Function at 0x4036c0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc1c
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0xc14]
mov word [ebp - 0xc08], 0x500
push eax
xor edi, edi
push 8
mov dword [ebp - 0xc10], edi
mov dword [ebp - 0xc0c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4037a4
movups xmm0, xmmword [str.Failure_on_OpenProcessToken___call.__Assuming_that_user_is_logged_on_n]
mov eax, dword [0x418b50]
lea edi, [ebp - 0x404]
mov dword [ebp - 0x3c4], eax
dec edi
mov ax, word [0x418b54]
movups xmmword [ebp - 0x404], xmm0
mov word [ebp - 0x3c0], ax
movups xmm0, xmmword [0x418b20]
movups xmmword [ebp - 0x3f4], xmm0
movups xmm0, xmmword [0x418b30]
movups xmmword [ebp - 0x3e4], xmm0
movups xmm0, xmmword [0x418b40]
movups xmmword [ebp - 0x3d4], xmm0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403761
mov ecx, 0x10
mov esi, str.with_Administrator_privileges.__Continuing_on_with_installation.
rep movsd dword es:[edi], dword [esi]
push 0x50030
push str.Retrieve_Token_Failure
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412814
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0xc10]
push eax
push dword [ebp - 0xc10]
push 0
push 2
push dword [ebp - 0xc14]
call esi
test eax, eax
jne 0x403859
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x403859
movups xmm0, xmmword [str.Failure_on_GetTokenInformation___call.__Assuming_that_user_is_logged_on_n]
mov al, byte [0x418c00]
lea edi, [ebp - 0x404]
mov byte [ebp - 0x3bc], al
dec edi
movups xmmword [ebp - 0x404], xmm0
movups xmm0, xmmword [0x418bc8]
movups xmmword [ebp - 0x3f4], xmm0
movups xmm0, xmmword [0x418bd8]
movups xmmword [ebp - 0x3e4], xmm0
movups xmm0, xmmword [0x418be8]
movups xmmword [ebp - 0x3d4], xmm0
movq xmm0, qword [0x418bf8]
movq qword [ebp - 0x3c4], xmm0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403834
mov ecx, 0x10
mov esi, str.with_Administration_privileges.__Continuing_on_with_installation.
rep movsd dword es:[edi], dword [esi]
push 0x50040
push str.GetTokenInformation_Failure_1
movsw word es:[edi], word [esi]
jmp 0x403780
push ebx
push dword [ebp - 0xc10]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
lea eax, [ebp - 0xc10]
push eax
push dword [ebp - 0xc10]
push ebx
push 2
push dword [ebp - 0xc14]
call esi
test eax, eax
jne 0x4038f4
movups xmm0, xmmword [str.Failure_on_GetTokenInformation___call.__Assuming_that_user_is_logged_on_n]
mov al, byte [0x418c00]
lea edi, [ebp - 0x404]
mov byte [ebp - 0x3bc], al
dec edi
movups xmmword [ebp - 0x404], xmm0
movups xmm0, xmmword [0x418bc8]
movups xmmword [ebp - 0x3f4], xmm0
movups xmm0, xmmword [0x418bd8]
movups xmmword [ebp - 0x3e4], xmm0
movups xmm0, xmmword [0x418be8]
movups xmmword [ebp - 0x3d4], xmm0
movq xmm0, qword [0x418bf8]
movq qword [ebp - 0x3c4], xmm0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4038e0
push 0x50040
push str.GetTokenInformation_Failure_2
jmp 0x403952
lea eax, [ebp - 0xc18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc0c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x403985
mov ecx, 0x13
lea edi, [ebp - 0x404]
mov esi, str.Failure_on_AllocateAndInitializeSid___call.__Assuming_that_user_is_logged_on_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x404]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403940
push 0x50040
push str.Allocation_Failure
mov ecx, 0x10
lea eax, [ebp - 0x404]
mov esi, str.with_Administration_privileges.__Continuing_on_with_installation.
rep movsd dword es:[edi], dword [esi]
push eax
push 0
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412814
mov esp, ebp
pop ebp
ret
xor esi, esi
cmp dword [ebx], esi
jbe 0x4039e7
lea edi, [ebx + 4]
nop
push dword [edi]
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4039dd
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc10], pe_nt_image_headers32
push eax
lea eax, [ebp - 0xc10]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0xc10]
push eax
lea eax, [ebp - 0xc04]
push eax
push dword [edi]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
jne 0x403a12
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x403990
xor edi, edi
mov eax, dword [ebp - 0xc18]
test eax, eax
je 0x4039f8
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00412814
mov esp, ebp
pop ebp
ret
movzx edi, byte [ebx + esi*8 + 8]
shr edi, 2
and edi, 1
jmp 0x4039e7