Function at 0x5b9ee5
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
push 0x74
push 0x69ee38
call fcn.005e51e0
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x68], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], ebx
mov edi, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push ebx
lea ecx, [ebp - 0x4c]
push ecx
push ebx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x5ba27e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
je 0x5b9f60
call esi
push eax
push str.LookupAccountName___failed._Error__d_n
call fcn.005ba472
pop ecx
pop ecx
jmp 0x5ba27b
push dword [ebp - 0x4c]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x5b9f83
call esi
push eax
push str.HeapAlloc___failed._Error__d_n
jmp 0x5b9f54
mov eax, dword [ebp - 0x48]
add eax, eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x5b9f79
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x38]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x5b9f4c
push 1
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x5b9fdd
call esi
push eax
push str.InitializeSecurityDescriptor___failed.Error__d_n
jmp 0x5b9f54
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x5ba003
call esi
push eax
push str.GetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x5b9f54
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp dword [ebp - 0x40], ecx
cmove eax, ecx
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x5ba044
push 2
push 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x5ba044
call esi
push eax
push str.GetAclInformation___failed._Error__d_n
jmp 0x5b9f54
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [ebp - 0x24]
add ecx, 8
add eax, ecx
mov dword [ebp - 0x38], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x5b9f79
push 2
push dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x5ba090
call esi
push eax
push str.InitializeAcl___failed._Error__d_n
jmp 0x5b9f54
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x3c], 0
je 0x5ba115
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x5ba115
mov edi, ebx
mov dword [ebp - 0x54], edi
cmp edi, eax
jae 0x5ba115
lea eax, [ebp - 0x44]
push eax
push edi
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x5ba0c8
call esi
push eax
push str.GetAce___failed._Error__d_n
jmp 0x5b9f54
mov eax, dword [ebp - 0x44]
test byte [eax + 1], 0x10
jne 0x5ba115
add eax, 8
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x5ba10c
mov ecx, dword [ebp - 0x44]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x5ba109
call esi
push eax
push str.AddAce___failed._Error__d_n
jmp 0x5b9f54
inc dword [ebp - 0x50]
inc edi
mov dword [ebp - 0x54], edi
mov eax, dword [ebp - 0x28]
jmp 0x5ba0a5
push str.AddAccessAllowedAceEx
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x30]
push dword [ebp + 0xc]
test eax, eax
je 0x5ba150
push 3
push 2
push dword [ebp - 0x34]
call eax
test eax, eax
jne 0x5ba16c
call esi
push eax
push str.AddAccessAllowedAceEx___failed._Error__d_n
jmp 0x5b9f54
push 2
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x5ba16c
call esi
push eax
push str.AddAccessAllowedAce___failed._Error__d_n
jmp 0x5b9f54
cmp dword [ebp - 0x3c], 0
je 0x5ba1ba
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x5ba1ba
cmp edi, eax
jae 0x5ba1ba
lea eax, [ebp - 0x44]
push eax
push edi
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x5ba0bb
mov ecx, dword [ebp - 0x44]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x5ba0fc
inc edi
mov dword [ebp - 0x54], edi
mov eax, dword [ebp - 0x28]
jmp 0x5ba179
push ebx
push dword [ebp - 0x34]
push 1
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x5ba1de
call esi
push eax
push str.SetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x5b9f54
push str.SetSecurityDescriptorControl
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5ba267
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x5ba267
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x64], ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x5ba228
call esi
push eax
push str.GetSecurityDescriptorControl___failed.Error__d_n
jmp 0x5b9f54
mov eax, dword [ebp - 0x38]
test eax, 0x400
je 0x5ba239
mov eax, 0x500
jmp 0x5ba24b
mov ecx, 0x1000
test ax, cx
mov eax, ebx
cmovne eax, ecx
test ax, ax
je 0x5ba267
push eax
push eax
lea eax, [ebp - 0x84]
push eax
call edi
test eax, eax
jne 0x5ba267
call esi
push eax
push str.SetSecurityDescriptorControl___failed.Error__d_n
jmp 0x5b9f54
xor ebx, ebx
inc ebx
mov dword [ebp - 0x58], ebx
push 5
pop ecx
lea esi, [ebp - 0x84]
mov edi, dword [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 4], 0xfffffffe
call fcn.005ba29a
mov eax, ebx
call fcn.005e5229
ret 8