Function at 0x912660
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x98eb88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x81c], ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x9126a7
push 0x958d10
push 1
call fcn.00902480
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [0x991ebc]
test esi, esi
je 0x9126e0
lea ecx, [ebp - 0x808]
mov dword [ebp - 0x808], 0
push ecx
push eax
mov ecx, esi
call dword [section..rdata]
call esi
test eax, eax
je 0x9126f2
push eax
push 0x958d3c
call fcn.00901db0
add esp, 8
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x808]
push dword [eax + 0x2c]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x912748
mov eax, dword [ebp - 0x808]
push dword [eax + 0x2c]
push 0x958d68
call fcn.00901db0
mov eax, dword [ebp - 0x808]
add esp, 8
test eax, eax
je 0x9126e0
mov esi, dword [0x991ec4]
mov ecx, esi
push eax
call dword [section..rdata]
call esi
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x810], esi
mov dword [ebp - 0x814], ebx
cmp dword [ebp + 0x10], ebx
jbe 0x91295d
add edi, 4
mov eax, dword [edi]
test eax, eax
je 0x91294a
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x91294a
mov eax, dword [ebp - 0x808]
push dword [edi]
push dword [eax + 0x2c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x91294a
cmp dword [0x98f460], 0
je 0x912934
lea eax, [ebp + 0x7f4]
mov dword [ebp - 0x80c], 0
cmp eax, 0x2000
jb 0x9128eb
lea eax, [edi + 0xffc]
cmp eax, 0x2000
jb 0x9128eb
cmp dword [0x991ed4], 0
jne 0x9127ec
cmp dword [0x991ed8], 0
jne 0x9127ec
mov esi, 0xffffffdb
jmp 0x9128f0
mov esi, 0x410
call fcn.00917cb0
cmp edx, 0x600000
jb 0x912809
ja 0x912804
test eax, eax
jb 0x912809
mov esi, 0x1000
push dword [edi - 4]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x91284c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [0x98f460], ebx
je 0x91283c
push esi
push dword [edi - 4]
push 0x958b0c
call fcn.00901db0
add esp, 0xc
push esi
call fcn.0091bf10
add esp, 4
mov esi, eax
jmp 0x9128df
mov esi, dword [0x991ed8]
mov dword [ebp - 0x818], 0x400
test esi, esi
je 0x912869
lea eax, [ebp - 0x818]
push eax
jmp 0x912874
mov esi, dword [0x991ed4]
push 0x400
lea eax, [ebp - 0x804]
mov ecx, esi
push eax
push 0
push ebx
call dword [section..rdata]
call esi
test eax, eax
je 0x9128ab
push 0x958b40
push 0
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x80c]
push eax
call fcn.009304e0
add esp, 0x10
jmp 0x9128d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x98f460], 3
mov esi, eax
jbe 0x9128cd
push esi
push dword [edi - 4]
push 0x958b98
call fcn.00901db0
add esp, 0xc
push esi
call fcn.0091bf10
add esp, 4
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
js 0x9128f0
mov eax, dword [ebp - 0x80c]
jmp 0x9128f5
mov esi, 0xfffffffa
mov eax, 0x958d84
push eax
movzx eax, byte [edi + 0xc]
push eax
push dword [edi - 4]
mov eax, dword [ebp - 0x808]
push dword [eax + 0x28]
push 0x958d98
push 4
call fcn.00902480
add esp, 0x18
test esi, esi
js 0x912928
push dword [ebp - 0x80c]
call fcn.00915800
add esp, 4
mov esi, dword [ebp - 0x810]
mov ebx, dword [ebp - 0x814]
cmp byte [edi + 0xc], 0
je 0x91294a
inc esi
cmp dword [0x98f460], 0
mov dword [ebp - 0x810], esi
je 0x91295d
inc ebx
add edi, 0x14
mov dword [ebp - 0x814], ebx
cmp ebx, dword [ebp + 0x10]
jb 0x912765
mov eax, dword [ebp - 0x81c]
mov edx, dword [ebp - 0x808]
pop ebx
test eax, eax
je 0x912973
mov ecx, dword [edx + 0x28]
mov dword [eax], ecx
mov esi, dword [0x991ec4]
mov ecx, esi
push edx
call dword [section..rdata]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x810]
xor ecx, ebp
pop esi
pop edi
call fcn.00901200
mov esp, ebp
pop ebp
ret