Function at 0x4031c8
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xce4
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc98], ecx
push ebx
push esi
push edi
push 0xc80
mov ebx, eax
mov dword [ebp - 0xc90], eax
push eax
mov dword [ebp - 0xc8c], eax
mov edi, eax
mov dword [ebp - 0xcbc], eax
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xcc4], eax
mov dword [ebp - 0xcc0], eax
mov dword [ebp - 0xca8], eax
mov dword [ebp - 0xcb4], eax
mov dword [ebp - 0xc9c], eax
mov dword [ebp - 0xca4], eax
mov dword [ebp - 0xc88], eax
mov dword [ebp - 0xcac], eax
mov dword [ebp - 0xcb8], eax
mov dword [ebp - 0xca0], eax
lea eax, [ebp - 0xc84]
push eax
mov dword [ebp - 0xcd0], ebx
call fcn.0049ef70
add esp, 0xc
call fcn.0049aae0
mov esi, dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidA]
movzx eax, al
mov dword [ebp - 0xcb0], eax
lea eax, [ebp - 0xc90]
push eax
push str.S_1_5_18
call esi
test eax, eax
je 0x403548
lea eax, [ebp - 0xc8c]
push eax
push str.S_1_5_80_4246687206_1736339067_1726116524_2577898602_182698384
call esi
test eax, eax
je 0x403548
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xcbc], eax
test eax, eax
je 0x403548
push 0x60000
push dword [ebp - 0xc98]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
mov dword [ebp - 0xccc], edi
test edi, edi
je 0x403548
lea eax, [ebp - 0xc9c]
push eax
push esi
lea eax, [ebp - 0xc94]
push eax
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
jne 0x403343
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x403548
mov esi, dword [ebp - 0xc9c]
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc94], eax
test eax, eax
je 0x403548
lea ecx, [ebp - 0xc9c]
push ecx
push esi
push eax
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
je 0x403548
xor esi, esi
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xcac]
push eax
lea eax, [ebp - 0xcc4]
push eax
push dword [ebp - 0xc94]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x403548
lea eax, [ebp - 0xca0]
push eax
lea eax, [ebp - 0xca4]
push eax
push dword [ebp - 0xcac]
call dword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclA]
test eax, eax
jne 0x403548
xor ecx, ecx
mov dword [ebp - 0xcc8], esi
inc ecx
cmp dword [ebp - 0xca4], ebx
jbe 0x403476
lea eax, [ebp - 0xc70]
mov edi, esi
mov dword [ebp - 0xc98], eax
mov eax, dword [ebp - 0xca0]
cmp dword [esi + eax + 0x14], 0
jne 0x403452
cmp dword [ebp - 0xcb0], 0
je 0x4033ea
push dword [ebp - 0xc8c]
push dword [esi + eax + 0x1c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4033fe
xor ecx, ecx
inc ecx
mov dword [ebp - 0xcb4], ecx
jmp 0x403452
push dword [ebp - 0xc90]
push dword [esi + eax + 0x1c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40344f
mov ecx, dword [ebp - 0xca0]
test byte [esi + ecx], 0x20
je 0x40344f
mov edx, dword [ebp - 0xc98]
mov eax, dword [esi + ecx + 8]
mov dword [ebp - 0xca8], 1
mov dword [edx - 0xc], eax
mov eax, dword [esi + ecx + 0x14]
mov dword [edx], eax
mov eax, dword [esi + ecx + 0x18]
mov dword [edx + 4], eax
mov eax, dword [esi + ecx + 0x1c]
mov dword [edx + 8], eax
mov dword [edx - 0x10], 2
mov eax, dword [esi + ecx]
and eax, 0xffffffdf
inc ebx
mov dword [edx - 0x14], eax
add edx, 0x20
mov dword [ebp - 0xc98], edx
xor ecx, ecx
inc ecx
inc edi
add esi, 0x20
cmp edi, dword [ebp - 0xca4]
jb 0x4033b1
mov edi, dword [ebp - 0xccc]
xor esi, esi
mov dword [ebp - 0xc88], ebx
mov ebx, dword [ebp - 0xcd0]
cmp dword [ebp - 0xcb0], 0
mov edx, dword [ebp - 0xc88]
je 0x4034d7
cmp dword [ebp - 0xcb4], 0
jne 0x4034d7
mov eax, dword [ebp - 0xc8c]
mov ecx, edx
shl ecx, 5
inc edx
mov dword [ebp + ecx - 0xc68], eax
mov dword [ebp + ecx - 0xc80], 2
mov dword [ebp + ecx - 0xc7c], esi
mov dword [ebp + ecx - 0xc70], esi
mov dword [ebp + ecx - 0xc6c], 2
mov dword [ebp + ecx - 0xc84], 0xf01ff
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x4034dd
mov eax, dword [ebp - 0xca8]
test eax, eax
jne 0x4034e5
mov ebx, ecx
jmp 0x403548
lea eax, [ebp - 0xcb8]
push eax
push dword [ebp - 0xcac]
lea eax, [ebp - 0xc84]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
jne 0x403548
push 1
lea eax, [ebp - 0xce4]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x403548
push esi
push dword [ebp - 0xcb8]
xor esi, esi
lea eax, [ebp - 0xce4]
inc esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x403548
lea eax, [ebp - 0xce4]
push eax
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
test eax, eax
cmovne ebx, esi
cmp dword [ebp - 0xc90], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x40355f
push dword [ebp - 0xc90]
call esi
cmp dword [ebp - 0xc8c], 0
je 0x403570
push dword [ebp - 0xc8c]
call esi
mov eax, dword [ebp - 0xcbc]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x403583
push eax
call esi
test edi, edi
je 0x40358a
push edi
call esi
mov eax, dword [ebp - 0xc94]
test eax, eax
je 0x4035a4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret