Function at 0x59b958
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edx, dword [0x65b6fc]
cmp dword [edx], 2
je 0x59b975
mov byte [ebp - 1], 1
jmp 0x59bb66
mov byte [ebp - 1], 0
mov dl, 2
mov ecx, 0x20
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
lea ebx, [ebp - 8]
push ebx
mov ebx, dword [ebp - 0x28]
push ebx
mov ebx, dword [ebp - 0x24]
push ebx
mov ebx, dword [ebp - 0x20]
push ebx
mov ebx, dword [ebp - 0x1c]
push ebx
push edi
push esi
push eax
push ecx
push edx
push 0x65a388
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x59bb66
xor eax, eax
push ebp
push 0x59bb5f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x59b9fa
push 0x59bb74
push 0x59bba0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040f4e8
mov ebx, eax
test ebx, ebx
je 0x59ba21
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x59bb48
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x59bb48
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x59ba72
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x3f0
je 0x59ba53
call fcn.00407448
jmp 0x59bb66
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x59ba72
call fcn.00407448
jmp 0x59bb66
xor eax, eax
push ebp
push 0x59bb41
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x59bab5
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x7a
je 0x59bab5
call fcn.00407448
call fcn.00407448
jmp 0x59bb66
mov eax, dword [ebp - 0x14]
call fcn.00404b80
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x59bae7
call fcn.00407448
call fcn.00407448
jmp 0x59bb66
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x59bb22
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x59bb1e
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x59bb1e
mov byte [ebp - 1], 1
jmp 0x59bb22
inc ebx
dec esi
jne 0x59baf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59bb48
mov eax, dword [ebp - 0x18]
call fcn.00404b9c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59bb66
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret