Function at 0x425c20
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a19c
mov eax, dword fs:[0]
push eax
mov eax, 0x10dc
call fcn.0056fae0
mov eax, dword [0x5da084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x1034]
mov dword [ebp - 0x102c], 0
mov dword [ebp - 0x1034], 0
call fcn.00431e20
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test al, al
je 0x426211
lea ecx, [ebp - 0x1020]
mov dword [ebp - 0x1020], 0
xor bl, bl
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 0
mov word [ebp - 0x1014], 0x500
call fcn.00431e20
test al, al
je 0x425d46
lea eax, [ebp - 0x1024]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push 2
push dword [ebp - 0x1020]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x425d46
lea eax, [ebp - 0x101c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x1018]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x425d46
xor esi, esi
cmp dword [ebp - 0x1010], esi
jbe 0x425d40
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [eax]
push dword [ebp + esi*8 - 0x100c]
push dword [ebp - 0x101c]
call edi
test eax, eax
jne 0x425d3e
inc esi
cmp esi, dword [ebp - 0x1010]
jb 0x425d20
jmp 0x425d40
mov bl, 1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x101c]
test eax, eax
je 0x425d57
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x1020]
test eax, eax
je 0x425d64
push eax
call esi
test bl, bl
je 0x426211
lea eax, [ebp - 0x102c]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
setne bl
test eax, eax
jne 0x425e16
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x425e16
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x425e16
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00430ce0
mov dword [ebp - 0x28], str.explorer.checker
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinExplorerChecker.cpp
mov dword [ebp - 0x1c], 0x45
mov dword [ebp - 0x18], str.CanOpenProcessToken
mov byte [ebp - 0x14], 1
mov dword [ebp - 4], 0
call edi
push eax
push ecx
mov edx, str.Unable_to_open_process_token._Error:
lea ecx, [ebp - 0xc0]
call fcn.00416960
add esp, 4
mov ecx, eax
call fcn.00423f60
lea ecx, [ebp - 0xc0]
mov dword [ebp - 4], 0xffffffff
call fcn.00430bd0
test bl, bl
je 0x426211
mov ebx, dword [ebp - 0x102c]
lea eax, [ebp - 0x1020]
push eax
push 0
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x101c], 0
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x425e52
call edi
cmp eax, 0x7a
jne 0x425e8c
push dword [ebp - 0x1020]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x101c], eax
test eax, eax
je 0x425e92
lea ecx, [ebp - 0x1020]
push ecx
push dword [ebp - 0x1020]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x425e8c
mov bl, 1
jmp 0x425f19
mov eax, dword [ebp - 0x101c]
mov ecx, dword [0x5dfbe0]
xor bl, bl
test ecx, ecx
je 0x425f1f
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x425f19
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00430ce0
mov dword [ebp - 0x28], str.explorer.checker
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinExplorerChecker.cpp
mov dword [ebp - 0x1c], 0x54
mov dword [ebp - 0x18], str.CanGetTokenInformation
mov byte [ebp - 0x14], 1
mov dword [ebp - 4], 1
call edi
push eax
push ecx
mov edx, str.Unable_to_get_token_information_for_TokenUser_class._Error:
lea ecx, [ebp - 0xc0]
call fcn.00416960
add esp, 4
mov ecx, eax
call fcn.00423f60
lea ecx, [ebp - 0xc0]
mov dword [ebp - 4], 0xffffffff
call fcn.00430bd0
mov eax, dword [ebp - 0x101c]
test eax, eax
je 0x425f2a
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x426211
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x1020], 0
push eax
push 4
lea eax, [ebp - 0x101c]
push eax
push 0x12
push dword [ebp - 0x1034]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
setne bl
test eax, eax
jne 0x425fe8
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x425fe8
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x425fe8
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00430ce0
mov dword [ebp - 0x28], str.explorer.checker
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinExplorerChecker.cpp
mov dword [ebp - 0x1c], 0x62
mov dword [ebp - 0x18], str.IsTokenFull
mov byte [ebp - 0x14], 1
mov dword [ebp - 4], 2
call edi
push eax
push ecx
mov edx, str.Unable_to_get_token_information_for_TokenUser_class._Error:
lea ecx, [ebp - 0xc0]
call fcn.00416960
add esp, 4
mov ecx, eax
call fcn.00423f60
lea ecx, [ebp - 0xc0]
mov dword [ebp - 4], 0xffffffff
call fcn.00430bd0
test bl, bl
je 0x426211
cmp dword [ebp - 0x101c], 2
je 0x426211
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x1020], 0
push eax
push 1
push 2
push 0
push 0xb
push dword [ebp - 0x102c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
setne bl
test eax, eax
jne 0x4260b0
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x4260b0
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x4260b0
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00430ce0
mov dword [ebp - 0x28], str.explorer.checker
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinExplorerChecker.cpp
mov dword [ebp - 0x1c], 0x6e
mov dword [ebp - 0x18], str.CanDuplicateToken
mov byte [ebp - 0x14], 1
mov dword [ebp - 4], 3
call edi
push eax
push ecx
mov edx, str.Unable_to_duplicate_token._Error:
lea ecx, [ebp - 0xc0]
call fcn.00416960
add esp, 4
mov ecx, eax
call fcn.00423f60
lea ecx, [ebp - 0xc0]
mov dword [ebp - 4], 0xffffffff
call fcn.00430bd0
mov eax, dword [ebp - 0x1020]
test eax, eax
je 0x4260bd
push eax
call esi
test bl, bl
je 0x426211
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1028], 0
push eax
push 0xf01ff
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x426159
mov edi, dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
lea eax, [ebp - 0x1030]
push eax
push esi
push esi
push 0xa0000017
push dword [ebp - 0x1028]
call edi
test eax, eax
jne 0x426119
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x426153
push dword [ebp - 0x1030]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x426153
lea eax, [ebp - 0x1030]
push eax
push dword [ebp - 0x1030]
push esi
push 0xa0000017
push dword [ebp - 0x1028]
call edi
test eax, eax
je 0x426153
mov bl, 1
jmp 0x4261eb
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x5dfbe0]
xor bl, bl
test ecx, ecx
je 0x4261eb
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x4261eb
push ecx
lea ecx, [ebp - 0x10e8]
call fcn.00430ce0
mov dword [ebp - 0x1050], str.explorer.checker
mov dword [ebp - 0x104c], 1
mov dword [ebp - 0x1048], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinExplorerChecker.cpp
mov dword [ebp - 0x1044], 0x81
mov dword [ebp - 0x1040], str.CanGetKernelObjectSecurity
mov byte [ebp - 0x103c], 1
mov dword [ebp - 4], 4
call edi
push eax
push ecx
mov edx, str.Unable_to_get_Kernel_Object_security._Error:
lea ecx, [ebp - 0x10e8]
call fcn.00416960
add esp, 4
mov ecx, eax
call fcn.00423f60
lea ecx, [ebp - 0x10e8]
call fcn.00430bd0
mov eax, dword [ebp - 0x1028]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4261fe
push eax
call edi
test esi, esi
je 0x426209
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x426217
mov bl, 1
jmp 0x426219
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov eax, dword [ebp - 0x102c]
test eax, eax
je 0x426226
push eax
call edi
mov eax, dword [ebp - 0x1034]
test eax, eax
je 0x426233
push eax
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056eb71
mov esp, ebp
pop ebp
ret