Function at 0x1000c66a
Capabilities:
Get token membership

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, 0x104e36fb
xor edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, 0x30bee138
jg 0x1000c6f7
cmp eax, 0xcff1643e
jle 0x1000c72f
cmp eax, 0xe80cb938
jg 0x1000c7f1
cmp eax, 0xcff1643f
je 0x1000c8d9
cmp eax, 0xd709629f
je 0x1000c8eb
cmp eax, 0xe1ab24d2
jne 0x1000c67e
mov eax, dword [0x10098df4]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
sete dl
cmp dword [0x10098df8], 0xa
setl cl
xor dl, cl
mov eax, edx
xor al, 1
and cl, al
xor al, cl
mov ebx, 0xad1e9444
mov eax, 0x7e6802c1
jne 0x1000c9e6
mov ebx, 0x7e6802c1
jmp 0x1000c9e6
cmp eax, 0x672f8404
jle 0x1000c765
cmp eax, 0x6dc94140
jg 0x1000c86e
cmp eax, 0x672f8405
je 0x1000c923
cmp eax, 0x697c289d
je 0x1000c985
cmp eax, 0x6b561831
je 0x1000cc17
jmp 0x1000c67e
cmp eax, 0xad1e9443
jle 0x1000c899
cmp eax, 0xad1e9444
je 0x1000c9f0
cmp eax, 0xb910da81
je 0x1000c9fa
cmp eax, 0xc9a4b6e9
jne 0x1000c67e
mov eax, 0x93145b4f
jmp 0x1000c67e
cmp eax, 0x587bdf3d
jle 0x1000c8b9
cmp eax, 0x587bdf3e
je 0x1000ca52
cmp eax, 0x59fc1787
je 0x1000ca64
cmp eax, 0x5d673988
jne 0x1000c67e
mov ecx, dword [0x10098df4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xba953881
and eax, 0x456ac77e
or eax, edx
xor eax, 0x456ac77f
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098df8], 0xa
setge ch
mov cl, ch
or cl, al
xor ch, al
mov edx, ecx
xor dl, ch
mov eax, 0x697c289d
mov ebp, 0x9899b703
mov ebx, 0x697c289d
test ch, ch
jne 0x1000cbf8
mov ebx, 0x9899b703
jmp 0x1000cbf8
cmp eax, 0xe80cb939
je 0x1000cab7
cmp eax, 0xfd98bee4
je 0x1000cb3c
cmp eax, 0x104e36fb
jne 0x1000c67e
mov ecx, dword [0x10098df4]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete ch
cmp dword [0x10098df8], 0xa
setge dh
setl dl
mov cl, dh
xor dh, al
and al, dl
and cl, ch
or cl, al
or dl, ch
xor dl, 1
or dl, dh
mov ch, dl
xor ch, cl
mov ebx, 0xd709629f
mov eax, 0xe80cb939
mov ebp, 0xd709629f
test dl, 1
jne 0x1000c85e
mov ebp, 0xe80cb939
test cl, cl
cmovne ebx, ebp
test ch, 1
cmovne eax, ebx
jmp 0x1000c67e
cmp eax, 0x6dc94141
je 0x1000cbab
cmp eax, 0x7e6802c1
je 0x1000cbb5
cmp eax, 0x7f400191
jne 0x1000c67e
mov eax, 0x59fc1787
jmp 0x1000c67e
cmp eax, 0x93145b4f
je 0x1000cc07
cmp eax, 0x9899b703
jne 0x1000cc48
mov eax, 0x697c289d
jmp 0x1000c67e
cmp eax, 0x30bee139
je 0x1000cc21
cmp eax, 0x4e3a3588
jne 0x1000c67e
mov eax, 0x5d673988
jmp 0x1000c67e
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov eax, 0x30bee139
jmp 0x1000c67e
mov dword [esp + 0x10], edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
mov word [esp + 0xc], 0x500
lea eax, [esp + 4]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push 0x220
push 0x20
push 2
lea eax, [esp + 0x30]
push eax
call esi
mov eax, 0xe80cb939
jmp 0x1000c67e
mov ecx, dword [0x10098df4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete ch
cmp dword [0x10098df8], 0xa
setl dl
xor ch, dl
mov cl, ch
xor cl, 1
and dl, cl
mov eax, 0x4e3a3588
test ch, ch
jne 0x1000c968
mov eax, 0x6dc94141
xor cl, dl
test dl, dl
jne 0x1000c973
mov eax, 0x6dc94141
test cl, cl
jne 0x1000c67e
mov eax, 0x4e3a3588
jmp 0x1000c67e
mov eax, dword [0x10098df4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xf5393d13
mov edx, eax
and edx, 0xac6c2ec
or edx, ecx
xor edx, 0xac6c2ed
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne ah
cmp dword [0x10098df8], 0xa
setge ch
setl dl
mov cl, dl
xor cl, ah
and cl, dl
and ch, al
and dl, ah
or dl, ch
mov eax, ecx
xor al, dl
mov eax, 0x9ec45299
mov ebx, 0x9ec45299
jne 0x1000c9e6
mov ebx, 0x9899b703
test dl, dl
cmove eax, ebx
jmp 0x1000cba1
mov eax, 0xe1ab24d2
jmp 0x1000c67e
mov ecx, dword [0x10098df4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
setne al
cmp dword [0x10098df8], 0xa
setge dl
mov ecx, edx
or cl, al
xor dl, al
mov eax, ecx
xor al, dl
mov ebx, 0xad1e9444
mov eax, 0xe1ab24d2
jne 0x1000ca43
mov ebx, 0xe1ab24d2
test dl, dl
cmove eax, ebx
test cl, cl
cmovne eax, ebx
jmp 0x1000c67e
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, 0xb910da81
jmp 0x1000c67e
mov ecx, dword [0x10098df4]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete dl
cmp dword [0x10098df8], 0xa
setl ch
setge cl
and dl, cl
or cl, al
and ch, al
or ch, dl
mov dl, ch
xor dl, cl
mov eax, 0xfd98bee4
mov ebp, 0x7f400191
mov ebx, 0xfd98bee4
test ch, ch
jne 0x1000caa6
mov ebx, 0x7f400191
test cl, 1
cmovne ebx, ebp
test dl, 1
cmovne eax, ebx
jmp 0x1000c67e
mov dword [esp + 0x10], edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
mov word [esp + 0xc], 0x500
lea eax, [esp + 4]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push 0x220
push 0x20
push 2
lea eax, [esp + 0x30]
push eax
call esi
test eax, eax
setne byte [esp + 3]
mov ecx, dword [0x10098df4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098df8], 0xa
setl dl
mov ecx, edx
xor cl, al
or dl, al
xor dl, 1
or dl, cl
mov eax, edx
xor al, cl
mov ebx, 0xd709629f
mov eax, 0xc9a4b6e9
jne 0x1000cb9c
mov ebx, 0xc9a4b6e9
jmp 0x1000cb9c
mov eax, dword [0x10098df4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x85975f16
mov edx, eax
and edx, 0x7a68a0e9
or edx, ecx
xor edx, 0x7a68a0e8
and eax, 0xfffffffe
or eax, edx
xor eax, 0xb85ce14f
xor eax, 0x47a31eb0
setne al
sete ah
cmp dword [0x10098df8], 0xa
setge dl
setl cl
xor cl, ah
or dl, al
mov eax, edx
xor al, cl
mov ebx, 0x6dc94141
mov eax, 0x672f8405
jne 0x1000cb9c
mov ebx, 0x672f8405
test dl, dl
cmovne eax, ebx
test cl, cl
cmove eax, ebx
jmp 0x1000c67e
mov eax, 0x672f8405
jmp 0x1000c67e
mov ecx, dword [0x10098df4]
lea eax, [ecx - 1]
imul eax, ecx
and eax, 1
sete dl
cmp dword [0x10098df8], 0xa
setl cl
setge ch
and dl, ch
and cl, al
or cl, dl
or ch, al
mov dl, ch
xor dl, cl
mov ebx, 0x7f400191
mov eax, 0x59fc1787
mov ebp, 0x7f400191
test ch, ch
jne 0x1000cbf8
mov ebp, 0x59fc1787
test cl, cl
cmovne ebx, ebp
test dl, dl
cmovne eax, ebx
jmp 0x1000c67e
cmp byte [esp + 3], 0
mov eax, 0xcff1643f
jne 0x1000c67e
mov eax, 0x587bdf3e
jmp 0x1000c67e
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, 0x6b561831
jmp 0x1000c67e
cmp eax, 0x9ec45299
jne 0x1000c67e
mov eax, dword [esp + 0x18]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret