Function at 0x10011500
Capabilities:
Compare security identifiers

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3dc0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3a8
mov eax, dword [0x1022101c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x3b8], eax
call fcn.10090b60
cmp dword [ebp - 0x15c], 6
jb 0x10011864
xorps xmm0, xmm0
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x280]
mov byte [ebp - 0x3a1], 0
mov esi, eax
call fcn.10090b60
cmp dword [ebp - 0x27c], 6
jb 0x10011855
push esi
push 0
push 0x410
mov dword [ebp - 0x3ac], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
mov dword [ebp - 0x3b4], edi
test edi, edi
je 0x100116ca
lea eax, [ebp - 0x3ac]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100116a3
mov eax, dword [ebp - 0x3ac]
lea ecx, [ebp - 0x3a0]
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 0x3a1], 0
call fcn.10090b60
cmp dword [ebp - 0x39c], 6
jae 0x10011629
mov byte [ebp - 0x3a1], 0
jmp 0x100116a3
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3a8], 0
push eax
push 0
push 0
push 0x19
push dword [ebp - 0x3b0]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x3a8]
call fcn.101b0f90
mov edi, eax
add esp, 4
test edi, edi
je 0x1001169d
lea eax, [ebp - 0x3a8]
push eax
push dword [ebp - 0x3a8]
push edi
push 0x19
push dword [ebp - 0x3b0]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x10011694
mov eax, dword [edi]
test eax, eax
je 0x10011694
cmp dword [eax + 8], 0x3000
setae byte [ebp - 0x3a1]
push edi
call fcn.101b0f8b
add esp, 4
mov edi, dword [ebp - 0x3b4]
push edi
call esi
mov eax, dword [ebp - 0x3ac]
test eax, eax
je 0x100116bd
push eax
call esi
mov dword [ebp - 0x3ac], 0
cmp byte [ebp - 0x3a1], 0
jne 0x10011855
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.10018e00
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x3b4]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3a8], 0
push eax
lea ecx, [ebp - 0x2c]
call fcn.10019230
test al, al
jne 0x1001172f
push dword [ebp - 0x3a8]
jmp 0x10011835
push 0x400
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x18], 0x500
mov byte [ebp - 0x3a1], 0
call fcn.101b0f90
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x3ac], edi
test edi, edi
je 0x10011834
lea ecx, [ebp - 0x3b4]
push ecx
push 0x400
push edi
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x10011801
lea eax, [ebp - 0x3b0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10011801
xor esi, esi
cmp dword [edi], esi
jbe 0x100117ef
add edi, 4
nop word [eax + eax]
push dword [edi]
push dword [ebp - 0x3b0]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x100117e2
mov eax, dword [ebp - 0x3ac]
inc esi
add edi, 8
cmp esi, dword [eax]
jb 0x100117c0
jmp 0x100117e9
mov byte [ebp - 0x3a1], 1
mov edi, dword [ebp - 0x3ac]
push dword [ebp - 0x3b0]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.101b0f8b
add esp, 4
cmp byte [ebp - 0x3a1], 0
je 0x1001182e
push dword [ebp - 0x3a8]
call esi
push dword [ebp - 0x3b8]
call fcn.10011890
mov byte [ebp - 0x3a1], al
jmp 0x1001183e
mov eax, dword [ebp - 0x3a8]
push eax
call esi
mov byte [ebp - 0x3a1], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.10018e00
mov al, byte [ebp - 0x3a1]
jmp 0x10011866
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.10018e00
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101b075c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4