Function at 0x401000
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402138
push 0x401df0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push dword [ebp + 0xc]
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
call edi
mov dword [ebp - 0x6c], eax
cmp eax, ebx
jne 0x4013b0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x4013b0
push dword [ebp - 0x2c]
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
mov esi, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
call esi
mov dword [ebp - 0x68], eax
cmp eax, ebx
je 0x4013b0
push dword [ebp - 0x38]
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call esi
mov dword [ebp - 0x60], eax
cmp eax, ebx
je 0x4013b0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x60]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x68]
push dword [ebp + 0xc]
push ebx
call edi
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x4013b0
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push 4
push dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
call edi
mov dword [ebp - 0x6c], eax
cmp eax, ebx
jne 0x4013b0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x4013b0
push dword [ebp - 0x5c]
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x4013b0
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
push dword [ebp - 0x28]
push 4
push dword [ebp + 8]
call edi
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x4013b0
push 1
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x4013b0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x4013b0
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], 8
cmp dword [ebp - 0x1c], ebx
jne 0x401189
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], ebx
je 0x4011a7
push 2
push 0xc
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x4013b0
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [ebp - 0x54]
lea edi, [eax + ecx + 8]
mov dword [ebp - 0x20], edi
push edi
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call esi
mov dword [ebp - 0x30], eax
push 2
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x4013b0
mov dword [ebp - 0x70], ebx
cmp dword [ebp - 0x3c], ebx
je 0x40124b
cmp dword [ebp - 0x58], ebx
je 0x40124b
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x24], eax
jae 0x40124b
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x4013b0
mov eax, dword [ebp - 0x64]
test byte [eax + 1], 0x10
jne 0x40124b
add eax, 8
push eax
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x401246
mov eax, dword [ebp - 0x64]
movzx ecx, word [eax + 2]
push ecx
push eax
push 0xffffffffffffffff
push 2
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x4013b0
inc dword [ebp - 0x70]
inc dword [ebp - 0x24]
jmp 0x4011eb
push str.AddAccessAllowedAceEx
push str.advapi32.dll
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call edi
push eax
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
call esi
mov dword [ebp - 0x40], eax
cmp eax, ebx
push dword [ebp - 0x68]
push dword [ebp + 0x10]
je 0x40127e
push 3
push 2
push dword [ebp - 0x30]
call eax
jmp 0x401289
push 2
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x4013b0
cmp dword [ebp - 0x3c], ebx
je 0x4012dc
cmp dword [ebp - 0x58], ebx
je 0x4012dc
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jae 0x4012dc
lea ecx, [ebp - 0x64]
push ecx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x4013b0
mov eax, dword [ebp - 0x64]
movzx ecx, word [eax + 2]
push ecx
push eax
push 0xffffffffffffffff
push 2
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x4013b0
inc dword [ebp - 0x24]
jmp 0x40129b
push ebx
push dword [ebp - 0x30]
push 1
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x4013b0
push str.SetSecurityDescriptorControl
push str.advapi32.dll
call edi
push eax
call esi
mov dword [ebp - 0x4c], eax
cmp eax, ebx
je 0x401391
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x94], ebx
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
je 0x4013b0
test byte [ebp - 0x8f], 4
je 0x401354
mov eax, 0x500
jmp 0x401362
mov eax, 0x1000
test word [ebp - 0x90], ax
je 0x40136e
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x98], eax
cmp word [ebp - 0x8c], bx
je 0x401391
push dword [ebp - 0x98]
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
call dword [ebp - 0x4c]
test eax, eax
je 0x4013b0
lea eax, [ebp - 0x84]
push eax
push 4
pop eax
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
je 0x4013b0
mov dword [ebp - 0x34], 1
or dword [ebp - 4], 0xffffffff
call fcn.004013cd
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret