Function at 0x411abc
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
mov eax, 0x4d1af8
push ebx
push esi
push edi
call fcn.00490d08
mov word [ebp - 0x34], 8
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x48], eax
xor esi, esi
mov word [ebp - 0x34], 8
mov dword [ebp - 0x4c], edx
xor eax, eax
mov edx, dword [0x4d1aa4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], edx
lea ecx, [ebp - 0x48]
mov dx, word [0x4d1aa8]
mov word [ebp - 0x54], dx
push ecx
push 0x20008
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x411c90
lea eax, [ebp - 0x50]
push eax
push 0
push esi
push 2
mov edx, dword [ebp - 0x48]
push edx
call sub.ADVAPI32.DLL_GetTokenInformation
mov word [ebp - 0x34], 0x14
mov esi, dword [ebp - 0x50]
xor eax, eax
inc dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 8], ecx
inc dword [ebp - 0x28]
test esi, esi
je 0x411b73
cmp esi, 0x80
jbe 0x411b68
push esi
call fcn.0048fa08
pop ecx
mov edi, eax
jmp 0x411b75
push esi
call fcn.004b0b30
pop ecx
mov edi, eax
jmp 0x411b75
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
add eax, esi
mov dword [ebp - 8], eax
inc dword [ebp - 0x28]
dec dword [ebp - 0x28]
mov byte [ebp - 0x59], 0
mov edi, dword [ebp - 0x18]
mov edx, esi
add edx, edi
mov dword [ebp - 0x60], edx
mov cl, byte [ebp - 0x59]
mov byte [ebp - 0x61], cl
mov eax, dword [ebp - 0x60]
sub eax, edi
push eax
xor edx, edx
mov dl, byte [ebp - 0x61]
push edx
push edi
call fcn.00490828
add edi, esi
add esp, 0xc
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x50]
inc dword [ebp - 0x28]
mov word [ebp - 0x34], 0x38
mov esi, dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x50]
push edx
push esi
push 2
mov ecx, dword [ebp - 0x48]
push ecx
call sub.ADVAPI32.DLL_GetTokenInformation
test eax, eax
setne al
and eax, 1
mov byte [ebp - 0x62], al
mov edx, dword [ebp - 0x48]
push edx
call sub.KERNEL32.DLL_CloseHandle
cmp byte [ebp - 0x62], 0
je 0x411c4f
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x58]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push eax
call sub.ADVAPI32.DLL_AllocateAndInitializeSid
test eax, eax
je 0x411c4f
xor edx, edx
lea edi, [esi + 4]
mov dword [ebp - 0x68], edx
jmp 0x411c3b
mov eax, dword [edi]
push eax
mov edx, dword [ebp - 0x4c]
push edx
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
setne bl
and ebx, 1
inc dword [ebp - 0x68]
add edi, 8
test bl, bl
jne 0x411c46
mov eax, dword [esi]
cmp eax, dword [ebp - 0x68]
ja 0x411c21
mov edx, dword [ebp - 0x4c]
push edx
call sub.ADVAPI32.DLL_FreeSid
dec dword [ebp - 0x28]
mov word [ebp - 0x34], 0x38
dec dword [ebp - 0x28]
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sub edi, eax
mov esi, eax
test esi, esi
je 0x411c84
cmp edi, 0x80
jbe 0x411c7a
push esi
call fcn.0048f9d4
pop ecx
jmp 0x411c84
push edi
push esi
call fcn.004b0ee0
add esp, 8
dec dword [ebp - 0x28]
dec dword [ebp - 0x28]
mov word [ebp - 0x34], 8
mov word [ebp - 0x34], 0
jmp 0x411ca5
mov eax, ebx
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret