Function at 0x7592dfec
Capabilities:
Compare security identifiers
Get hostname
Get session user name

Disassembly:
push dword [eax]
lea ecx, [ebp - 0x458]
call fcn.7592e4e2
test al, al
jne 0x7592e139
cmp byte [ebp + 8], al
jne 0x759340c1
push 0x7594d4c8
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x759340d7
mov eax, dword [ebp - 0x434]
push dword [esi + eax]
lea ecx, [ebp - 0x458]
call fcn.7592e4fa
test al, al
jne 0x7592e152
call fcn.75921d31
test al, al
jne 0x75934115
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0x7594d4c8
push dword [ebp - 0x43c]
call edi
test eax, eax
jne 0x75934128
push 0x7594d5c8
push dword [ebp - 0x43c]
call edi
test eax, eax
jne 0x7592e152
mov eax, dword [ebp - 0x434]
push dword [esi + eax]
call fcn.7592e5e9
test al, al
jne 0x75934157
mov eax, dword [ebp - 0x434]
push dword [esi + eax]
call fcn.7592e30a
test al, al
jne 0x7592e152
jmp 0x7592e139
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x7594d0ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp + 0x10]
push esi
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x460], eax
call fcn.7592e668
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x444], esi
call fcn.7592e4a5
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x440]
push eax
push 0x12c18
push 0x64
push esi
push 1
push esi
mov dword [ebp - 0x434], esi
call sub.NETAPI32.dll_NetQueryDisplayInformation
cmp eax, esi
mov dword [ebp - 0x44c], eax
jne 0x75934011
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x42c]
push eax
mov dword [ebp - 0x464], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x75934021
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x450], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x7593402d
or dword [ebp - 0x438], 0xffffffff
mov ebx, dword [ebp - 0x440]
dec ebx
cmp ebx, esi
push edi
mov byte [ebp - 0x42d], 0
jl 0x7592e16c
lea esi, [ebx + ebx*2]
shl esi, 3
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp - 0x434]
push dword [esi + eax]
call edi
test eax, eax
je 0x75934039
mov eax, dword [ebp - 0x434]
push dword [esi + eax]
call fcn.7592e279
test eax, eax
mov dword [ebp - 0x43c], eax
je 0x7592e15e
lea eax, [ebp - 0x42c]
push eax
mov eax, dword [ebp - 0x434]
push dword [esi + eax]
call edi
test eax, eax
je 0x7592e930
mov eax, dword [ebp - 0x434]
add eax, esi
test byte [eax + 8], 0x12
je 0x7592df26
push ebx
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x434]
call fcn.7592e46e
dec dword [ebp - 0x438]
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
dec ebx
sub esi, 0x18
test ebx, ebx
jge 0x7592e0d5
xor esi, esi
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x440]
push dword [ebp - 0x434]
call fcn.7592e7ae
test al, al
je 0x7593418f
mov ebx, dword [ebp - 0x448]
push dword [ebp - 0x434]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0x44c], esi
jne 0x7592e232
push dword [ebp - 0x444]
push ebx
call fcn.7592e9ab
mov dword [ebp - 0x43c], esi
mov esi, dword [sym.imp.msvcrt.dll_memmove]
mov byte [ebp - 0x42d], 0
mov edi, ebx
mov eax, dword [ebp - 0x43c]
cmp eax, dword [ebp - 0x444]
jge 0x7592e230
push dword [edi]
call fcn.7592e279
test eax, eax
mov dword [ebp - 0x448], eax
je 0x7592e21e
push 0x7594d5c8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne byte [ebp - 0x42d]
cmp byte [ebp - 0x42d], 0
jne 0x759341a6
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [ebp - 0x43c]
add edi, 0x10
cmp byte [ebp - 0x42d], 0
je 0x7592e1d1
xor esi, esi
pop edi
mov eax, dword [ebp - 0x460]
cmp eax, esi
je 0x7592e968
mov dword [eax], ebx
mov eax, dword [ebp - 0x45c]
cmp eax, esi
pop esi
pop ebx
je 0x7592e257
mov ecx, dword [ebp - 0x444]
mov dword [eax], ecx
lea ecx, [ebp - 0x458]
call fcn.7592e97a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x44c]
call fcn.75921930
leave
ret 0xc
push 0x7594d4c8
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x7592e152
jmp 0x75934073
test eax, eax
je 0x7592df44
jmp 0x7592e139
test al, al
jne 0x7592df5d
jmp 0x7592e139
cmp ebx, esi
jne 0x759341eb
jmp 0x7592e243
cmp eax, 0xea
je 0x7592e065
jmp 0x7592e233
mov word [ebp - 0x42c], si
jmp 0x7592e08b
mov word [ebp - 0x228], si
jmp 0x7592e0b1
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x434]
add eax, eax
push 0x101
mov word [ebp + eax - 0x228], 0x5c
push dword [esi + ecx]
lea eax, [ebp + eax - 0x226]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x228]
push eax
jmp 0x7592e0fe
mov eax, dword [ebp - 0x434]
push dword [esi + eax]
call fcn.7592e5e9
test al, al
je 0x7592e152
cmp dword [ebp - 0x438], 0
mov byte [ebp - 0x42d], 1
jl 0x7592e152
push dword [ebp - 0x438]
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x434]
call fcn.7592e46e
or dword [ebp - 0x438], 0xffffffff
jmp 0x7592e152
push 0x7594d5c8
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x7592e94e
cmp byte [ebp - 0x42d], 0
je 0x7592df5d
mov eax, dword [ebp - 0x434]
push dword [esi + eax]
lea ecx, [ebp - 0x458]
call fcn.7592e4fa
test al, al
jne 0x7592df5d
mov eax, dword [ebp - 0x434]
push 0
push dword [esi + eax]
call fcn.759457e5
jmp 0x7592e95b
mov eax, dword [ebp - 0x434]
push dword [esi + eax]
call fcn.7592e5e9
jmp 0x7592dfda
mov eax, dword [ebp - 0x434]
push 0
push dword [esi + eax]
call fcn.759457e5
test al, al
jne 0x7592e152
cmp byte [ebp - 0x42d], al
jne 0x7592e139
mov dword [ebp - 0x438], ebx
jmp 0x7592e152
cmp dword [ebp - 0x438], 0
mov byte [ebp - 0x42d], 1
jl 0x7592dfcc
push dword [ebp - 0x438]
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x434]
call fcn.7592e46e
or dword [ebp - 0x438], 0xffffffff
jmp 0x7592dfcc
mov dword [ebp - 0x44c], 0xe
xor ebx, ebx
mov dword [ebp - 0x444], esi
jmp 0x7592e199
push 0x10
lea eax, [ebp - 0x474]
push edi
push eax
call esi
mov eax, dword [ebp - 0x444]
sub eax, dword [ebp - 0x43c]
dec eax
shl eax, 4
push eax
lea eax, [edi + 0x10]
push eax
push edi
call esi
push 0x10
lea eax, [ebp - 0x474]
push eax
mov eax, dword [ebp - 0x444]
shl eax, 4
lea eax, [eax + ebx - 0x10]
push eax
call esi
add esp, 0x24
jmp 0x7592e212
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x7592e243