Function at 0x403580
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x40f1a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40f004]
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x10c], 0
mov word [ebp - 0x108], 0x500
cmp eax, 0xffffffff
jne 0x403840
lea eax, [ebp - 0x110]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40360a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_open_process_token:_error_code__lu_n
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00407600
add esp, 0xc
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409cf2
mov esp, ebp
pop ebp
ret
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push dword [ebp - 0x110]
call fcn.004034c0
add esp, 0x14
test al, al
jne 0x40363f
lea eax, [ebp - 0x104]
push eax
push 0x40c150
jmp 0x4035e7
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea eax, [ebp - 0x10c]
push eax
call edi
test eax, eax
jne 0x4036a1
push str.could_not_get_SID_for_local_system_account_n
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00407600
add esp, 8
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409cf2
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp - 0x114]
push dword [esi]
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4036fb
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov dword [0x40f004], 1
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409cf2
mov esp, ebp
pop ebp
ret
push ebx
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ebx, dword [sym.imp.MSVCR120.dll_free]
push esi
call ebx
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x114]
push eax
push 2
push dword [ebp - 0x110]
call fcn.004034c0
add esp, 0x18
test al, al
jne 0x40376a
lea eax, [ebp - 0x104]
push eax
push 0x40c150
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00407600
add esp, 0xc
or eax, 0xffffffff
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409cf2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x11c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 6
push 1
lea eax, [ebp - 0x10c]
push eax
call edi
test eax, eax
jne 0x4037cf
push str.could_not_get_SID_for_service_group_n
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call fcn.00407600
push dword [ebp - 0x114]
call ebx
add esp, 0xc
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409cf2
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x114]
xor esi, esi
mov dword [0x40f004], 0
cmp dword [ebx], esi
jbe 0x403816
lea edi, [ebx + 4]
jmp 0x4037f0
push dword [edi]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40380c
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x4037f0
jmp 0x403816
mov dword [0x40f004], 1
push ebx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x40f004]
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409cf2
mov esp, ebp
pop ebp
ret