Function at 0x1007a329
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100a6b34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
mov esi, ecx
lea eax, [ebp - 0xc]
push 2
push eax
mov dword [esi], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1007a384
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1007a3d0
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1007a3d0
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1007a36d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test eax, eax
je 0x1007a3d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80070000
test eax, eax
jle 0x1007a3b6
movzx eax, ax
or eax, esi
test eax, eax
jns 0x1007a3cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1007a3d0
movzx ebx, bx
or ebx, esi
jmp 0x1007a3d0
mov ebx, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1002bcc0
leave
ret

Function at 0x1007afb0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea edx, [ebp - 8]
xor ebx, ebx
mov ecx, edi
mov esi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.10075603
test eax, eax
je 0x1007b0ed
cmp dword [ebp - 4], ebx
ja 0x1007afeb
cmp dword [ebp - 8], 0x1900000
jbe 0x1007b0ed
mov ecx, edi
push 2
pop esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x1007aff3
sub ecx, edx
mov edx, 0x100a6ea0
sar ecx, 1
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1007b009
sub edx, esi
lea esi, [ecx + 1]
sar edx, 1
xor ecx, ecx
add esi, edx
push 0x10005480
push 2
pop edx
mov eax, esi
mov dword [ebp - 4], esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002bf1a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x1007b04d
mov esi, 0x8007000e
jmp 0x1007b0ed
lea eax, [esi + esi]
push eax
push 0
push ebx
call fcn.1002e3fd
add esp, 0xc
mov edx, esi
mov ecx, ebx
push edi
call fcn.10050582
mov esi, eax
test esi, esi
js 0x1007b0e6
mov edx, dword [ebp - 4]
mov ecx, ebx
push 0x100a6ea0
call fcn.1005533b
mov esi, eax
test esi, esi
js 0x1007b0e6
push 1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1007b0c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1007b0a5
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1007b0ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1007b0e6
movzx esi, si
or esi, edi
jmp 0x1007b0e6
mov esi, 0x80004005
jmp 0x1007b0e6
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1007b08f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call sub.msvcrt.dll_free
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4