Function at 0x3001fcf0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x94
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push str.advapi32.dll
mov dword [esi], 0x30294800
mov dword [esi + 4], ebx
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x3001fd21
cmp eax, 0xffffffff
jne 0x3001fd24
mov byte [esi + 8], bl
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp eax, ebx
mov dword [esi], 0x302949c0
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
je 0x3001fd94
cmp eax, 0xffffffff
je 0x3001fd94
push str.AllocateAndInitializeSid
push eax
call edi
mov ecx, eax
cmp ecx, ebx
jne 0x3001fd97
mov byte [esi + 8], bl
mov dword [esi + 0x24], ecx
mov ecx, dword [esi + 4]
xor eax, eax
cmp ecx, ebx
je 0x3001fdb4
cmp ecx, 0xffffffff
je 0x3001fdb4
push str.GetNamedSecurityInfoA
push ecx
call edi
cmp eax, ebx
jne 0x3001fdb7
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x28], eax
xor eax, eax
cmp ecx, ebx
je 0x3001fdd0
cmp ecx, 0xffffffff
je 0x3001fdd0
push str.GetNamedSecurityInfoW
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x2c], eax
xor eax, eax
cmp ecx, ebx
je 0x3001fded
cmp ecx, 0xffffffff
je 0x3001fded
push str.GetSecurityInfo
push ecx
call edi
cmp eax, ebx
jne 0x3001fdf0
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x30], eax
xor eax, eax
cmp ecx, ebx
je 0x3001fe0d
cmp ecx, 0xffffffff
je 0x3001fe0d
push str.SetEntriesInAclA
push ecx
call edi
cmp eax, ebx
jne 0x3001fe10
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x34], eax
xor eax, eax
cmp ecx, ebx
je 0x3001fe29
cmp ecx, 0xffffffff
je 0x3001fe29
push str.SetEntriesInAclW
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x38], eax
xor eax, eax
cmp ecx, ebx
je 0x3001fe46
cmp ecx, 0xffffffff
je 0x3001fe46
push str.SetNamedSecurityInfoA
push ecx
call edi
cmp eax, ebx
jne 0x3001fe49
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x3c], eax
xor eax, eax
cmp ecx, ebx
je 0x3001fe62
cmp ecx, 0xffffffff
je 0x3001fe62
push str.SetNamedSecurityInfoW
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x40], eax
xor eax, eax
cmp ecx, ebx
je 0x3001fe7f
cmp ecx, 0xffffffff
je 0x3001fe7f
push str.SetSecurityInfo
push ecx
call edi
cmp eax, ebx
jne 0x3001fe82
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x44], eax
xor eax, eax
cmp ecx, ebx
je 0x3001fe9f
cmp ecx, 0xffffffff
je 0x3001fe9f
push str.FreeSid
push ecx
call edi
cmp eax, ebx
jne 0x3001fea2
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x48], eax
xor eax, eax
cmp ecx, ebx
je 0x3001febf
cmp ecx, 0xffffffff
je 0x3001febf
push str.GetAclInformation
push ecx
call edi
cmp eax, ebx
jne 0x3001fec2
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x4c], eax
xor eax, eax
cmp ecx, ebx
je 0x3001fedf
cmp ecx, 0xffffffff
je 0x3001fedf
push str.GetAce
push ecx
call edi
cmp eax, ebx
jne 0x3001fee2
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x50], eax
xor eax, eax
cmp ecx, ebx
je 0x3001feff
cmp ecx, 0xffffffff
je 0x3001feff
push str.EqualSid
push ecx
call edi
cmp eax, ebx
jne 0x3001ff02
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x54], eax
xor eax, eax
cmp ecx, ebx
je 0x3001ff1f
cmp ecx, 0xffffffff
je 0x3001ff1f
push str.DeleteAce
push ecx
call edi
cmp eax, ebx
jne 0x3001ff22
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x58], eax
xor eax, eax
cmp ecx, ebx
je 0x3001ff3b
cmp ecx, 0xffffffff
je 0x3001ff3b
push str.CreateWellKnownSid
push ecx
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x5c], eax
xor eax, eax
cmp ecx, ebx
je 0x3001ff58
cmp ecx, 0xffffffff
je 0x3001ff58
push str.OpenProcessToken
push ecx
call edi
cmp eax, ebx
jne 0x3001ff5b
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x60], eax
xor eax, eax
cmp ecx, ebx
je 0x3001ff78
cmp ecx, 0xffffffff
je 0x3001ff78
push str.GetTokenInformation
push ecx
call edi
cmp eax, ebx
jne 0x3001ff7b
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x64], eax
xor eax, eax
cmp ecx, ebx
je 0x3001ff98
cmp ecx, 0xffffffff
je 0x3001ff98
push str.GetSidSubAuthority
push ecx
call edi
cmp eax, ebx
jne 0x3001ff9b
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x68], eax
xor eax, eax
cmp ecx, ebx
je 0x3001ffb8
cmp ecx, 0xffffffff
je 0x3001ffb8
push str.GetSidSubAuthorityCount
push ecx
call edi
cmp eax, ebx
jne 0x3001ffbb
mov byte [esi + 8], bl
mov dword [esi + 0x6c], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 2
jb 0x3002009c
mov ecx, dword [esi + 4]
xor eax, eax
cmp ecx, ebx
je 0x3001fff6
cmp ecx, 0xffffffff
je 0x3001fff6
push str.RegCreateKeyExW
push ecx
call edi
cmp eax, ebx
jne 0x3001fff9
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0xc], eax
xor eax, eax
cmp ecx, ebx
je 0x30020016
cmp ecx, 0xffffffff
je 0x30020016
push str.RegOpenKeyExW
push ecx
call edi
cmp eax, ebx
jne 0x30020019
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x10], eax
xor eax, eax
cmp ecx, ebx
je 0x30020036
cmp ecx, 0xffffffff
je 0x30020036
push str.RegDeleteKeyW
push ecx
call edi
cmp eax, ebx
jne 0x30020039
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
xor eax, eax
cmp ecx, ebx
je 0x30020056
cmp ecx, 0xffffffff
je 0x30020056
push str.RegDeleteValueW
push ecx
call edi
cmp eax, ebx
jne 0x30020059
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x18], eax
xor eax, eax
cmp ecx, ebx
je 0x30020076
cmp ecx, 0xffffffff
je 0x30020076
push str.RegQueryValueExW
push ecx
call edi
cmp eax, ebx
jne 0x30020079
mov byte [esi + 8], bl
mov ecx, dword [esi + 4]
mov dword [esi + 0x1c], eax
xor eax, eax
cmp ecx, ebx
je 0x30020096
cmp ecx, 0xffffffff
je 0x30020096
push str.RegSetValueExW
push ecx
call edi
cmp eax, ebx
jne 0x30020099
mov byte [esi + 8], bl
mov dword [esi + 0x20], eax
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x94
ret