Function at 0x453954
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x28], edi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
test esi, esi
je 0x453b37
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
push ecx
lea eax, [ebp - 0x18]
push eax
push ecx
push ecx
push 4
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x4539b8
push eax
xor esi, esi
call ebx
test esi, esi
je 0x453b37
mov edi, dword [sym.imp.ADVAPI32.dll_GetAclInformation]
push 2
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call edi
mov esi, eax
test esi, esi
je 0x453b37
push 1
push 4
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x18]
call edi
mov esi, eax
test esi, esi
je 0x453b37
xor edi, edi
cmp dword [ebp - 0x10], edi
jbe 0x453a4e
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov esi, eax
test esi, esi
je 0x453b37
mov ecx, dword [ebp - 0x14]
cmp byte [ecx], 0
jne 0x453a48
mov eax, dword [ebp + 0xc]
cmp dword [ecx + 4], eax
jne 0x453a48
mov dl, byte [ebp + 0x10]
mov al, byte [ecx + 1]
and al, dl
cmp al, dl
jne 0x453a48
push dword [ebp - 0x1c]
lea eax, [ecx + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x453b2f
inc edi
cmp edi, dword [ebp - 0x10]
jb 0x4539fb
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea edi, [eax + 8]
cmp edi, 8
jae 0x453a68
push 0x216
call ebx
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 0xc]
call fcn.00452dde
test eax, eax
jns 0x453a82
push 0x216
call ebx
xor esi, esi
xor edi, edi
test esi, esi
je 0x453ab1
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov edi, eax
pop ecx
test edi, edi
jne 0x453a9e
push EventRegister
call ebx
xor esi, esi
test esi, esi
je 0x453ab1
push dword [ebp - 0x24]
push dword [ebp - 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov esi, eax
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
jbe 0x453aef
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x453b37
mov ecx, dword [ebp - 0x14]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push dword [ebp - 0x24]
push edi
call dword [sym.imp.ADVAPI32.dll_AddAce]
mov esi, eax
test esi, esi
je 0x453b37
inc ebx
cmp ebx, dword [ebp - 0x10]
jb 0x453ab8
test esi, esi
je 0x453b37
push dword [ebp - 0x1c]
movzx eax, byte [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp - 0x24]
push edi
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAceEx]
mov esi, eax
test esi, esi
je 0x453b37
push 0
push edi
push 0
push 0
push 4
push 4
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x453b2f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
test esi, esi
je 0x453b37
xor edi, edi
jmp 0x453b3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x20]
and dword [ebp - 0x18], 0
call esi
push dword [ebp - 0x1c]
and dword [ebp - 0x20], 0
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 0xc