Function at 0x44ad75
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x44ad95
mov ecx, dword [ebp + 8]
push 0x4a7dd8
call fcn.004362eb
jmp 0x44b0cf
push ebx
xor ecx, ecx
lea eax, [ebp + 0xc]
push eax
push ecx
push ecx
push 2
push edi
mov dword [ebp + 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x44ae39
call ebx
cmp eax, 0x7a
je 0x44ae39
xor ebx, ebx
push ebx
push eax
lea eax, [ebp - 0x44]
push str.GetTokenInformation__
push eax
call fcn.00436a45
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x44]
call fcn.0043634f
lea ecx, [ebp - 0x30]
call fcn.0043fe40
cmp eax, 0x7d1
lea eax, [ebp - 0x30]
push ebx
jl 0x44ae23
push ebx
push 0x588
push 0x49a508
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004069d9
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x44]
call fcn.0043634f
jmp 0x44ae2c
mov ecx, dword [ebp + 8]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x30]
call fcn.0043634f
jmp 0x44b0ce
push esi
push dword [ebp + 0xc]
call fcn.004529c5
mov esi, eax
pop ecx
test esi, esi
jne 0x44aece
xor ebx, ebx
lea eax, [ebp - 0x44]
push ebx
push str.Failed_to_allocate_buffer_for_the_token_information_structure
push 0x4a49d8
push 3
push eax
call fcn.00436297
add esp, 0x10
lea ecx, [ebp - 0x30]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x44]
call fcn.0043634f
lea ecx, [ebp - 0x30]
call fcn.0043fe40
cmp eax, 0x7d1
lea eax, [ebp - 0x30]
push ebx
jl 0x44aec3
push ebx
push 0x590
push 0x49a508
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004069d9
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x44]
call fcn.0043634f
lea ecx, [ebp - 0x30]
call fcn.0043634f
push ebx
jmp 0x44b0c7
mov ecx, dword [ebp + 8]
push eax
call fcn.0043630b
jmp 0x44aeb5
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00449f02
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0043630b
lea ecx, [ebp - 0x44]
call fcn.0043634f
lea ecx, [ebp - 0x30]
call fcn.0043fe40
cmp eax, 0x7d1
jl 0x44af3a
push 0
push 0
push 0x595
lea eax, [ebp - 0x30]
push 0x49a508
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004069d9
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x44]
call fcn.0043634f
lea ecx, [ebp - 0x30]
jmp 0x44b0c1
lea ecx, [ebp - 0x30]
call fcn.0043634f
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push esi
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x44afb1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
call ebx
xor ebx, ebx
push ebx
push eax
lea eax, [ebp - 0x44]
push str.GetTokenInformation__
push eax
call fcn.00436a45
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x44]
call fcn.0043634f
lea ecx, [ebp - 0x30]
call fcn.0043fe40
cmp eax, 0x7d1
lea eax, [ebp - 0x30]
push ebx
jl 0x44afa6
push ebx
push 0x599
jmp 0x44af0f
mov ecx, dword [ebp + 8]
push eax
call fcn.0043630b
jmp 0x44af32
push 0x4a7e7c
lea ecx, [ebp - 0x1c]
call fcn.004362eb
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x44afe7
lea eax, [esi + 4]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x44b021
mov eax, dword [ebp - 8]
inc ebx
add eax, 8
mov dword [ebp - 8], eax
cmp ebx, dword [esi]
jb 0x44afca
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x10], 0x3e9
jne 0x44b0b1
push 1
call fcn.00445137
pop ecx
test al, al
je 0x44b0b1
mov eax, dword [sym.imp.ADVAPI32.dll_IsTokenRestricted]
cmp eax, ebx
jne 0x44b065
mov dword [ebp - 0x10], 0x7e2
jmp 0x44b073
test byte [esi + ebx*8 + 8], 4
lea ecx, [ebp - 0x1c]
je 0x44b040
xor eax, eax
mov dword [ebp - 0x10], 0x3e9
push eax
push eax
mov byte [ebp - 0xc], al
call fcn.004414cc
jmp 0x44afe7
test byte [esi + ebx*8 + 8], 0x10
je 0x44b05c
mov dword [ebp - 0x10], 0x2904
xor ebx, ebx
push ebx
push ebx
mov byte [ebp - 0xc], bl
call fcn.004414cc
jmp 0x44afe9
mov dword [ebp - 0x10], 0x2905
jmp 0x44b04e
push edi
call eax
test eax, eax
je 0x44b082
mov dword [ebp - 0x10], 0x2906
push ebx
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0xc], bl
call fcn.004414cc
jmp 0x44b0b1
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
test eax, eax
je 0x44b0b1
call edi
push eax
lea eax, [ebp - 0x44]
push str.::IsTokenRestricted__
push eax
call fcn.00436a45
add esp, 0xc
mov ecx, eax
call fcn.0043fe40
lea ecx, [ebp - 0x44]
call fcn.0043634f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0043630b
lea ecx, [ebp - 0x1c]
call fcn.0043634f
push esi
call fcn.0046b1fd
pop ecx
pop esi
pop ebx
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret