b59a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x5b8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x42c]
call fcn.1001b651
pop ecx
pop ecx
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x1001aec1
mov eax, dword [eax]
lea ecx, [ebp - 0x5fc]
xor ebx, ebx
push ecx
lea ecx, [ebp - 0x5f4]
push ecx
push ebx
push ebx
push ebx
push 8
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
mov esi, eax
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x42c]
call fcn.10002c1a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3cc]
push ebx
push 1
call fcn.10002c1a
test esi, esi
jne 0x1001b329
mov ecx, dword [ebp - 0x5f4]
test ecx, ecx
je 0x1001b325
cmp word [ecx + 4], bx
jbe 0x1001b325
xor eax, eax
mov dword [ebp - 0x600], ebx
lea edi, [ebp - 0x5f0]
stosd dword es:[edi], eax
push 8
pop esi
push 2
stosd dword es:[edi], eax
push 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x5f0]
push eax
push ecx
mov dword [ebp - 0x5ec], esi
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x1001b45a
push dword [ebp - 0x5ec]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1001b44d
push 2
push dword [ebp - 0x5ec]
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x1001b44d
mov esi, dword [ebp - 0x5f4]
xor eax, eax
cmp ax, word [esi + 4]
jae 0x1001b30c
xor eax, eax
push 0x103
push eax
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x604], eax
mov byte [ebp - 0x154], al
lea eax, [ebp - 0x153]
push eax
call fcn.10023400
xor eax, eax
push 0x103
push eax
mov byte [ebp - 0x258], al
lea eax, [ebp - 0x257]
push eax
call fcn.10023400
add esp, 0x18
mov dword [ebp - 0x618], 0x104
xor eax, eax
mov dword [ebp - 0x5f8], eax
lea eax, [ebp - 0x614]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1001b42b
mov ecx, dword [ebp - 0x614]
cmp byte [ecx], 2
je 0x1001b027
push str.ACE_ERROR:_not_SYSTEM_AUDIT_ACE_TYPE_n
call fcn.10020e18
pop ecx
jmp 0x1001b1af
lea eax, [ecx + 8]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x60c], ecx
mov ecx, 0x104
mov dword [ebp - 0x608], ecx
mov dword [ebp - 0x604], ecx
lea ecx, [ebp - 0x610]
push ecx
lea ecx, [ebp - 0x604]
push ecx
lea ecx, [ebp - 0x258]
push ecx
lea ecx, [ebp - 0x608]
push ecx
lea ecx, [ebp - 0x154]
push ecx
push eax
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x1001b401
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x154]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001b0a4
test dl, dl
je 0x1001b09e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001b0a4
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001b082
xor ecx, ecx
mov eax, ecx
jmp 0x1001b0ab
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
jne 0x1001b190
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x5f8]
push eax
push ecx
lea eax, [ebp - 0x30]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x1001b17c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001b17c
push dword [ebp - 0x5f8]
call fcn.1002010d
mov esi, eax
pop ecx
test esi, esi
je 0x1001b3cf
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x5f8]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x1001b15e
push 1
push 1
push esi
push dword [ebp - 0x60c]
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AddAuditAccessAce]
test eax, eax
je 0x1001b3b3
mov dword [ebp - 0x600], 1
jmp 0x1001b171
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FAILED:__d_n
call fcn.10020e18
pop ecx
pop ecx
push esi
call fcn.1001f0b9
jmp 0x1001b021
lea eax, [ebp - 0x30]
push eax
push str.FAILED_to_find__s_n
call fcn.10020e18
pop ecx
jmp 0x1001b021
mov ecx, dword [ebp - 0x614]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x1001b3db
mov esi, dword [ebp - 0x5f4]
inc ebx
movzx eax, word [esi + 4]
cmp ebx, eax
jl 0x1001afa0
mov eax, dword [ebp - 0x600]
test eax, eax
je 0x1001b30c
push 0x100addc0
lea edx, [ebp + 8]
lea ecx, [ebp - 0x48c]
call fcn.1001b59a
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5b8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x3b4]
call fcn.1001b651
pop ecx
pop ecx
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 0x10
jb 0x1001b209
mov eax, dword [eax]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 8
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov esi, eax
mov byte [ebp - 4], 7
push ebx
push 1
lea ecx, [ebp - 0x3b4]
call fcn.10002c1a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48c]
push ebx
push 1
call fcn.10002c1a
lea edx, [ebp + 8]
push 0x100addc0
test esi, esi
jne 0x1001b2b0
lea ecx, [ebp - 0x414]
call fcn.1001b59a
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x5b8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x3e4]
call fcn.1001b651
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 0x10
jb 0x1001b27d
mov eax, dword [eax]
push eax
push str.Fixed:__s_n
call fcn.10020e18
pop ecx
pop ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3e4]
push ebx
push 1
call fcn.10002c1a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x414]
push ebx
push 1
call fcn.10002c1a
jmp 0x1001b30e
lea ecx, [ebp - 0x474]
call fcn.1001b59a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x5b8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x444]
call fcn.1001b651
pop ecx
pop ecx
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 0x10
jb 0x1001b2e1
mov eax, dword [eax]
push eax
push str.Failed_to_fix:__s_n
call fcn.10020e18
pop ecx
pop ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x444]
push ebx
push 1
call fcn.10002c1a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x474]
jmp 0x1001b2a6
xor ebx, ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x624]
jmp 0x1001b395
test esi, esi
je 0x1001b395
push 0x100addc0
lea edx, [ebp + 8]
lea ecx, [ebp - 0x3fc]
call fcn.1001b59a
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x5b8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x4a4]
call fcn.1001b651
pop ecx
pop ecx
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 0x10
jb 0x1001b362
mov eax, dword [eax]
push eax
push esi
push str.fail__d__s_n
call fcn.10020e18
add esp, 0xc
mov byte [ebp - 4], 0xd
push ebx
push 1
lea ecx, [ebp - 0x4a4]
call fcn.10002c1a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3fc]
push ebx
push 1
call fcn.10002c1a
cmp dword [ebp - 0x5fc], 0
je 0x1001ae56
push dword [ebp - 0x5fc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1001ae56
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_updated_ACL__d__n
call fcn.10020e18
push esi
call fcn.1001f0b9
add esp, 0xc
jmp 0x1001b3ee
push str.memory_failed_n
call fcn.10020e18
jmp 0x1001b3ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_add_ACE_to_acl___d__n
call fcn.10020e18
pop ecx
pop ecx
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1001b416
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_grab_SID___d_
call fcn.10020e18
pop ecx
pop ecx
xor ebx, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x374]
push ebx
push 1
call fcn.10002c1a
mov esi, ebx
jmp 0x1001b464
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x5f4]
push ebx
movzx eax, word [eax + 4]
push eax
push str.ACE_error__d:_d__d__n
call fcn.10020e18
add esp, 0x10
jmp 0x1001b414
push str.Cant_allocate_new_ACL__exiting_n
call fcn.10020e18
pop ecx
jmp 0x1001b416
push str.Cant_find_ACL_info__exiting_n
jmp 0x1001b452
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
push ebx
push 1
call fcn.10002c1a
mov eax, esi
call fcn.1004601c
ret 0x1c