Function at 0x10013410
Capabilities:
Check if file exists
Compare security identifiers
Create directory
Get common file path
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ba9f
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x10088020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008958c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10089e5c]
mov dword [ebp - 0x260], ecx
cmp eax, dword [ecx + 4]
jle 0x100134b5
push 0x10089e5c
call fcn.10045034
add esp, 4
cmp dword [0x10089e5c], 0xffffffff
jne 0x100134b5
mov dword [ebp - 4], 1
push 0x100647f0
call fcn.10044eec
mov byte [ebp - 4], 0
push 0x10089e5c
call fcn.10044fea
add esp, 8
cmp dword [0x10088ae4], 0
jne 0x10013bc1
mov dword [ebp - 0x220], 0x10070ab0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x220]
mov eax, dword [ebp - 0x220]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x21c]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
jne 0x10013517
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10013b5d
xor esi, esi
mov dword [ebp - 0x258], esi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x254]
push eax
push esi
push esi
push 1
push dword [ebp - 0x21c]
mov dword [ebp - 0x254], esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1001358e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10013b41
push dword [ebp - 0x254]
lea ecx, [ebp - 0x258]
call fcn.10014c90
mov esi, dword [ebp - 0x258]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x254]
push esi
push 1
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x10013b41
cmp dword [ebp - 0x254], 0
je 0x10013b41
lea eax, [ebp - 0x264]
mov dword [ebp - 0x238], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea eax, [ebp - 0x238]
mov word [ebp - 0x234], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10013b48
push dword [ebp - 0x264]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x264]
cmp eax, 1
sete byte [ebp - 0x259]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov byte [ebp - 4], 2
push esi
call edi
mov dword [ebp - 0x258], 0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x10070ab0
test eax, eax
je 0x1001363a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x21c], 0
cmp byte [ebp - 0x259], 0
je 0x10013b86
mov ecx, dword [ebp - 0x260]
mov eax, dword [0x10089e60]
cmp eax, dword [ecx + 4]
jle 0x100136a4
push 0x10089e60
call fcn.10045034
add esp, 4
cmp dword [0x10089e60], 0xffffffff
jne 0x100136a4
mov dword [ebp - 4], 4
push str.GetTempPath2W
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10089e64], eax
mov byte [ebp - 4], 0
push 0x10089e60
call fcn.10044fea
add esp, 4
mov eax, dword [0x10089e64]
test eax, eax
je 0x100136c3
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call eax
mov dword [ebp - 0x254], eax
jmp 0x100136f4
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.SystemTemp_
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1004b51e
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10013a3f
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 4], 7
push ecx
push 0x10000000
push str.S_1_5_18
lea ecx, [ebp - 0x294]
call fcn.1000fd70
push ecx
push 0x10000000
push str.S_1_5_32_544
lea ecx, [ebp - 0x294]
call fcn.1000fd70
mov eax, dword [ebp - 0x274]
test eax, eax
je 0x100137a6
push eax
call edi
mov dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x100137bd
push eax
call edi
mov dword [ebp - 0x278], 0
mov ecx, dword [ebp - 0x284]
test ecx, ecx
jle 0x1001390f
mov edx, dword [ebp - 0x27c]
xor eax, eax
mov dword [ebp - 0x258], eax
test edx, edx
je 0x10013838
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x264]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x1001381b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x270], eax
jmp 0x1001390f
mov eax, dword [ebp - 0x258]
xor ecx, ecx
cmp dword [ebp - 0x264], ecx
cmove eax, ecx
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x258], eax
test ecx, ecx
jle 0x10013c03
lea edx, [ebp - 0x274]
push edx
push eax
push dword [ebp - 0x288]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
je 0x10013864
mov dword [ebp - 0x270], eax
jmp 0x1001390f
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x278], eax
test eax, eax
jne 0x1001388a
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x270], eax
jmp 0x1001390f
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x100138bd
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x1001390f
push eax
call edi
mov dword [ebp - 0x278], 0
jmp 0x1001390f
push 0
push dword [ebp - 0x274]
push 1
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x10013897
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x1001390f
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x224], 0xc
push eax
mov dword [ebp - 0x21c], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], 9
xor esi, esi
mov edx, dword [ebp - 0x290]
mov eax, edx
mov dword [ebp - 0x260], eax
test eax, eax
mov eax, dword [ebp - 0x294]
jle 0x1001395f
test esi, esi
js 0x10013c03
cmp esi, edx
jge 0x10013c03
mov ecx, dword [eax + esi*8]
test ecx, ecx
je 0x10013956
push ecx
call edi
mov edx, dword [ebp - 0x290]
mov eax, dword [ebp - 0x294]
inc esi
cmp esi, dword [ebp - 0x260]
jl 0x10013930
test eax, eax
je 0x10013976
push eax
call fcn.10048780
add esp, 4
mov dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0
test eax, eax
je 0x100139a7
push eax
call fcn.10048780
add esp, 4
mov dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x280], 0
test eax, eax
je 0x100139c8
push eax
call edi
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x100139d5
push eax
call edi
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x288]
test eax, eax
je 0x100139f6
push eax
call fcn.10048780
add esp, 4
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x280], 0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x294]
test eax, eax
je 0x10013a2b
push eax
call fcn.10048780
add esp, 4
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x254]
test eax, eax
je 0x10013bc1
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
movups xmmword [ebp - 0x230], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10013a74
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.10002c20
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x230]
push 1
sub esp, 0x18
mov dword [ebp - 0x260], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x264], esp
push eax
call fcn.10005780
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xa
mov ecx, esi
call fcn.10018390
add esp, 0x18
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x250]
call fcn.10018980
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x250]
push eax
call fcn.10017e70
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x250]
call fcn.100055a0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x10013ba4
mov ecx, dword [ebp - 0x230]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10013b9d
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x10013c0d
jmp 0x10013b9d
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov byte [ebp - 4], 2
test esi, esi
je 0x10013b53
push esi
call edi
mov dword [ebp - 0x258], 0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x10070ab0
test eax, eax
je 0x10013b86
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10013a45
test ecx, ecx
je 0x10013ba4
push ecx
call edi
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov ecx, dword [ebp - 0x298]
push 0x10088ad4
call fcn.10005780
mov dword [ebp - 4], 0
mov dword [ebp - 0x29c], 1
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10044a98
mov esp, ebp
pop ebp
ret
push ntohs
call fcn.10005390
call fcn.1004872f
int3