Function at 0x75b9db49
Capabilities:
Compare security identifiers
Get session user name
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0xac], 1
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x120], ebx
cmp esi, ebx
je 0x75b9e234
lea eax, [ebp - 0x120]
push eax
push 0x27
push esi
call fcn.759b4220
test eax, eax
jl 0x75b9e234
cmp dword [ebp - 0x120], 0x26
jne 0x75b9e234
push 1
push 0x21
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.759b449f
add esp, 0x10
test eax, eax
je 0x75b9e234
cmp byte [ebp + 0xc], bl
je 0x75b9dbff
cmp edi, ebx
je 0x75b9dbff
cmp word [edi], bx
je 0x75b9dbff
push 0x57
pop esi
lea ecx, [ebp - 0xb0]
call fcn.759b1681
mov eax, esi
jmp 0x75b9e242
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0x124]
mov byte [ecx + 0x25], al
mov esi, 0x759c2dec
cmp al, bl
je 0x75b9dc35
cmp dword [0x75bc8ca8], ebx
je 0x75b9dc35
push ebx
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x75b9e4b0
push ebx
push ebx
push 9
call fcn.759de326
add esp, 0x30
mov eax, dword [ebp - 0x11c]
mov edi, 0x759b7ff8
cmp eax, ebx
je 0x75b9df5b
cmp word [eax], bx
je 0x75b9df5b
push 0x48
pop eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x12c]
push ebx
push eax
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x12c], ebx
call fcn.759b412f
pop ecx
pop ecx
test eax, eax
jne 0x75b9dcd5
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x12c]
call fcn.759b4259
pop ecx
neg eax
pop ecx
push dword [ebp - 0x12c]
sbb al, al
inc al
mov byte [ebp - 0x115], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x115], bl
jne 0x75b9dcf5
lea ecx, [ebp - 0xa0]
call fcn.759b1681
lea ecx, [ebp - 0x114]
call fcn.759b41fe
mov esi, 0x65b
jmp 0x75b9dbed
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0xa0]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x114]
push dword [ebp - 0x11c]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push 1
push dword [ebp - 0x130]
lea ecx, [ebp - 0xa0]
call fcn.759c5bb8
test al, al
je 0x75b9df31
push 1
push dword [ebp - 0x128]
lea ecx, [ebp - 0x114]
call fcn.75b9cd04
test al, al
je 0x75b9df31
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0xa0]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x114]
push dword [ebp - 0x11c]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x75b9dea9
inc eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0xb4]
lea eax, [ebp - 0x120]
push eax
mov eax, ecx
push eax
mov dword [ebp - 0xc0], ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 1
push dword [ebp - 0x120]
lea ecx, [ebp - 0xc0]
call fcn.759c5bb8
test al, al
je 0x75b9de78
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0xc0]
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x75b9de78
push dword [ebp - 0x11c]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x75b9de3f
call fcn.759c4b5e
movzx esi, al
neg esi
sbb esi, esi
and esi, 0x895
lea ecx, [ebp - 0xc0]
add esi, 5
call fcn.759b1681
lea ecx, [ebp - 0xa0]
call fcn.759b1681
lea ecx, [ebp - 0x114]
call fcn.759b41fe
jmp 0x75b9dbed
lea ecx, [ebp - 0xc0]
mov byte [ebp - 0x115], 1
call fcn.759b1681
cmp dword [0x75bc8ca8], ebx
je 0x75b9df19
push ebx
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x75b9e480
push ebx
push ebx
push 9
call fcn.759de326
jmp 0x75b9df16
cmp dword [0x75bc8ca8], ebx
je 0x75b9de99
push ebx
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x75b9e450
push ebx
push ebx
push 9
call fcn.759de326
add esp, 0x30
lea ecx, [ebp - 0xc0]
call fcn.759b1681
jmp 0x75b9dcd5
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne byte [ebp - 0x115]
cmp byte [ebp - 0x115], bl
jne 0x75b9de51
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0x114]
mov dword [ebp - 0xa8], 1
call fcn.759b4323
pop ecx
pop ecx
test eax, eax
jne 0x75b9dcd5
cmp dword [0x75bc8ca8], ebx
je 0x75b9df19
push ebx
push ebx
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0xb0]
push 0x75b9e3d8
push ebx
push ebx
push 9
call fcn.759c26bf
add esp, 0x30
lea ecx, [ebp - 0xa0]
call fcn.759b1681
lea ecx, [ebp - 0x114]
call fcn.759b41fe
jmp 0x75b9df65
cmp dword [0x75bc8ca8], ebx
je 0x75b9dcd5
push ebx
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x75b9e450
push ebx
push ebx
push 9
call fcn.759de326
add esp, 0x30
jmp 0x75b9dcd5
cmp byte [ebp + 0xc], bl
sete byte [ebp - 0x115]
cmp byte [ebp + 0xc], bl
jne 0x75b9dfa3
cmp byte [ebp - 0x115], bl
jne 0x75b9dfa3
call fcn.759c4b5e
test al, al
jne 0x75b9dfa3
cmp dword [0x75bc8ca8], ebx
je 0x75b9df9c
push ebx
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x75b9e388
push ebx
push ebx
push 9
call fcn.759de326
add esp, 0x30
push 5
jmp 0x75b9dbec
mov byte [ebp - 0x116], bl
mov byte [ebp - 0x134], bl
cmp dword [0x75bc8ca8], ebx
je 0x75b9dfdf
mov eax, 0x75b9e374
cmp byte [ebp + 0xc], bl
jne 0x75b9dfc6
mov eax, 0x75b9e364
push ebx
push ebx
push esi
push esi
push esi
push esi
push esi
push eax
push 0x75b9e348
push ebx
push ebx
push 9
call fcn.759de326
add esp, 0x30
push 1
lea ecx, [ebp - 0x13c]
call fcn.759b87f0
cmp byte [ebp + 0xc], bl
jne 0x75b9e007
cmp byte [ebp - 0x115], bl
jne 0x75b9e007
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x11c], eax
jmp 0x75b9e00d
mov dword [ebp - 0x11c], ebx
mov eax, dword [ebp - 0x124]
push ebx
push ebx
lea edx, [ebp - 0x134]
push edx
lea edx, [ebp - 0x116]
push edx
xor edx, edx
cmp byte [eax + 0x25], bl
lea ecx, [eax + 4]
sete dl
lea eax, [ebp - 0x48]
push edx
push ecx
push eax
movzx eax, byte [ebp + 0xc]
push dword [ebp - 0x11c]
neg eax
sbb eax, eax
and eax, 2
push ebx
push eax
call fcn.75a6a67b
add esp, 0x28
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x11c], eax
call fcn.759b87d1
cmp dword [ebp - 0x11c], ebx
je 0x75b9e198
cmp byte [ebp - 0x116], bl
je 0x75b9e09f
cmp dword [0x75bc8ca8], ebx
je 0x75b9e095
push ebx
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x75b9e2f8
push ebx
push ebx
push 9
call fcn.759de326
add esp, 0x30
mov esi, 0x64a
jmp 0x75b9dbed
cmp byte [ebp - 0x115], bl
je 0x75b9e160
mov byte [ebp - 0x115], bl
cmp dword [0x75bc8ca8], ebx
je 0x75b9e0d2
push ebx
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x75b9e2a8
push ebx
push ebx
push 9
call fcn.759de326
add esp, 0x30
push 1
lea ecx, [ebp - 0x13c]
call fcn.759b87f0
push ebx
push ebx
lea eax, [ebp - 0x115]
push eax
lea eax, [ebp - 0x116]
push eax
mov eax, dword [ebp - 0x124]
xor ecx, ecx
cmp byte [eax + 0x25], bl
sete cl
add eax, 4
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push 1
call fcn.75a6a67b
add esp, 0x28
mov dword [ebp - 0x11c], eax
cmp eax, ebx
je 0x75b9e155
cmp byte [ebp - 0x116], bl
je 0x75b9e155
cmp dword [0x75bc8ca8], ebx
je 0x75b9e145
push ebx
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x75b9e2f8
push ebx
push ebx
push 9
call fcn.759de326
add esp, 0x30
lea ecx, [ebp - 0x13c]
call fcn.759b87d1
jmp 0x75b9e095
lea ecx, [ebp - 0x13c]
call fcn.759b87d1
cmp dword [ebp - 0x11c], ebx
je 0x75b9e198
cmp dword [0x75bc8ca8], ebx
je 0x75b9e18e
push ebx
push ebx
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x140]
push 0x75b9e258
push ebx
push ebx
push 9
call fcn.759c26bf
add esp, 0x30
mov esi, 0x645
jmp 0x75b9dbed
mov eax, dword [ebp - 0x124]
mov esi, dword [ebp - 0x124]
add eax, 4
mov ecx, dword [eax]
mov eax, dword [esi + 0x2c]
mov edx, dword [eax]
push 0xffffffffffffffff
push ecx
push eax
call dword [edx + 0x60]
push eax
lea ecx, [esi + 0x20]
call fcn.759cbe5f
cmp dword [esi + 0x20], ebx
je 0x75b9dceb
call fcn.759c4b5e
test al, al
jne 0x75b9e1e2
push dword [ebp - 0x134]
mov ecx, esi
call fcn.75b9cb49
mov byte [esi + 0x24], al
jmp 0x75b9e1e6
mov byte [esi + 0x24], 1
cmp dword [0x75bc8ca8], ebx
je 0x75b9e225
mov ecx, 0x759b1758
cmp byte [esi + 0x24], bl
jne 0x75b9e1fd
mov ecx, 0x75a0a4d4
mov eax, 0x75a1079c
cmp byte [esi + 0x25], bl
jne 0x75b9e20c
mov eax, 0x75a10790
push ebx
push ebx
push edi
push edi
push edi
push edi
push ecx
push eax
push 0x75a10720
push ebx
push ebx
push 9
call fcn.759c26bf
add esp, 0x30
lea ecx, [ebp - 0xb0]
call fcn.759b1681
xor eax, eax
jmp 0x75b9e242
lea ecx, [ebp - 0xb0]
call fcn.759b1681
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret 0x10