Function at 0x100511e
Capabilities:
Get common file path
Get token privileges

Disassembly:
push 0x120
push 0x1001690
call fcn.010070d8
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], esi
push 0x104
lea eax, [ebp - 0x124]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1005161
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x10054a0
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [ebp - 0x128], edi
cmp edi, esi
je 0x1005153
mov ebx, dword [ebp + 8]
push 0x40e
push edi
mov esi, dword [sym.imp.USER32.dll_LoadBitmapA]
call esi
mov dword [ebx + 0x24], eax
push 0x40f
push edi
call esi
mov dword [ebx + 0x28], eax
push 0x2bc
mov edi, 0x3fb
push edi
push dword [ebx + 0x24]
mov esi, 0x404
push esi
push dword [ebx + 4]
call fcn.010031d0
xor eax, eax
cmp dword [ebx + 8], eax
je 0x10051c8
mov dword [ebp - 0x1c], 0x4c7
jmp 0x10054a0
cmp dword [0x100f2c8], eax
jne 0x10051ec
cmp dword [0x100f2e0], eax
jne 0x10051ec
push 0x1022780
push dword [0x1021004]
call fcn.01004f8a
test eax, eax
je 0x10051bc
push 0x190
push edi
push dword [ebx + 0x28]
push esi
push dword [ebx + 4]
call fcn.010031d0
xor esi, esi
cmp dword [0x100f2dc], esi
jne 0x1005257
push 0x2bc
push 0x3fc
push dword [ebx + 0x24]
push 0x405
push dword [ebx + 4]
call fcn.010031d0
call fcn.01007630
mov dword [0x1020dc4], eax
push 0x1020cc0
call fcn.0100a437
mov dword [0x10213e4], eax
cmp dword [0x1020dc4], eax
jae 0x1005257
mov esi, 0xf104
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x1c], esi
jmp 0x10054a0
push ebx
call fcn.01004428
cmp dword [ebx + 8], esi
jne 0x10051bc
push 0x1020824
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x10054a0
push 0x11
call fcn.010075bb
push 0x12
call fcn.010075bb
push 0x13
call fcn.010075bb
push 8
call fcn.010075bb
push 9
call fcn.010075bb
push 0x1020dc8
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
push 0x100f108
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x10054a0
lea eax, [ebp - 0x1c]
push eax
push 0xfffa
push 0x10339e0
push 4
push dword [0x1020824]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x10054a0
push 0x104
push 0x1022660
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1005153
push dword [0x10339e0]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov dword [ebp - 0x12c], eax
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [0x1020ca8], eax
cmp eax, esi
jne 0x1005341
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10054a0
mov ecx, dword [ebp - 0x12c]
mov esi, dword [0x10339e0]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x1c]
push eax
push 0xfffa
push 0x10339e0
push 1
push dword [0x1020824]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10054a0
and dword [ebp - 0x1c], 0
push dword [0x10339e0]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov dword [ebp - 0x12c], eax
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [0x102082c], eax
test eax, eax
je 0x1005334
mov ecx, dword [ebp - 0x12c]
mov esi, dword [0x10339e0]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x190
push 0x3fc
push dword [ebx + 0x28]
push 0x405
push dword [ebx + 4]
call fcn.010031d0
push 0x2bc
mov edi, 0x3fd
push edi
push dword [ebx + 0x24]
mov esi, 0x406
push esi
push dword [ebx + 4]
call fcn.010031d0
cmp dword [0x10204a4], 5
jb 0x1005449
push 0
push 0x1020de0
push 0x1020f00
call fcn.0100c4e6
lea eax, [ebp - 0x130]
push eax
push 0
push 0x102049c
push dword [0x1020ca8]
push 0
push 0x1001674
push 0x1020cc0
push dword [0x1021004]
call fcn.0100bc43
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10054a0
lea eax, [ebx + 0x14]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.01009445
push 0x190
push edi
push dword [ebx + 0x28]
push esi
push dword [ebx + 4]
call fcn.010031d0
push 0x2bc
push 0x3fe
push dword [ebx + 0x24]
push 0x407
push dword [ebx + 4]
call fcn.010031d0
push 0x1020cc0
push 1
push 0x1001654
push dword [0x1021004]
call fcn.0100962a
test eax, eax
jne 0x10054a0
and dword [ebp - 0x20], eax
or dword [ebp - 4], 0xffffffff
call fcn.010054b4
mov eax, dword [ebp - 0x1c]
call fcn.01007111
ret 4