Function at 0x104e1d6
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x350
mov eax, dword [0x1079e94]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x28]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x344], ecx
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp + 0xc]
push ecx
push eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x310], edi
mov dword [ebp - 0x320], edi
mov dword [ebp - 0x328], edi
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x314], edi
mov dword [ebp - 0x31c], edi
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x318], edi
call fcn.01055b85
mov esi, eax
cmp esi, edi
je 0x104e260
push esi
push 0xa2e00ca
jmp 0x104e67a
lea eax, [ebp - 0x328]
push eax
push 2
call fcn.01054594
mov esi, eax
cmp esi, edi
je 0x104e27f
push esi
push 0xa3300ca
jmp 0x104e67a
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x328]
mov dword [ebp - 0x348], 0x100
push edi
mov dword [ebp - 0x34c], 0x104
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x104e2e4
call fcn.0106d6ff
mov esi, eax
push esi
push 0xa4300ca
push dword [ebp - 0x328]
call fcn.0105364b
jmp 0x104e67f
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0106d381
test eax, eax
jne 0x104e30d
call fcn.0106d6ff
mov esi, eax
push esi
push 0xa4900ca
jmp 0x104e67a
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x324]
push 0x100e248
call fcn.0106cfc5
mov esi, eax
cmp esi, edi
je 0x104e335
push esi
push 0xa5000ca
jmp 0x104e67a
lea eax, [ebp - 0x314]
push eax
push edi
push 0x100e0d0
call fcn.0106cfc5
mov esi, eax
cmp esi, edi
je 0x104e358
push esi
push 0xa5600ca
jmp 0x104e67a
push dword [ebp - 0x314]
push dword [ebp - 0x314]
push dword [ebp + 0x18]
push ebx
push dword [ebp - 0x318]
call fcn.0104cae6
mov esi, eax
cmp esi, edi
je 0x104e384
push esi
push 0xa5e00ca
jmp 0x104e67a
push dword [ebp - 0x314]
push dword [ebp - 0x31c]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp - 0x338]
push dword [ebp - 0x340]
call fcn.0104c838
mov esi, eax
cmp esi, edi
je 0x104e3be
push esi
push 0xa6a00ca
jmp 0x104e67a
lea eax, [ebp - 0x310]
push eax
push 0x50
push edi
push dword [ebp - 0x318]
call dword [sym.imp.certcli.dll_CAFindByName]
test eax, eax
jne 0x104e3e0
cmp dword [ebp - 0x310], edi
jne 0x104e427
lea eax, [ebp - 0x310]
push eax
push edi
push edi
push dword [ebp - 0x318]
mov dword [ebp - 0x310], edi
mov dword [ebp + 0x24], edi
call dword [sym.imp.certcli.dll_CACreateNewCA]
mov esi, eax
cmp esi, edi
je 0x104e40f
push esi
push 0xa7b00ca
jmp 0x104e67a
cmp dword [ebp - 0x310], edi
jne 0x104e430
mov esi, 0x80070057
push esi
push 0xa8000ca
jmp 0x104e67a
cmp dword [ebp + 0x24], edi
jne 0x104e5fb
mov eax, dword [ebp - 0x338]
mov ebx, dword [sym.imp.certcli.dll_CASetCAProperty]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x330]
push eax
push 0x10042a0
push dword [ebp - 0x310]
mov dword [ebp - 0x32c], edi
call ebx
mov esi, eax
cmp esi, edi
je 0x104e46d
push esi
push 0xa8900ca
jmp 0x104e67a
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x330]
push eax
push 0x10042b8
push dword [ebp - 0x310]
mov dword [ebp - 0x32c], edi
call ebx
mov esi, eax
cmp esi, edi
je 0x104e4a4
push esi
push 0xa8e00ca
jmp 0x104e67a
lea eax, [ebp - 0x320]
push eax
mov eax, dword [ebp - 0x33c]
mov eax, dword [eax + 0xc]
push 0x10000003
add eax, 0x30
push eax
push 1
call fcn.010580ea
mov esi, eax
cmp esi, edi
je 0x104e4d5
push esi
push 0xa9500ca
jmp 0x104e67a
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x330]
push eax
push 0x10042fc
push dword [ebp - 0x310]
mov dword [ebp - 0x32c], edi
call ebx
mov esi, eax
cmp esi, edi
je 0x104e50c
push esi
push 0xa9a00ca
jmp 0x104e67a
mov eax, dword [ebp + 0x18]
sub eax, edi
je 0x104e58a
dec eax
je 0x104e56b
dec eax
dec eax
je 0x104e54c
dec eax
je 0x104e52d
mov esi, 0x80070057
push esi
push 0xab600ca
jmp 0x104e67a
push 5
push dword [ebp - 0x310]
call dword [sym.imp.certcli.dll_CASetCAFlags]
mov esi, eax
cmp esi, edi
je 0x104e5a9
push esi
push 0xab100ca
jmp 0x104e67a
push 5
push dword [ebp - 0x310]
call dword [sym.imp.certcli.dll_CASetCAFlags]
mov esi, eax
cmp esi, edi
je 0x104e5a9
push esi
push 0xaac00ca
jmp 0x104e67a
push 2
push dword [ebp - 0x310]
call dword [sym.imp.certcli.dll_CASetCAFlags]
mov esi, eax
cmp esi, edi
je 0x104e5a9
push esi
push 0xaa600ca
jmp 0x104e67a
push 2
push dword [ebp - 0x310]
call dword [sym.imp.certcli.dll_CASetCAFlags]
mov esi, eax
cmp esi, edi
je 0x104e5a9
push esi
push 0xaa000ca
jmp 0x104e67a
push dword [ebp + 0x18]
call fcn.0103fdc7
test eax, eax
je 0x104e5f5
cmp dword [ebp + 0x14], edi
je 0x104e5d1
call fcn.0105550f
test eax, eax
je 0x104e5ca
mov eax, 0x1079ec8
jmp 0x104e5d6
mov eax, 0x1079ea4
jmp 0x104e5d6
mov eax, 0x1079ef4
push eax
push 0x10042d0
push dword [ebp - 0x310]
call ebx
mov esi, eax
cmp esi, edi
je 0x104e5f5
push esi
push 0xac200ca
jmp 0x104e67a
mov ebx, dword [ebp - 0x33c]
push dword [ebx + 8]
push dword [ebx + 4]
push 1
call dword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
cmp eax, edi
mov dword [ebp - 0x334], eax
jne 0x104e622
call fcn.0106d6ff
mov esi, eax
push esi
push 0xacd00ca
jmp 0x104e67a
push eax
push dword [ebp - 0x310]
call dword [sym.imp.certcli.dll_CASetCACertificate]
mov esi, eax
cmp esi, edi
je 0x104e63d
push esi
push 0xad100ca
jmp 0x104e67a
cmp dword [ebp + 0x24], edi
jne 0x104e662
push dword [ebp - 0x31c]
push dword [ebp - 0x310]
call dword [sym.imp.certcli.dll_CASetCASecurity]
mov esi, eax
cmp esi, edi
je 0x104e662
push esi
push 0xad600ca
jmp 0x104e67a
push dword [ebp - 0x310]
call dword [sym.imp.certcli.dll_CAUpdateCA]
mov esi, eax
cmp esi, edi
je 0x104e67f
push esi
push 0xad900ca
call fcn.01053610
cmp dword [ebp - 0x324], edi
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x104e695
push dword [ebp - 0x324]
call ebx
cmp dword [ebp - 0x318], edi
je 0x104e6a5
push dword [ebp - 0x318]
call ebx
cmp dword [ebp - 0x320], edi
je 0x104e6b5
push dword [ebp - 0x320]
call ebx
cmp dword [ebp - 0x310], edi
je 0x104e6c9
push dword [ebp - 0x310]
call dword [sym.imp.certcli.dll_CACloseCA]
cmp dword [ebp - 0x31c], edi
je 0x104e6d9
push dword [ebp - 0x31c]
call ebx
cmp dword [ebp - 0x314], edi
je 0x104e6e9
push dword [ebp - 0x314]
call ebx
cmp dword [ebp - 0x334], edi
je 0x104e6fd
push dword [ebp - 0x334]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
push edi
push edi
push edi
push 0xf9
push esi
push 0xaf8
push 0xca
call fcn.01064378
lea ecx, [ebp - 0x328]
call fcn.0101a994
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0x24