Function at 0x4426d0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4426f0
mov ecx, dword [ebp + 8]
push 0x49b51c
call fcn.0042f5ab
jmp 0x442a2a
push ebx
xor ecx, ecx
lea eax, [ebp + 0xc]
push eax
push ecx
push ecx
push 2
push edi
mov dword [ebp + 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x442794
call ebx
cmp eax, 0x7a
je 0x442794
xor ebx, ebx
push ebx
push eax
lea eax, [ebp - 0x44]
push str.GetTokenInformation__
push eax
call fcn.0042fd05
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x44]
call fcn.0042f60f
lea ecx, [ebp - 0x30]
call fcn.00438d6f
cmp eax, 0x7d1
lea eax, [ebp - 0x30]
push ebx
jl 0x44277e
push ebx
push 0x588
push 0x48e328
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00413c09
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x44]
call fcn.0042f60f
jmp 0x442787
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x30]
call fcn.0042f60f
jmp 0x442a29
push esi
push dword [ebp + 0xc]
call fcn.0044721c
mov esi, eax
pop ecx
test esi, esi
jne 0x442829
xor ebx, ebx
lea eax, [ebp - 0x44]
push ebx
push str.Failed_to_allocate_buffer_for_the_token_information_structure
push 0x498584
push 3
push eax
call fcn.0042f557
add esp, 0x10
lea ecx, [ebp - 0x30]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x44]
call fcn.0042f60f
lea ecx, [ebp - 0x30]
call fcn.00438d6f
cmp eax, 0x7d1
lea eax, [ebp - 0x30]
push ebx
jl 0x44281e
push ebx
push 0x590
push 0x48e328
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00413c09
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x44]
call fcn.0042f60f
lea ecx, [ebp - 0x30]
call fcn.0042f60f
push ebx
jmp 0x442a22
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f5cb
jmp 0x442810
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0044185d
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0042f5cb
lea ecx, [ebp - 0x44]
call fcn.0042f60f
lea ecx, [ebp - 0x30]
call fcn.00438d6f
cmp eax, 0x7d1
jl 0x442895
push 0
push 0
push 0x595
lea eax, [ebp - 0x30]
push 0x48e328
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00413c09
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x44]
call fcn.0042f60f
lea ecx, [ebp - 0x30]
jmp 0x442a1c
lea ecx, [ebp - 0x30]
call fcn.0042f60f
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push esi
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x44290c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
call ebx
xor ebx, ebx
push ebx
push eax
lea eax, [ebp - 0x44]
push str.GetTokenInformation__
push eax
call fcn.0042fd05
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x44]
call fcn.0042f60f
lea ecx, [ebp - 0x30]
call fcn.00438d6f
cmp eax, 0x7d1
lea eax, [ebp - 0x30]
push ebx
jl 0x442901
push ebx
push 0x599
jmp 0x44286a
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f5cb
jmp 0x44288d
push 0x49b5bc
lea ecx, [ebp - 0x1c]
call fcn.0042f5ab
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x442942
lea eax, [esi + 4]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x44297c
mov eax, dword [ebp - 8]
inc ebx
add eax, 8
mov dword [ebp - 8], eax
cmp ebx, dword [esi]
jb 0x442925
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x10], 0x3e9
jne 0x442a0c
push 1
call fcn.0043e074
pop ecx
test al, al
je 0x442a0c
mov eax, dword [sym.imp.ADVAPI32.dll_IsTokenRestricted]
cmp eax, ebx
jne 0x4429c0
mov dword [ebp - 0x10], 0x7e2
jmp 0x4429ce
test byte [esi + ebx*8 + 8], 4
lea ecx, [ebp - 0x1c]
je 0x44299b
xor eax, eax
mov dword [ebp - 0x10], 0x3e9
push eax
push eax
mov byte [ebp - 0xc], al
call fcn.0043a07a
jmp 0x442942
test byte [esi + ebx*8 + 8], 0x10
je 0x4429b7
mov dword [ebp - 0x10], 0x2904
xor ebx, ebx
push ebx
push ebx
mov byte [ebp - 0xc], bl
call fcn.0043a07a
jmp 0x442944
mov dword [ebp - 0x10], 0x2905
jmp 0x4429a9
push edi
call eax
test eax, eax
je 0x4429dd
mov dword [ebp - 0x10], 0x2906
push ebx
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0xc], bl
call fcn.0043a07a
jmp 0x442a0c
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
test eax, eax
je 0x442a0c
call edi
push eax
lea eax, [ebp - 0x44]
push str.::IsTokenRestricted__
push eax
call fcn.0042fd05
add esp, 0xc
mov ecx, eax
call fcn.00438d6f
lea ecx, [ebp - 0x44]
call fcn.0042f60f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x1c]
call fcn.0042f60f
push esi
call fcn.0045fb1d
pop ecx
pop esi
pop ebx
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret