Function at 0x402e50
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor esi, esi
mov eax, ecx
push eax
push esi
push 0xf001f
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [0x4690e4], esi
mov dword [0x4690e0], esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x40303a
cmp ebx, 0xffffffff
je 0x40303a
call fcn.00421b50
test al, al
je 0x402f43
call fcn.0042f930
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x402ebf
mov ecx, str.unable_to_get_user_SID
call fcn.004318d0
jmp 0x403058
call fcn.00402c60
mov dword [ebp - 8], eax
test eax, eax
jne 0x402eda
mov ecx, str.unable_to_get_default_SID
call fcn.004318d0
jmp 0x403058
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push 1
push 6
push ebx
call dword [0x4690a8]
test eax, eax
je 0x402f14
mov ecx, 1
call fcn.00430620
push eax
push str.unable_to_get_owner_of_file_mapping:_GetSecurityInfo_returned:__s
call fcn.004318b0
add esp, 8
jmp 0x403058
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x402f43
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x402f43
mov ecx, str.wrong_owning_SID_of_file_mapping
call fcn.004318d0
jmp 0x403058
push 0
push 0
push 0
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x402f78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00430620
push eax
push str.unable_to_obtain_view_of_file_mapping:__s
call fcn.004318b0
add esp, 8
jmp 0x403058
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x402fa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00430620
push eax
push str.unable_to_query_view_of_file_mapping:__s
call fcn.004318b0
add esp, 8
jmp 0x403058
cmp eax, 0x10
jae 0x402fbd
mov ecx, str.VirtualQuery_returned_too_little_data_to_get_region_size
call fcn.004318d0
jmp 0x403058
mov edx, dword [ebp - 0x20]
cmp edx, 5
jae 0x402fd4
mov ecx, str.mapping_smaller_than_smallest_possible_request
call fcn.004318d0
jmp 0x403058
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov dword [0x4690e0], edi
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 3]
shl ecx, 8
or ecx, eax
lea eax, [edi + 4]
mov dword [0x4690e4], eax
lea eax, [edx - 4]
mov dword [0x4690e8], eax
cmp ecx, eax
jbe 0x403018
mov dword [edi], 0x1000000
mov byte [edi + 4], 5
jmp 0x40305a
push dword [0x4690f0]
mov dword [0x4690ec], ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push dword [0x4690f4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40305a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00430620
push eax
push dword [ebp - 0x10]
push str.OpenFileMapping___s__:__s
call fcn.004318b0
add esp, 0xc
mov esi, eax
mov ecx, dword [ebp - 8]
call fcn.00431220
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x403070
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x40307b
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
je 0x40308b
cmp ebx, 0xffffffff
je 0x40308b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret