Function at 0x40faa0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc90
mov eax, dword [0x448d60]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
cmp dword [0x452394], 0
je 0x40fad6
cmp dword [0x452398], 0
jne 0x40fb59
push 0x451f60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x452394], 0
jne 0x40fb4e
call fcn.0041b490
test eax, eax
je 0x40fb09
call fcn.0040f550
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40fb07
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 1
jmp 0x40fb4e
push 1
lea edx, [ebp - 8]
push edx
push 0
push 0x10
push 0x23
push 0x437d44
push 7
push 0x437d68
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
push 0
call sub.WTSAPI32.dll_WTSSendMessageA
test eax, eax
jne 0x40fb47
push str.WTSSendMessage
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
mov dword [ebp - 4], 0
push 0x451f60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x452394], 0
je 0x40fe3a
cmp dword [ebp - 4], 0
je 0x40fe3a
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 0x10], 0x3ff
mov al, byte [0x43638f]
mov byte [ebp - 0x528], al
push 0x103
push 0
lea ecx, [ebp - 0x527]
push ecx
call fcn.0042adc0
add esp, 0xc
mov byte [ebp - 0x20], 0
xor edx, edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov word [ebp - 0x17], dx
mov byte [ebp - 0x15], dl
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x528]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x628]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040f030
add esp, 0x1c
test eax, eax
jne 0x40fbef
mov dword [ebp - 4], 0
jmp 0x40fe3a
push 0x451e48
lea ecx, [ebp - 0x628]
push ecx
call fcn.00435275
add esp, 8
test eax, eax
jne 0x40fc23
push 0x451f78
lea edx, [ebp - 0x420]
push edx
call fcn.00435275
add esp, 8
test eax, eax
je 0x40fe3a
mov dword [ebp - 0x62c], 0
mov byte [ebp - 0x634], 0
mov byte [ebp - 0x633], 0
mov byte [ebp - 0x632], 0
mov byte [ebp - 0x631], 0
mov byte [ebp - 0x630], 0
mov byte [ebp - 0x62f], 5
lea eax, [ebp - 0x638]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea ecx, [ebp - 0x634]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40fdf8
mov edx, dword [ebp - 0x638]
push edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40fdf8
push 0x104
lea ecx, [ebp - 0x840]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x528]
push edx
push 2
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x890], 0
xor eax, eax
mov dword [ebp - 0x88c], eax
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x890], 0x10
lea ecx, [ebp - 0x840]
mov dword [ebp - 0x88c], ecx
mov dword [ebp - 0x880], 0
push 0x2c
push 0
lea edx, [ebp - 0x87c]
push edx
call fcn.0042adc0
add esp, 0xc
mov dword [ebp - 0x880], 0x30
mov dword [ebp - 0x874], 2
mov dword [ebp - 0x870], 1
mov dword [ebp - 0x86c], 1
lea eax, [ebp - 0x890]
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x864], 1
mov dword [ebp - 0x858], 0x140
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 0xfc451c16
mov ecx, 0xac75
mov word [ebp - 0x84c], cx
mov edx, 0x11d1
mov word [ebp - 0x84a], dx
mov byte [ebp - 0x848], 0xb4
mov byte [ebp - 0x847], 0xb8
mov byte [ebp - 0x846], 0
mov byte [ebp - 0x845], 0xc0
mov byte [ebp - 0x844], 0x4f
mov byte [ebp - 0x843], 0xb6
mov byte [ebp - 0x842], 0x6e
mov byte [ebp - 0x841], 0xa0
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x850]
push ecx
push 0xffffffffffffffff
call sub.WINTRUST.dll_WinVerifyTrust
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0
je 0x40fdf8
push 0
push 0x4363e3
lea edx, [ebp - 0x528]
push edx
push 0x7c
push 1
call fcn.0040e190
add esp, 0x14
mov eax, dword [ebp - 0x638]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x62c], 0
je 0x40fe33
push 0
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x420]
push edx
push 0x6b
push 2
call fcn.0040e190
add esp, 0x14
mov dword [ebp - 4], 0
jmp 0x40fe3a
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
jne 0x40fe52
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x40ff5c
mov eax, dword [0x4523a4]
push eax
mov ecx, dword [0x452398]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0041b953
test eax, eax
jne 0x40fe88
mov edx, dword [0x4523a0]
push edx
mov eax, dword [0x452394]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0041ba23
test eax, eax
je 0x40ff57
mov cl, byte [0x43641a]
mov byte [ebp - 0xc90], cl
push 0x3ff
push 0
lea edx, [ebp - 0xc8f]
push edx
call fcn.0042adc0
add esp, 0xc
push 0x400
lea eax, [ebp - 0xc90]
push eax
call fcn.0041b696
add esp, 8
lea ecx, [ebp - 0xc90]
push ecx
push str.ContinentTLS:_incorrect_certificate:__s_n
call fcn.0040e130
add esp, 8
push 0
push 0
lea edx, [ebp - 0xc90]
push edx
push 0x71
push 1
call fcn.0040e190
add esp, 0x14
cmp dword [0x452394], 0
je 0x40fefe
mov eax, dword [0x452394]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x452398], 0
je 0x40ff3d
mov ecx, dword [0x4523a4]
push ecx
push 0
mov edx, dword [0x452398]
push edx
call fcn.0042adc0
add esp, 0xc
mov eax, dword [0x452398]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 0
push 0x70
push 4
call fcn.0040e190
add esp, 0x14
mov dword [0x452398], 0
mov ecx, dword [0x452398]
mov dword [0x452394], ecx
xor eax, eax
jmp 0x40ff5c
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042a637
mov esp, ebp
pop ebp
ret