Function at 0x401270
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x544
mov eax, dword [0x43e010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43e890]
mov dword [ebp - 0x540], edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x53c], edi
cmp eax, 1
je 0x401497
cmp eax, 2
je 0x401497
cmp eax, 3
je 0x401497
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 1
push eax
mov dword [edi + 0x68], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x328]
push str.Administrators
push eax
mov dword [edi], 3
call esi
push str.SYSTEM
lea eax, [ebp - 0x288]
push eax
call esi
push str.Authenticated_Users
lea eax, [ebp - 0x1e8]
push eax
call esi
cmp word [0x43f538], 0
je 0x401325
push 0x43f538
lea eax, [ebp - 0x148]
mov dword [edi], 4
push eax
call esi
cmp dword [edi], 0
lea ebx, [edi + 8]
mov dword [ebp - 0x538], 0
jle 0x40143c
lea esi, [ebp - 0x328]
jmp 0x401349
mov esi, dword [ebp - 0x52c]
lea eax, [ebp - 0x534]
mov dword [ebp - 0x52c], 0x100
push eax
lea eax, [ebp - 0x52c]
mov dword [ebp - 0x530], 0
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x530]
push eax
push 0
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push dword [ebp - 0x530]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx], eax
test eax, eax
je 0x4013d9
lea ecx, [ebp - 0x534]
push ecx
lea ecx, [ebp - 0x52c]
push ecx
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x530]
push ecx
push eax
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x4013d9
push dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x538]
add esi, 0xa0
inc eax
mov dword [ebp - 0x52c], esi
mov esi, dword [edi]
add ebx, 4
mov dword [ebp - 0x538], eax
cmp eax, esi
jl 0x401343
xor eax, eax
lea ebx, [edi + 8]
test esi, esi
jle 0x40143e
mov edi, ebx
xor ebx, ebx
nop dword [eax]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add ebx, 8
lea edi, [edi + 4]
add ebx, eax
sub esi, 1
jne 0x401410
mov edi, dword [ebp - 0x53c]
mov dword [ebp - 0x534], ebx
mov eax, dword [ebp - 0x534]
lea ebx, [edi + 8]
jmp 0x40143e
xor eax, eax
lea esi, [eax + 8]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 2
push esi
push eax
mov dword [edi + 4], eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
xor esi, esi
cmp dword [edi], esi
jle 0x401480
push dword [ebx]
push 0x10000000
push 3
push 2
push dword [edi + 4]
call dword [0x43e890]
inc esi
lea ebx, [ebx + 4]
cmp esi, dword [edi]
jl 0x401464
push 0
push dword [edi + 4]
push 1
push dword [edi + 0x68]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov esi, dword [edi + 0x68]
xor ecx, ecx
jmp 0x4014b5
push 1
lea esi, [edi + 0x54]
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov ecx, 1
lea eax, [edi + 0x48]
mov dword [eax], 0xc
mov dword [edi + 0x4c], esi
mov dword [edi + 0x50], ecx
mov ecx, dword [ebp - 0x540]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d3d1
mov esp, ebp
pop ebp
ret