Function at 0x59bb08
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edx, dword [0x65d704]
cmp dword [edx], 2
je 0x59bb25
mov byte [ebp - 1], 1
jmp 0x59bd16
mov byte [ebp - 1], 0
mov dl, 2
mov ecx, 0x20
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
lea ebx, [ebp - 8]
push ebx
mov ebx, dword [ebp - 0x28]
push ebx
mov ebx, dword [ebp - 0x24]
push ebx
mov ebx, dword [ebp - 0x20]
push ebx
mov ebx, dword [ebp - 0x1c]
push ebx
push edi
push esi
push eax
push ecx
push edx
push 0x65c388
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x59bd16
xor eax, eax
push ebp
push 0x59bd0f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x59bbaa
push 0x59bd24
push 0x59bd50
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040f4e8
mov ebx, eax
test ebx, ebx
je 0x59bbd1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x59bcf8
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x59bcf8
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x59bc22
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x3f0
je 0x59bc03
call fcn.00407448
jmp 0x59bd16
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x59bc22
call fcn.00407448
jmp 0x59bd16
xor eax, eax
push ebp
push 0x59bcf1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x59bc65
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x7a
je 0x59bc65
call fcn.00407448
call fcn.00407448
jmp 0x59bd16
mov eax, dword [ebp - 0x14]
call fcn.00404b80
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x59bc97
call fcn.00407448
call fcn.00407448
jmp 0x59bd16
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x59bcd2
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x59bcce
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x59bcce
mov byte [ebp - 1], 1
jmp 0x59bcd2
inc ebx
dec esi
jne 0x59bca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59bcf8
mov eax, dword [ebp - 0x18]
call fcn.00404b9c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59bd16
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret