Function at 0x5349e0
Capabilities:
Get token membership
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x270], 0
push esi
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jne 0x534a7f
mov eax, 0x3ec
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 8], 2
jge 0x534a9e
push 0x186bf
mov esi, 0x16
push esi
push edi
call fcn.00538b70
add esp, 0xc
jmp 0x534b41
mov eax, dword [ebx + 4]
push dword [eax + 4]
call fcn.004f3ea0
mov ecx, eax
xor ebx, ebx
mov eax, dword [0xa39918]
add esp, 4
mov dword [ebp - 0x264], ecx
cmp dword [eax], ebx
je 0x534b12
xor esi, esi
push ecx
push dword [esi + eax]
call fcn.004f37c0
add esp, 8
test eax, eax
je 0x534b94
mov eax, dword [0xa39918]
mov ecx, dword [esi + eax + 4]
test ecx, ecx
je 0x534aff
mov esi, dword [ebp - 0x264]
push esi
push ecx
call fcn.004f37c0
add esp, 8
test eax, eax
je 0x534b9a
mov eax, dword [0xa39918]
mov ecx, dword [ebp - 0x264]
inc ebx
lea esi, [ebx + ebx*8]
shl esi, 3
cmp dword [esi + eax], 0
jne 0x534ac1
cmp dword [ebp - 0x25c], 0
mov ecx, 0x6d7038
mov eax, 0x6cae50
mov esi, 0x16
cmove eax, ecx
push eax
push 0x186c1
push esi
push edi
call fcn.00538b70
add esp, 0x10
mov ebx, dword [ebp - 0x254]
push 0xa39900
call fcn.004f4a70
add esp, 4
cmp dword [0xa39940], edi
jne 0x534b6a
mov dword [0xa39940], 0
mov dword [0xa39944], 0
push 0xa39900
call fcn.004f4b00
add esp, 4
cmp dword [ebp - 0x270], 0
je 0x535117
push edi
call fcn.005a6fd0
add esp, 4
mov edi, eax
jmp 0x535119
mov esi, dword [ebp - 0x264]
mov eax, dword [0xa39918]
lea ebx, [ebx + ebx*8]
shl ebx, 3
cmp dword [eax + ebx + 0x40], 0
jne 0x534bf4
test byte [0x9538a8], 1
je 0x534bda
push esi
push str.Command__s_has_no_implementation_n
push 0x299
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_process
push dword [0x7d0124]
push 1
call fcn.004f21c0
add esp, 0x1c
push 0x186c2
push 0xffffffffffffffff
push edi
call fcn.00538b70
add esp, 0xc
mov esi, 0x26
jmp 0x534b3b
cmp dword [ebp - 0x25c], 0
jne 0x534cf1
test byte [eax + ebx + 0xc], 0x20
push edi
jne 0x534cdf
call fcn.005a6fd0
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
test eax, eax
jne 0x534c69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
test byte [0x9538a8], 1
je 0x534c73
push esi
call fcn.004f1b00
push eax
push esi
push esi
push str.Error_from_ImpersonateNamedPipeClient:_err__d__0x_x_:__s_n
push 0x2ad
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_process
push dword [0x7d0124]
push 1
call fcn.004f21c0
add esp, 0x28
jmp 0x534c73
mov dword [ebp - 0x270], 1
lea eax, [ebp - 0x288]
mov dword [ebp - 0x264], 0
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x288], 0x44
push eax
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x534cb7
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x534cbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x264], 0
jne 0x534cf1
push 0x186c0
mov esi, 0x2e4
push esi
push edi
call fcn.00538b70
add esp, 0xc
jmp 0x534b3b
call fcn.005a6fd0
push eax
call fcn.00535e50
add esp, 8
test eax, eax
jne 0x534cc6
lea eax, [ebp - 0x260]
push eax
call fcn.00537190
mov esi, eax
add esp, 4
test esi, esi
je 0x534d43
test byte [0x9538a8], 1
mov dword [ebp - 0x258], esi
je 0x534b3b
push esi
push str.Failed_to_init_validation_object:__d_n
push 0x2d7
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_process
push dword [0x7d0124]
push 1
call fcn.004f21c0
add esp, 0x1c
jmp 0x534b3b
lea eax, [ebp - 0x274]
mov dword [ebp - 0x284], 1
push eax
mov eax, dword [0xa39918]
add eax, ebx
push eax
push dword [ebp - 0x25c]
lea eax, [ebp - 0x260]
push dword [ebp - 0x254]
push edi
push eax
call fcn.00537260
mov esi, eax
add esp, 0x18
test esi, esi
je 0x534d9e
test byte [0x9538a8], 1
mov dword [ebp - 0x258], esi
je 0x534b3b
push esi
push str.Failed_to_validate_command_line:__d_n
push 0x2e2
jmp 0x534d24
lea eax, [ebp - 0x260]
push 0x78
push eax
call fcn.00537ae0
add esp, 8
test eax, eax
je 0x534e65
push edi
push 1
call fcn.00535830
add esp, 8
test eax, eax
jne 0x534e65
mov eax, dword [0xa39918]
push 0xa39920
push dword [ebx + eax]
call fcn.005be700
mov esi, eax
add esp, 8
test esi, esi
je 0x534df0
mov dword [ebp - 0x258], esi
jmp 0x534b3b
mov eax, dword [0xa39918]
push str.list_solidified
push dword [ebx + eax]
call fcn.004f3800
add esp, 8
test eax, eax
jne 0x534e47
call fcn.004f46e0
push edx
push eax
push str._I64d
lea eax, [ebp - 0x30]
push 0x2c
push eax
call fcn.004f3b60
push 0xa39920
lea eax, [ebp - 0x30]
push eax
push str.time
call fcn.005be850
mov esi, eax
add esp, 0x20
test esi, esi
je 0x534e47
mov dword [ebp - 0x258], esi
jmp 0x534b3b
push 0xa39920
call fcn.005beb80
mov esi, eax
add esp, 4
test esi, esi
je 0x534e65
mov dword [ebp - 0x258], esi
jmp 0x534b3b
mov eax, dword [ebp - 0x25c]
test eax, eax
je 0x534e90
mov esi, dword [0x910f50]
test esi, esi
je 0x534e90
mov ebx, dword [ebp - 0x254]
push esi
push ebx
push edi
push eax
call fcn.00535ce0
add esp, 0x10
jmp 0x534b41
mov esi, dword [0x910f4c]
test esi, esi
je 0x534eb2
mov ebx, dword [ebp - 0x254]
push esi
push ebx
push edi
push 0
call fcn.00535ce0
add esp, 0x10
jmp 0x534b41
cmp dword [ebp - 0x274], 0
jne 0x534ec5
mov esi, 0x16
jmp 0x534b3b
call fcn.00594950
test eax, eax
je 0x534efd
call fcn.00594950
cmp eax, 4
je 0x534efd
call fcn.00594d70
test eax, 0x400
je 0x534efd
lea eax, [ebp - 0x278]
push eax
call fcn.00591cd0
mov esi, eax
add esp, 4
test esi, esi
jne 0x534b3b
mov eax, dword [0xa39918]
test byte [ebx + eax + 0xc], 6
je 0x535038
cmp dword [ebp - 0x25c], 0
jne 0x535038
cmp dword [ebp - 0x278], 0
jne 0x535038
lea eax, [ebp - 0x260]
push 0x7a
push eax
call fcn.00537ae0
add esp, 8
test eax, eax
je 0x534f53
lea eax, [ebp - 0x260]
push 0x7a
push eax
call fcn.00537b10
add esp, 8
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x280]
push eax
mov eax, dword [0xa39918]
push dword [ebx + eax + 0xc]
mov eax, dword [ebp - 0x254]
push dword [ebp - 0x268]
mov eax, dword [eax + 4]
push dword [eax + 4]
push edi
call fcn.00532820
mov esi, eax
add esp, 0x18
cmp esi, 0x3e
jne 0x534fa6
push 0x186ba
push 1
push edi
call fcn.00538b70
add esp, 0xc
mov esi, 1
jmp 0x534b3b
cmp esi, 0x45d
jne 0x535002
cmp dword [ebp - 0x27c], 1
jne 0x534fbe
push 0x186be
jmp 0x534fea
call fcn.00533500
test eax, eax
jle 0x534fe5
push eax
push 0x186bc
push 0x45d
push edi
call fcn.00538b70
add esp, 0x10
mov esi, 1
jmp 0x534b3b
push 0x186bd
push 0x45d
push edi
call fcn.00538b70
add esp, 0xc
mov esi, 1
jmp 0x534b3b
test esi, esi
je 0x535020
push 0xc6
push esi
push edi
call fcn.00538b70
add esp, 0xc
mov dword [ebp - 0x258], esi
jmp 0x534b3b
cmp dword [ebp - 0x280], 0
jne 0x535033
push 0x186bb
jmp 0x534f91
mov eax, dword [0xa39918]
mov eax, dword [ebx + eax + 0x40]
lea ecx, [ebp - 0x258]
push ecx
lea ecx, [ebp - 0x260]
push ecx
mov ecx, dword [ebp - 0x254]
push dword [ecx + 0xc]
push edi
call eax
mov esi, eax
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x254]
call fcn.005354b0
mov eax, dword [ebp - 0x258]
add esp, 0x18
mov ebx, dword [ebp - 0x26c]
test eax, eax
jne 0x5350b5
test byte [0x9538a8], 4
je 0x535101
push esi
call fcn.004f1b00
push eax
push esi
push ebx
push str.Command__s_returned__d:__s_n
push 0x377
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_process
push dword [0x7d0124]
push 4
call fcn.004f21c0
add esp, 0x28
jmp 0x535101
test byte [0x9538a8], 4
je 0x535101
push eax
call fcn.004f1b00
add esp, 4
push eax
mov eax, dword [ebp - 0x258]
push eax
push eax
push esi
call fcn.004f1b00
add esp, 4
push eax
push esi
push esi
push ebx
push str.Command__s_returned_err__d__0x_x_:__s:_internal_error__d__0x_x_:__s_n
push 0x37d
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_process
push dword [0x7d0124]
push 4
call fcn.004f21c0
add esp, 0x34
test ebx, ebx
je 0x534b3b
push ebx
call fcn.004f3570
add esp, 4
jmp 0x534b3b
xor edi, edi
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 0x268], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x26c], 0
lea eax, [ebp - 0x250]
mov dword [ebp - 0x254], 0
push str._a__b__d__Y__H:_M:_S
push 0x104
push eax
call fcn.004f46e0
push edx
push eax
call fcn.004f4830
lea eax, [ebp - 0x26c]
push eax
push ebx
call fcn.005354b0
add esp, 0x1c
test eax, eax
je 0x5351bc
test byte [0x9538a8], 1
je 0x5352b0
push eax
lea eax, [ebp - 0x250]
push eax
push str.Error_in_getting_cmd_params_alloc_:_s__d_n
push 0x223
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_evt_raise_COMMAND_EXECUTED
push dword [0x7d0124]
push 1
call fcn.004f21c0
add esp, 0x20
jmp 0x5352b0
cmp dword [ebp - 0x25c], 0
mov ebx, dword [ebp - 0x26c]
jne 0x53523f
lea eax, [ebp - 0x254]
push eax
push edi
call fcn.00535900
add esp, 8
test eax, eax
je 0x535222
test byte [0x9538a8], 1
je 0x53521a
push eax
push ebx
lea eax, [ebp - 0x250]
push eax
push str.Error_in_cli_username_alloc:_s__s__d_n
push 0x22f
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_evt_raise_COMMAND_EXECUTED
push dword [0x7d0124]
push 1
call fcn.004f21c0
mov edi, dword [ebp - 0x254]
jmp 0x53528e
mov edi, dword [ebp - 0x254]
jmp 0x535291
mov edi, dword [ebp - 0x254]
test edi, edi
jne 0x535233
mov edi, str.Local_Administrator
jmp 0x535244
mov dword [ebp - 0x268], 1
jmp 0x535244
mov edi, str.Remote_Administrator
push 0
push ebx
lea eax, [ebp - 0x250]
push edi
push eax
call fcn.005a3460
add esp, 0x10
test eax, eax
je 0x535291
test byte [0x9538a8], 1
je 0x535291
push eax
push ebx
lea eax, [ebp - 0x250]
push eax
push str.Error_in_raising_event_:_s__s__d_n
push 0x241
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_evt_raise_COMMAND_EXECUTED
push dword [0x7d0124]
push 1
call fcn.004f21c0
add esp, 0x24
test ebx, ebx
je 0x53529e
push ebx
call fcn.004f3570
add esp, 4
cmp dword [ebp - 0x268], 0
je 0x5352b0
push edi
call fcn.004f3570
add esp, 4
cmp dword [ebp - 0x284], 1
jne 0x5352c8
lea eax, [ebp - 0x260]
push eax
call fcn.005371d0
add esp, 4
mov eax, dword [0x910f48]
test eax, eax
je 0x5352da
push eax
call fcn.004f3570
add esp, 4
cmp dword [ebp - 0x270], 0
mov dword [0x910f48], 0
je 0x535347
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x535347
test byte [0x9538a8], 1
je 0x535331
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
push eax
push str.RevertToSelf_function_failed_with_error__d
push 0x3a2
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_process
push dword [0x7d0124]
push 1
call fcn.004f21c0
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test esi, esi
jne 0x535371
cmp dword [ebp - 0x258], esi
jne 0x535371
cmp dword [0xa3c628], esi
jne 0x535371
call fcn.00595100
xor eax, eax
and edx, 0x100
or eax, edx
je 0x535371
call fcn.005d7ce0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret