Function at 0x687c90
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x687fb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040a7ac
mov eax, dword [ebp - 0xc]
add eax, 4
call fcn.0040a7ac
mov eax, dword [ebp - 0xc]
add eax, 8
call fcn.0040a7ac
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 0
mov eax, ebx
sub eax, 5
jb 0x687f82
xor edx, edx
push ebp
push 0x687f60
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x687f56
xor eax, eax
push ebp
push 0x687f4f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0xe
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x687f36
cmp dword [ebp - 0x14], 0
je 0x687f36
xor eax, eax
push ebp
push 0x687f2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_ImpersonateLoggedOnUser
test eax, eax
je 0x687d96
xor eax, eax
push ebp
push 0x687d8f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
call fcn.00687bb4
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.0040ab8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687d96
call sub.advapi32.dll_RevertToSelf
pop eax
jmp eax
mov ebx, 0x4c
mov eax, ebx
call fcn.00406f18
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x687f0f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
push ebx
mov eax, dword [ebp - 0x18]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x687ef7
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_ConvertSidToStringSidW
test eax, eax
je 0x687e75
xor eax, eax
push ebp
push 0x687e6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x2c]
call fcn.0040b294
lea ecx, [ebp - 8]
mov edx, 0x687fcc
mov eax, dword [ebp - 4]
call fcn.0051dda4
mov eax, dword [ebp - 8]
call fcn.0040cf00
test eax, eax
jle 0x687e42
mov eax, dword [ebp - 0xc]
add eax, 8
mov edx, dword [ebp - 4]
call fcn.0040ab8c
mov eax, dword [ebp - 8]
call fcn.0040cf0c
mov edx, dword [ebp - 8]
mov edx, dword [edx + eax*4]
mov eax, dword [ebp - 0xc]
add eax, 4
call fcn.0040ab8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687e75
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_LocalFree
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
mov edx, dword [0x412128]
call fcn.0040d3f4
pop eax
jmp eax
mov eax, dword [0x7edb5c]
mov dword [ebp - 0x22], eax
mov ax, word [0x7edb60]
mov word [ebp - 0x1e], ax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x22]
mov ecx, 0x12
mov dl, 1
call fcn.00415e64
test eax, eax
je 0x687ef7
xor eax, eax
push ebp
push 0x687ef0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 0xc]
mov byte [edx + 0xc], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687ef7
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687f16
mov eax, dword [ebp - 0x18]
call fcn.00406f34
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687f56
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x687f82
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687fb7
lea eax, [ebp - 0x30]
call fcn.0040a7ac
lea eax, [ebp - 8]
mov edx, dword [0x412128]
call fcn.0040d3f4
lea eax, [ebp - 4]
call fcn.0040a7ac
pop eax
jmp eax