Function at 0x408324
Capabilities:
Compare security identifiers

Disassembly:
test dword [0x4b63ec], 0xffffff80
jne 0x40834c
test dword [0x4b63ec], 0xffffffff
jne 0x40848c
call fcn.00490ee4
jmp fcn.00408324
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [0x4a3b94], eax
mov dword [0x4a3b90], eax
call fcn.00408280
cmp eax, 1
jne 0x40837f
mov eax, 1
mov esp, ebp
pop ebp
ret
mov eax, dword [0x497610]
movzx edx, word [0x497614]
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xc]
mov word [ebp - 0x14], dx
push ecx
push ebx
push ebx
push 2
push dword [0x4a3b90]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4083b5
xor eax, eax
mov ebx, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4083ed
mov edi, dword [ebp - 0xc]
mov eax, edi
call fcn.00486680
and esp, 0xfffffff0
mov eax, esp
mov ebx, eax
test ebx, ebx
je 0x4083ed
lea edx, [ebp - 0xc]
push edx
push edi
push ebx
push 2
push dword [0x4a3b90]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4083f9
xor eax, eax
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x18]
xor ecx, ecx
lea edx, [ebp - 0x10]
push edx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x220
push 0x20
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4083ed
cmp dword [ebx], 0
jbe 0x408485
xor edi, edi
push dword [ebp - 0x10]
push dword [ebx + edi*8 + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40847e
inc edi
cmp edi, dword [ebx]
jb 0x408423
xor ebx, ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [0x4a3b94]
test eax, eax
je 0x408454
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4a3b90]
test eax, eax
je 0x408464
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 1
cmp ebx, 0
mov eax, 0
cmovne eax, edx
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, 1
jmp 0x40843b
xor ebx, ebx
jmp 0x40843b
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [0x4a3b94], eax
mov dword [0x4a3b90], eax
call fcn.00408280
cmp eax, 1
jne 0x4084bf
mov eax, 1
mov esp, ebp
pop ebp
ret
mov eax, dword [0x497618]
mov dword [ebp - 0x18], eax
movzx edx, word [0x49761c]
mov word [ebp - 0x14], dx
xor ebx, ebx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push ebx
push 2
push dword [0x4a3b90]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4084f5
xor eax, eax
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40852d
mov esi, dword [ebp - 0xc]
mov eax, esi
call fcn.00486680
and esp, 0xfffffff0
mov eax, esp
mov ebx, eax
test ebx, ebx
je 0x40852d
lea edx, [ebp - 0xc]
push edx
push esi
push ebx
push 2
push dword [0x4a3b90]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x408539
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
lea esi, [ebp - 0x18]
xor ecx, ecx
lea edx, [ebp - 0x10]
push edx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x220
push 0x20
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40852d
cmp dword [ebx], 0
jbe 0x4085bf
xor esi, esi
push dword [ebp - 0x10]
push dword [ebx + esi*8 + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4085b8
inc esi
cmp esi, dword [ebx]
jb 0x408563
xor ebx, ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [0x4a3b94]
test eax, eax
je 0x408594
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4a3b90]
test eax, eax
je 0x4085a4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov eax, 0
setne al
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ebx, 1
jmp 0x40857b
xor ebx, ebx
jmp 0x40857b