Function at 0x100038ee
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x10086e84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
lea eax, [ebp - 0x64]
push eax
push str.S_1_5_18
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x4c], ebx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x10003947
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10003940
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x4c], eax
jl 0x100039c5
lea eax, [ebp - 0x54]
push eax
push str.S_1_5_32_544
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x10003970
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1000396d
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jl 0x100039c5
lea eax, [ebp - 0x60]
push eax
push str.S_1_5_32_545
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x1000399e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1000399b
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jl 0x100039c5
lea eax, [ebp - 0x50]
push eax
push str.S_1_5_32_547
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x5c]
push eax
push str.S_1_3_0
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov dword [ebp - 0x68], eax
push 0x43
lea eax, [ebp - 0x47]
push ebx
push eax
mov byte [ebp - 0x48], bl
call fcn.10042010
add esp, 0xc
cmp dword [ebp - 0x4c], ebx
jl 0x10003c6d
push edi
push 2
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x58], ebx
xor esi, esi
pop edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push str.NT_SERVICETrustedInstaller
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x10003a32
cmp esi, ebx
jne 0x10003a32
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003e542
pop ecx
mov esi, eax
dec edi
jne 0x100039f0
cmp esi, ebx
je 0x10003a40
push esi
call fcn.100421fa
pop ecx
push 1
push str.SeSecurityPrivilege
call fcn.10002101
push 1
push str.SeTakeOwnershipPrivilege
call fcn.10002101
push 1
push str.SeRestorePrivilege
call fcn.10002101
push dword [ebp - 0x54]
call fcn.100038a6
add esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0x4c], eax
jl 0x10003c48
push dword [ebp - 0x60]
mov esi, dword [sym.imp.ADVAPI32.dll_GetLengthSid]
call esi
push dword [ebp - 0x54]
mov edi, eax
call esi
push dword [ebp - 0x64]
add edi, eax
call esi
cmp dword [ebp - 0x6c], ebx
lea edi, [eax + edi + 0x20]
je 0x10003aaa
cmp dword [ebp - 0x50], ebx
je 0x10003aaa
push dword [ebp - 0x50]
call esi
lea edi, [edi + eax + 8]
cmp dword [ebp - 0x68], ebx
je 0x10003abd
cmp dword [ebp - 0x5c], ebx
je 0x10003abd
push dword [ebp - 0x5c]
call esi
lea edi, [edi + eax + 8]
cmp dword [ebp - 0x70], ebx
je 0x10003acc
lea eax, [ebp - 0x48]
push eax
call esi
lea edi, [edi + eax + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x58], ebx
jne 0x10003aeb
mov dword [ebp - 0x4c], 0x8007000e
cmp dword [ebp - 0x4c], 0
jl 0x10003c46
push 4
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x10003b1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10003b17
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10003c46
push dword [ebp - 0x64]
mov esi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAceEx]
mov edi, 0xf003f
push edi
push 3
push 4
push ebx
call esi
test eax, eax
jne 0x10003b55
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10003b52
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10003c46
push dword [ebp - 0x54]
push edi
push 3
push 4
push ebx
call esi
test eax, eax
jne 0x10003b85
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10003b82
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10003c46
push dword [ebp - 0x60]
mov ebx, 0x20019
push ebx
push 3
push 4
push dword [ebp - 0x58]
call esi
test eax, eax
jne 0x10003bbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10003bb9
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10003c46
cmp dword [ebp - 0x6c], 0
je 0x10003bdf
cmp dword [ebp - 0x50], 0
je 0x10003bdf
push dword [ebp - 0x50]
push ebx
push 3
push 4
push dword [ebp - 0x58]
call esi
cmp dword [ebp - 0x68], 0
je 0x10003bf8
cmp dword [ebp - 0x5c], 0
je 0x10003bf8
push dword [ebp - 0x5c]
push edi
push 3
push 4
push dword [ebp - 0x58]
call esi
cmp dword [ebp - 0x70], 0
je 0x10003c0c
lea eax, [ebp - 0x48]
push eax
push edi
push 3
push 4
push dword [ebp - 0x58]
call esi
push 0
push dword [ebp - 0x58]
push 0
push dword [ebp - 0x54]
push 5
call fcn.10002d13
neg eax
sbb eax, eax
and eax, 8
add eax, 4
push eax
push str.MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
test eax, eax
je 0x10003c46
jle 0x10003c43
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x4c], eax
xor ebx, ebx
push ebx
push str.SeSecurityPrivilege
call fcn.10002101
push ebx
push str.SeTakeOwnershipPrivilege
call fcn.10002101
push ebx
push str.SeRestorePrivilege
call fcn.10002101
add esp, 0x18
pop edi
cmp dword [ebp - 0x64], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x10003c80
push dword [ebp - 0x64]
call esi
mov dword [ebp - 0x64], ebx
cmp dword [ebp - 0x54], ebx
je 0x10003c8d
push dword [ebp - 0x54]
call esi
mov dword [ebp - 0x54], ebx
cmp dword [ebp - 0x60], ebx
je 0x10003c9a
push dword [ebp - 0x60]
call esi
mov dword [ebp - 0x60], ebx
cmp dword [ebp - 0x50], ebx
je 0x10003ca7
push dword [ebp - 0x50]
call esi
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x5c], ebx
je 0x10003cb1
push dword [ebp - 0x5c]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c]
pop esi
xor ecx, ebp
pop ebx
call fcn.10041ffa
leave
ret