Function at 0x401b80
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3cc
mov eax, dword [0x410008]
xor eax, esp
mov dword [esp + 0x3c8], eax
push ebx
push esi
push edi
push str.__DumpIt___v1.3.2.20110401___One_click_memory_memory_dumper_n
call fcn.00401060
add esp, 4
push str.__Copyright__c__2007___2011__Matthieu_Suiche__http:__www.msuiche.net__n
call fcn.00401e01
add esp, 4
push str.__Copyright__c__2010___2011__MoonSols__http:__www.moonsols.com__n_n
call fcn.00401e01
add esp, 4
call fcn.004017e0
test al, al
jne 0x401bf6
push str._______Error:_Cannot_import_functions._n
call fcn.00401000
add esp, 4
call fcn.00402140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.00401db6
mov esp, ebp
pop ebp
ret
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], ebx
mov word [esp + 0x48], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x401c54
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x401c43
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 0xc], ebx
jne 0x401c7d
push str._______Error:_This_application_requires_Administrator_privileges._n
call fcn.00401000
add esp, 4
call fcn.00402140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.00401db6
mov esp, ebp
pop ebp
ret
call fcn.00401a70
test al, al
jne 0x401caf
push str._______You_dont_have_enough_space_on_disk_to_dump_the_physical_memory._n
call fcn.00401000
add esp, 4
call fcn.00402140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.00401db6
mov esp, ebp
pop ebp
ret
push 0x3b0
lea edx, [esp + 0x24]
push ebx
push edx
call fcn.004076b0
add esp, 0xc
lea edi, [esp + 0x94]
mov dword [esp + 0x28], 0x300021
call fcn.00401870
push str._____Destination_
call fcn.00401060
add esp, 4
mov eax, edi
push eax
push 0x40e5f8
call fcn.004010c0
add esp, 8
call fcn.00401120
test eax, eax
je 0x401d9f
call fcn.004019c0
mov esi, eax
cmp esi, 0xffffffff
je 0x401d9f
push str._____Processing...
call fcn.00401060
add esp, 4
push ebx
lea ecx, [esp + 0x18]
push ecx
push 0x3b0
lea edx, [esp + 0x2c]
push edx
push 0x3b0
mov eax, edx
push eax
push 0x22c000
push esi
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x401d65
push str.Failed._r_n_r_n
call fcn.00401e01
add esp, 4
push str._______Error:_DeviceIoControl____Cannot_send_IOCTL._r_n_r_n
call fcn.00401e01
add esp, 4
jmp 0x401d93
cmp dword [esp + 0x24], ebx
jl 0x401d81
cmp dword [esp + 0x20], 0x57333244
jne 0x401d81
push str.Success._n
call fcn.004010c0
jmp 0x401d8b
push str.Failed._n
call fcn.00401000
add esp, 4
call fcn.00402140
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00401720
mov ecx, dword [esp + 0x3d4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00401db6
mov esp, ebp
pop ebp
ret