Function at 0x41aff2
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
xor esi, esi
push edi
xor eax, eax
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x10], esi
cmp dword [ebp + 8], esi
jne 0x41b027
xor al, al
jmp 0x41b2da
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41b020
lea eax, [ebp - 8]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 2
push dword [ebp - 4]
call esi
test eax, eax
jne 0x41b060
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41b020
push ebx
mov edi, 0x43e6c8
push edi
push dword [ebp - 8]
call fcn.00422533
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41b14d
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push 2
push dword [ebp - 4]
call esi
test eax, eax
je 0x41b0be
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebp - 4]
call esi
test eax, eax
jne 0x41b0ac
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41b0be
push edi
push dword [ebp - 8]
call fcn.00422533
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x41b0c6
push ebx
call fcn.0042209e
jmp 0x41b120
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
push eax
push 1
push dword [ebp - 4]
call esi
test eax, eax
je 0x41b111
mov esi, dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 7
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41b0fd
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41b111
push edi
push dword [ebp - 8]
call fcn.00422533
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x28], edi
test edi, edi
jne 0x41b123
push ebx
call fcn.0042209e
push dword [ebp - 0xc]
call fcn.0042209e
pop ecx
pop ecx
jmp 0x41b14d
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 7
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41b15d
push ebx
call fcn.0042209e
push dword [ebp - 0xc]
call fcn.0042209e
push edi
call fcn.0042209e
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
jmp 0x41b2d9
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x41b1a0
mov byte [ebp + 0xb], 0
push ebx
call fcn.0042209e
push dword [ebp - 0xc]
call fcn.0042209e
push edi
call fcn.0042209e
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [ebp + 0xb]
jmp 0x41b2d9
xor esi, esi
cmp dword [ebp - 0x1c], esi
jne 0x41b1ad
mov byte [ebp + 0xb], 1
jmp 0x41b178
push 2
push 0xc
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x41b174
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x34], esi
jbe 0x41b29f
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x41b28d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41b28d
cmp byte [eax], 1
jne 0x41b242
mov ecx, dword [ebp - 0xc]
push dword [ecx]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41b214
mov ecx, dword [eax + 4]
or dword [ebp - 0x18], ecx
and dword [ebp + 8], 0
cmp dword [ebx], 0
jbe 0x41b242
lea esi, [ebx + 4]
push dword [esi]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41b235
mov ecx, dword [eax + 4]
or dword [ebp - 0x18], ecx
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
add esi, 8
cmp ecx, dword [ebx]
jb 0x41b220
cmp byte [eax], 0
jne 0x41b28d
mov ecx, dword [ebp - 0xc]
push dword [ecx]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41b25f
mov ecx, dword [eax + 4]
or dword [ebp - 0x14], ecx
and dword [ebp + 8], 0
cmp dword [ebx], 0
jbe 0x41b28d
lea esi, [ebx + 4]
push dword [esi]
add eax, 8
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x41b280
mov ecx, dword [eax + 4]
or dword [ebp - 0x14], ecx
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
add esi, 8
cmp ecx, dword [ebx]
jb 0x41b26b
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x34]
jb 0x41b1d4
mov edi, dword [ebp - 0x28]
push ebx
call fcn.0042209e
push dword [ebp - 0xc]
call fcn.0042209e
push edi
call fcn.0042209e
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x14]
mov eax, 0x1201b6
and ecx, eax
cmp ecx, eax
jne 0x41b2d7
test dword [ebp - 0x18], eax
jne 0x41b2d7
xor eax, eax
inc eax
jmp 0x41b2d9
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret