Function at 0x43a44a
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
push 0x78
push 0x62a758
call fcn.0043bd30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
xor esi, esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push esi
lea ecx, [ebp - 0x54]
push ecx
push esi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x43a4be
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x7a
je 0x43a4db
call edi
push eax
push str.LookupAccountName___failed._Error__d_n
call fcn.0043ab48
pop ecx
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 4], 0xfffffffe
call fcn.0043a88e
mov eax, dword [ebp - 0x68]
call fcn.0043bd79
ret 0xc
push dword [ebp - 0x54]
push 8
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x43a507
call edi
push eax
push str.HeapAlloc___failed._Error__d_n
call fcn.0043ab48
pop ecx
pop ecx
jmp 0x43a4c4
mov eax, dword [ebp - 0x50]
add eax, eax
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x64], eax
test eax, eax
je 0x43a4f6
lea ecx, [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x40]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x43a547
call edi
push eax
push str.LookupAccountName___failed._Error__d_n
jmp 0x43a4fe
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push 4
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x43a4c4
call edi
cmp eax, 0x7a
je 0x43a571
call edi
push eax
push str.GetFileSecurity___failed._Error__d_n
jmp 0x43a4fe
push dword [ebp - 0x44]
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x43a4f6
lea ecx, [ebp - 0x44]
push ecx
push dword [ebp - 0x44]
push eax
push 4
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
je 0x43a567
push 1
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x43a5c1
call edi
push eax
push str.InitializeSecurityDescriptor___failed.Error__d_n
jmp 0x43a4fe
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x43a5e7
call edi
push eax
push str.GetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x43a4fe
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp dword [ebp - 0x38], ecx
cmove eax, ecx
mov dword [ebp - 0x48], eax
test eax, eax
je 0x43a628
push 2
push 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x43a628
call edi
push eax
push str.GetAclInformation___failed._Error__d_n
jmp 0x43a4fe
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [ebp - 0x24]
add ecx, 8
add eax, ecx
mov dword [ebp - 0x40], eax
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x43a4f6
push 2
push dword [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x43a670
call edi
push eax
push str.InitializeAcl___failed._Error__d_n
jmp 0x43a4fe
mov dword [ebp - 0x5c], esi
cmp dword [ebp - 0x48], 0
je 0x43a6ff
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x43a6ff
mov eax, esi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x2c], eax
cmp eax, ecx
jae 0x43a6ff
lea ecx, [ebp - 0x3c]
push ecx
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x43a6af
call edi
push eax
push str.GetAce___failed._Error__d_n
jmp 0x43a4fe
mov eax, dword [ebp - 0x3c]
test byte [eax + 1], 0x10
jne 0x43a6ff
add eax, 8
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x43a6f3
mov ecx, dword [ebp - 0x3c]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x43a6f0
call edi
push eax
push str.AddAce___failed._Error__d_n
jmp 0x43a4fe
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x28]
jmp 0x43a689
push str.AddAccessAllowedAceEx
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x30]
push dword [ebp + 0x10]
test eax, eax
je 0x43a73a
push 3
push 2
push dword [ebp - 0x34]
call eax
test eax, eax
jne 0x43a756
call edi
push eax
push str.AddAccessAllowedAceEx___failed._Error__d_n
jmp 0x43a4fe
push 2
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x43a756
call edi
push eax
push str.AddAccessAllowedAce___failed._Error__d_n
jmp 0x43a4fe
cmp dword [ebp - 0x48], 0
je 0x43a7ad
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x43a7ad
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
jae 0x43a7ad
lea ecx, [ebp - 0x3c]
push ecx
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x43a6a2
mov ecx, dword [ebp - 0x3c]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x43a6e3
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x28]
jmp 0x43a766
push esi
push dword [ebp - 0x34]
push 1
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x43a7d1
call edi
push eax
push str.SetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x43a4fe
push str.SetSecurityDescriptorControl
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x70], eax
test eax, eax
je 0x43a857
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x40], esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x43a817
call edi
push eax
push str.GetSecurityDescriptorControl___failed.Error__d_n
jmp 0x43a4fe
mov eax, dword [ebp - 0x2c]
test eax, 0x400
je 0x43a828
mov eax, 0x500
jmp 0x43a83a
mov ecx, 0x1000
test ax, cx
mov eax, esi
cmovne eax, ecx
test ax, ax
je 0x43a857
push eax
push eax
lea eax, [ebp - 0x88]
push eax
call dword [ebp - 0x70]
test eax, eax
jne 0x43a857
call edi
push eax
push str.SetSecurityDescriptorControl___failed.Error__d_n
jmp 0x43a4fe
lea eax, [ebp - 0x88]
push eax
push 4
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x43a87a
call edi
push eax
push str.SetFileSecurity___failed._Error__d_n
jmp 0x43a4fe
mov dword [ebp - 0x68], 1
jmp 0x43a4c4