Function at 0x417828
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov eax, 0x4b967c
call fcn.00498c30
mov edx, dword [0x4b961c]
mov dword [ebp - 0x54], edx
mov edx, dword [0x4b9620]
mov dword [ebp - 0x50], edx
mov edx, dword [0x4b9624]
mov dword [ebp - 0x4c], edx
mov word [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov dword [ebp - 0x34], edx
xor ecx, ecx
mov dword [ebp - 0x38], ecx
xor eax, eax
mov dword [ebp - 0x3c], eax
xor edx, edx
mov dword [ebp - 0x40], edx
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], 2
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0xc]
call fcn.004161e4
add esp, 8
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x4178a6
mov word [ebp - 0x14], 0xc
jmp 0x417aba
push 2
push 0xc
lea edx, [ebp - 0x54]
push edx
push dword [ebp + 8]
call sub.ADVAPI32.DLL_GetAclInformation
test eax, eax
jne 0x4178cd
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x40], eax
mov word [ebp - 0x14], 0xc
jmp 0x417aba
mov ecx, dword [ebp - 0x54]
dec ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
jl 0x417aba
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_GetAce
test eax, eax
jne 0x4178fe
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x40], eax
jmp 0x417aba
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x44], edx
cmp dword [ebp + 0x18], 0
je 0x417914
cmp dword [ebp + 0x18], 0xffffffff
jne 0x417994
mov ecx, dword [ebp - 0x44]
cmp byte [ecx], 0
jne 0x417994
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
add edx, 8
push edx
push dword [ebp - 0x3c]
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
je 0x417aad
cmp dword [ebp + 0x14], 0
je 0x417981
mov ecx, dword [ebp - 0x30]
test dword [ecx + 4], 0xffff
je 0x417981
mov eax, dword [ebp + 0x10]
not eax
mov edx, dword [ebp - 0x30]
and dword [edx + 4], eax
mov ecx, dword [ebp - 0x30]
test byte [ecx + 4], 0x1e
je 0x417968
mov eax, dword [ebp - 0x30]
or dword [eax + 4], 1
jmp 0x41798a
mov edx, dword [ebp - 0x30]
test dword [edx + 4], 0xffff
jne 0x41798a
push dword [ebp - 0x28]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_DeleteAce
jmp 0x41798a
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x30]
or dword [eax + 4], ecx
xor edx, edx
mov dword [ebp - 0x48], edx
jmp 0x417aad
cmp dword [ebp + 0x18], 1
je 0x4179a4
cmp dword [ebp + 0x18], 0xffffffff
jne 0x417a26
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov al, byte [ecx]
dec eax
jne 0x417a26
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x34]
add ecx, 8
push ecx
push dword [ebp - 0x3c]
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
je 0x417aad
cmp dword [ebp + 0x14], 0
je 0x417a13
mov eax, dword [ebp - 0x34]
test dword [eax + 4], 0xffff
je 0x417a13
mov edx, dword [ebp + 0x10]
not edx
mov ecx, dword [ebp - 0x34]
and dword [ecx + 4], edx
mov eax, dword [ebp - 0x34]
test byte [eax + 4], 0x1e
je 0x4179fa
mov edx, dword [ebp - 0x34]
or dword [edx + 4], 1
jmp 0x417a1c
mov ecx, dword [ebp - 0x34]
test dword [ecx + 4], 0xffff
jne 0x417a1c
push dword [ebp - 0x28]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_DeleteAce
jmp 0x417a1c
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x34]
or dword [edx + 4], eax
xor ecx, ecx
mov dword [ebp - 0x48], ecx
jmp 0x417aad
cmp dword [ebp + 0x18], 2
je 0x417a32
cmp dword [ebp + 0x18], 0xffffffff
jne 0x417aad
mov eax, dword [ebp - 0x44]
xor edx, edx
mov dl, byte [eax]
cmp edx, 2
jne 0x417aad
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
add eax, 8
push eax
push dword [ebp - 0x3c]
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
je 0x417aad
cmp dword [ebp + 0x14], 0
je 0x417a9f
mov edx, dword [ebp - 0x38]
test dword [edx + 4], 0xffff
je 0x417a9f
mov ecx, dword [ebp + 0x10]
not ecx
mov eax, dword [ebp - 0x38]
and dword [eax + 4], ecx
mov edx, dword [ebp - 0x38]
test byte [edx + 4], 0x1e
je 0x417a86
mov ecx, dword [ebp - 0x38]
or dword [ecx + 4], 1
jmp 0x417aa8
mov eax, dword [ebp - 0x38]
test dword [eax + 4], 0xffff
jne 0x417aa8
push dword [ebp - 0x28]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_DeleteAce
jmp 0x417aa8
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp + 0x10]
or dword [edx + 4], ecx
xor eax, eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0
jge 0x4178de
cmp dword [ebp - 0x3c], 0
je 0x417ac9
push dword [ebp - 0x3c]
call fcn.00497c78
pop ecx
cmp dword [ebp - 0x40], 0
jne 0x417ad5
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret