Function at 0x403d10
Capabilities:
Compare security identifiers

Disassembly:
push edi
push esi
mov esi, 1
push ebx
sub esp, 0x50
mov dword [esp + 4], 0x32
mov dword [esp], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0x32
call sym._LocalAlloc_8
sub esp, 8
mov ebx, eax
mov byte [esp + 0x4a], 0
mov byte [esp + 0x4b], 0
mov byte [esp + 0x4c], 0
mov byte [esp + 0x4d], 0
mov byte [esp + 0x4e], 0
mov byte [esp + 0x4f], 5
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call sym._GetCurrentProcess_0
lea edx, [esp + 0x38]
mov dword [esp + 4], 8
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._OpenProcessToken_12
sub esp, 0xc
test eax, eax
je 0x403ea0
test ebx, ebx
je 0x403f54
mov eax, dword [esp + 0x3c]
lea edi, [esp + 0x3c]
mov dword [esp + 8], ebx
mov dword [esp + 4], 2
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._GetTokenInformation_20
sub esp, 0x14
test eax, eax
je 0x403ef1
lea eax, [esp + 0x40]
lea edi, [esp + 0x4a]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov esi, 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], edi
call sym._AllocateAndInitializeSid_44
sub esp, 0x2c
test eax, eax
je 0x403ea0
lea eax, [esp + 0x44]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], edi
call sym._AllocateAndInitializeSid_44
sub esp, 0x2c
test eax, eax
jne 0x403f60
mov eax, dword [esp + 0x40]
test eax, eax
je 0x403eb3
mov dword [esp], eax
call sym._FreeSid_4
sub esp, 4
mov eax, dword [esp + 0x44]
test eax, eax
je 0x403ec6
mov dword [esp], eax
call sym._FreeSid_4
sub esp, 4
test ebx, ebx
je 0x403ed5
mov dword [esp], ebx
call sym._LocalFree_4
sub esp, 4
mov eax, dword [esp + 0x38]
test eax, eax
je 0x403ee8
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
add esp, 0x50
mov eax, esi
pop ebx
pop esi
pop edi
ret
call sym._GetLastError_0
cmp eax, 0x7a
jne 0x403ea0
mov dword [esp], ebx
call sym._LocalFree_4
push ebx
mov eax, dword [esp + 0x3c]
mov dword [esp], 0
mov dword [esp + 4], eax
call sym._LocalAlloc_8
test eax, eax
push edx
mov ebx, eax
push edx
je 0x403f54
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 2
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._GetTokenInformation_20
sub esp, 0x14
test eax, eax
je 0x403ea0
jmp 0x403dd5
mov esi, 1
xor ebx, ebx
jmp 0x403ea0
xor esi, esi
jmp 0x403f97
mov edi, dword [ebx + esi*8 + 4]
mov eax, dword [esp + 0x40]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._EqualSid_8
test eax, eax
push ecx
push ecx
jne 0x403fa2
mov eax, dword [esp + 0x44]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._EqualSid_8
test eax, eax
push edx
push edx
jne 0x403f9b
add esi, 1
cmp esi, dword [ebx]
jb 0x403f64
xor esi, esi
jmp 0x403ea0
mov esi, 1
jmp 0x403ea0