Function at 0x217e30a
Capabilities:
Compare security identifiers
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [0x218c314]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call fcn.0217101d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
cmp edx, esi
mov dword [ebp - 8], edx
jne 0x217e341
cmp dword [ebp - 0xc], esi
je 0x217e416
push dword [ebp - 8]
push dword [ebp - 0xc]
mov ecx, dword [0x218c334]
call fcn.02176baf
mov esi, eax
test esi, esi
jne 0x217e35f
mov dword [ebp - 4], 0x778
cmp dword [ebp - 4], 0
jne 0x217e53f
cmp dword [ebp + 8], 0
jne 0x217e379
mov eax, 1
jmp 0x217e401
cmp dword [esi + 4], 0
jne 0x217e386
mov eax, 1
jmp 0x217e401
push dword [ebp + 8]
call sub.RPCRT4.dll_RpcImpersonateClient
test eax, eax
jne 0x217e3ff
lea eax, [ebp - 0x10]
push eax
push 1
push 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x217e3ff
mov dword [ebp - 8], 0x18
mov eax, dword [ebp - 8]
add eax, 3
and al, 0xfc
call sub.ntdll.dll__alloca_probe
mov edi, esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, eax
test ebx, ebx
jne 0x217e3e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x217e3b2
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x217e3ff
push dword [edi]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x217e401
xor eax, eax
cmp eax, 1
je 0x217e539
mov dword [ebp - 4], 5
jmp 0x217e539
cmp dword [ebp + 8], 0
jne 0x217e44a
push dword [ebp + 0xc]
cmp dword [ebp + 8], 1
sbb eax, eax
mov ecx, dword [0x218c334]
neg eax
push eax
push 0
push dword [ebp + 0x10]
call fcn.021770ec
cmp eax, 1
mov esi, eax
sbb eax, eax
and eax, 0xe
mov dword [ebp - 4], eax
jmp 0x217e539
push dword [ebp + 8]
call sub.RPCRT4.dll_RpcImpersonateClient
mov dword [ebp - 4], eax
test eax, eax
jne 0x217e484
lea eax, [ebp - 0x10]
push eax
push 1
push 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x217e47d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x217e484
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x217e493
mov dword [ebp - 4], 0
jmp 0x217e506
mov dword [ebp - 8], 0x18
mov eax, dword [ebp - 8]
add eax, 3
and al, 0xfc
call sub.ntdll.dll__alloca_probe
mov edi, esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, eax
test ebx, ebx
jne 0x217e4d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x217e49a
test ebx, ebx
je 0x217e4f6
mov eax, dword [ebp - 8]
sub eax, 0xc
push eax
push 0xc
call fcn.02173d38
add esp, 8
mov esi, eax
test esi, esi
je 0x217e4f6
push dword [edi]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x217e4fd
mov dword [ebp - 4], 0xe
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x217e536
push dword [ebp + 0xc]
cmp dword [ebp + 8], 1
sbb eax, eax
mov ecx, dword [0x218c334]
neg eax
push eax
push esi
push dword [ebp + 0x10]
call fcn.021770ec
mov esi, eax
test esi, esi
jne 0x217e539
mov dword [ebp - 4], 0xe
jmp 0x217e539
mov esi, dword [ebp - 4]
cmp dword [ebp - 4], 0
je 0x217e54f
mov ecx, dword [0x218c314]
call fcn.02171000
jmp 0x217e620
mov ax, word [ebp + 0x10]
sub ax, word [esi + 0x14]
je 0x217e56e
cmp ax, 3
ja 0x217e56e
mov ax, word [ebp + 0x10]
mov word [esi + 0x14], ax
mov eax, 1
jmp 0x217e570
xor eax, eax
test eax, eax
je 0x217e604
mov di, 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub dx, dx
mov dword [esi], eax
add dword [esi], 0x57e40
mov cx, word [esi + 0x16]
inc cx
mov ax, cx
mov word [esi + 0x16], cx
div di
test dx, dx
jne 0x217e5ab
push 0
mov ecx, esi
call fcn.02177222
mov eax, dword [ebp + 0x24]
mov edi, dword [ebp + 0x14]
mov word [eax], 0
test edi, edi
je 0x217e5e8
mov eax, dword [ebp + 0x1c]
lea ebx, [eax + edi*8 - 8]
push ebx
mov ecx, esi
call fcn.02176b53
mov dword [ebp - 4], eax
cmp eax, 0x777
jne 0x217e5dc
mov dword [ebp - 0x14], 1
jmp 0x217e5e2
cmp dword [ebp - 4], 0
jne 0x217e5e8
sub ebx, 8
dec edi
jne 0x217e5c1
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x217e604
mov eax, dword [ebp + 0x20]
lea ebx, [eax + edi*8 - 8]
push ebx
mov ecx, esi
sub ebx, 8
call fcn.02176c23
dec edi
jne 0x217e5f6
mov ecx, dword [0x218c314]
call fcn.02171000
cmp dword [ebp - 4], 0
jne 0x217e620
cmp dword [ebp - 0x14], 0
mov eax, 0x777
jne 0x217e623
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20