Function at 0x472b74
Capabilities:
Get token membership

Disassembly:
push 0x200
mov eax, 0x51e698
call fcn.004d8af2
mov dword [ebp - 0x190], ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x1b4]
mov eax, dword [ebp + 0x1c]
xor edi, edi
mov esi, dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x194], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1f4], ebx
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1a4], edi
call fcn.004ad4c1
and dword [ebp - 4], 0
cmp dword [esi + 0x30], 0
je 0x472c63
push ecx
mov ecx, esp
push 0x54478c
call fcn.00406fea
lea edx, [esi + 0x2c]
lea ecx, [ebp - 0x1f0]
call fcn.004b3176
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [eax]
sub ecx, 0x10
mov dword [ebp - 0x1fc], str.global
call fcn.004070e7
mov esi, eax
mov edi, 0x801
lea eax, [esi + 0x10]
mov dword [ebp - 0x1f8], eax
lea eax, [ebp - 0x1fc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x204]
call fcn.004b2797
lea eax, [ebp - 0x204]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1b4]
call fcn.004ad3cd
lea ecx, [ebp - 0x204]
call fcn.00407c33
mov ecx, esi
call fcn.00407189
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1f0]
add ecx, 0xfffffff0
call fcn.00407189
push ecx
mov ecx, esp
push 0x54478c
call fcn.00406fea
mov edx, dword [ebp - 0x194]
lea ecx, [ebp - 0x1a8]
lea edx, [edx + 0x88]
call fcn.004b3176
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [eax]
sub ecx, 0x10
mov dword [ebp - 0x20c], str.script
call fcn.004070e7
mov esi, eax
or edi, 0x400
mov dword [ebp - 0x1a4], edi
lea eax, [esi + 0x10]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x20c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x1a0]
call fcn.004b2797
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x1b4]
call fcn.004ad3cd
lea ecx, [ebp - 0x1a0]
call fcn.00407c33
mov ecx, esi
call fcn.00407189
mov ecx, dword [ebp - 0x1a8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x1d4]
call fcn.00406d1e
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x194]
and dword [ebp - 0x1c8], 0
and dword [ebp - 0x1c4], 0
mov dword [eax + 0xc], ecx
push ecx
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 7
push ecx
lea ecx, [ebp - 0x1c8]
push ecx
lea ecx, [ebp - 0x1ec]
push ecx
mov ecx, eax
call fcn.004aa0e9
mov byte [ebp - 4], 8
cmp dword [ebp - 0x1ec], 0
jge 0x472da1
cmp dword [ebp - 0x1e8], 0
push 0x1f
pop eax
cmovne eax, dword [ebp - 0x1e8]
push eax
push dword [ebp - 0x1ec]
push ecx
mov esi, esp
mov dword [ebp - 0x1ac], esi
mov edi, dword [ebp - 0x1e4]
lea ecx, [edi - 0x10]
call fcn.004070e7
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.00406620
lea ecx, [edi - 0x10]
call fcn.00407189
jmp 0x473542
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1e4]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x1c8]
mov edx, 0xffffd8ee
push 0x10
pop esi
push str.all_users
mov edi, dword [eax + 0x198]
movzx eax, byte [ebp + 0x10]
mov ecx, dword [edi + 8]
mov dword [ecx], eax
mov dword [ecx + 8], 1
mov ecx, edi
add dword [edi + 8], esi
call fcn.00410549
mov ecx, dword [edi + 8]
mov edx, 0xffffd8ee
movzx eax, byte [ebp + 0x18]
mov dword [esp], str.repair
mov dword [ecx], eax
mov dword [ecx + 8], 1
mov ecx, edi
add dword [edi + 8], esi
call fcn.00410549
mov ecx, dword [edi + 8]
mov edx, 0xffffd8ee
movzx eax, byte [ebp + 0x14]
mov dword [esp], str.disable_autoupdate
mov dword [ecx], eax
mov dword [ecx + 8], 1
mov ecx, edi
add dword [edi + 8], esi
call fcn.00410549
call fcn.004013b8
mov ecx, dword [edi + 8]
mov edx, 0xffffd8ee
movzx eax, al
mov dword [esp], 0x54a218
mov dword [ecx], eax
mov dword [ecx + 8], 1
mov ecx, edi
add dword [edi + 8], esi
call fcn.00410549
and dword [ebp - 0x194], 0
lea eax, [ebp - 0x70]
push 0x12
push 1
push 0x53d240
push eax
call fcn.004d6394
or dword [ebp - 0x1a4], 0x200
lea eax, [ebp - 0x194]
add esp, 0x14
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.004d6486
test esi, esi
jne 0x472ed8
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x39
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, ebx
call fcn.00406620
jmp 0x473542
mov ecx, dword [edi + 8]
xor eax, eax
cmp dword [ebp - 0x194], eax
mov edx, 0xffffd8ee
push 0x54a204
setne al
mov dword [ecx], eax
mov dword [ecx + 8], 1
mov ecx, edi
add dword [edi + 8], 0x10
call fcn.00410549
pop ecx
lea ecx, [ebp - 0x1d0]
call fcn.0040687a
lea ecx, [ebp - 0x1cc]
call fcn.0040687a
lea edx, [ebp - 0x1d0]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1c0]
call fcn.0043b840
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x1c0], 0
jge 0x472f90
cmp dword [ebp - 0x1bc], 0
push 0x3f
pop eax
cmovne eax, dword [ebp - 0x1bc]
push eax
push dword [ebp - 0x1c0]
push ecx
mov esi, esp
mov dword [ebp - 0x1ac], esi
mov edi, dword [ebp - 0x1b8]
lea ecx, [edi - 0x10]
call fcn.004070e7
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.00406620
lea ecx, [edi - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x1d0]
call fcn.00407c33
jmp 0x473542
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1b8]
add ecx, 0xfffffff0
call fcn.00407189
push ecx
mov esi, esp
mov dword [ebp - 0x190], esi
mov ecx, dword [ebp - 0x1d0]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x190]
mov dword [esi], eax
call fcn.00429cff
pop ecx
mov byte [ebp - 4], 0xb
mov ecx, edi
mov edx, dword [eax]
call fcn.0041029a
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x190]
lea ecx, [ecx - 0x10]
call fcn.00407189
push str.os_language
mov edx, 0xffffd8ee
mov ecx, edi
call fcn.00410549
mov esi, esp
mov dword [ebp - 0x190], esi
mov ecx, dword [ebp - 0x1cc]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x190]
mov dword [esi], eax
call fcn.00429cff
pop ecx
mov byte [ebp - 4], 0xc
mov ecx, edi
mov edx, dword [eax]
call fcn.0041029a
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x190]
lea ecx, [ecx - 0x10]
call fcn.00407189
push str.os_country
mov edx, 0xffffd8ee
mov ecx, edi
call fcn.00410549
lea ecx, [ebp - 0x18c]
call fcn.0042b0ee
fild dword [ebp - 0x188]
mov eax, dword [edi + 8]
mov edx, 0xffffd8ee
push 0x10
pop esi
mov ecx, edi
mov dword [esp], str.os_major
fstp qword [ebp - 0x1a0]
fld qword [ebp - 0x1a0]
fstp qword [eax]
mov dword [eax + 8], 3
add dword [edi + 8], esi
call fcn.00410549
fild dword [ebp - 0x184]
mov eax, dword [edi + 8]
mov edx, 0xffffd8ee
mov ecx, edi
mov dword [esp], str.os_minor
fstp qword [ebp - 0x1a0]
fld qword [ebp - 0x1a0]
fstp qword [eax]
mov dword [eax + 8], 3
add dword [edi + 8], esi
call fcn.00410549
movzx eax, word [ebp - 0x78]
mov dword [ebp - 0x190], eax
mov eax, dword [edi + 8]
fild dword [ebp - 0x190]
fstp qword [ebp - 0x1a0]
fld qword [ebp - 0x1a0]
mov edx, 0xffffd8ee
fstp qword [eax]
mov dword [eax + 8], 3
mov ecx, edi
add dword [edi + 8], esi
mov dword [esp], str.os_sp
call fcn.00410549
movzx eax, word [ebp - 0x76]
mov edx, 0xffffd8ee
mov dword [ebp - 0x190], eax
mov ecx, edi
fild dword [ebp - 0x190]
mov eax, dword [edi + 8]
mov dword [esp], str.os_sp_minor
fstp qword [ebp - 0x1a0]
fld qword [ebp - 0x1a0]
fstp qword [eax]
mov dword [eax + 8], 3
add dword [edi + 8], esi
call fcn.00410549
fild dword [ebp - 0x180]
mov eax, dword [edi + 8]
mov ecx, edi
mov dword [esp], 0x54a28c
fstp qword [ebp - 0x1a0]
fld qword [ebp - 0x1a0]
fstp qword [eax]
mov dword [eax + 8], 3
add dword [edi + 8], esi
mov esi, 0xffffd8ee
mov edx, esi
call fcn.00410549
push esp
lea ecx, [ebp - 0x18c]
call fcn.0042add3
lea ecx, [ebp - 0x1a8]
call fcn.00429cff
pop ecx
mov byte [ebp - 4], 0xd
mov ecx, edi
mov edx, dword [eax]
call fcn.0041029a
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1a8]
lea ecx, [ecx - 0x10]
call fcn.00407189
push str.os_product_type
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x4478e2
mov ecx, edi
call fcn.004102f4
push str.exists
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x446a90
mov ecx, edi
call fcn.004102f4
push str.readfile
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x448336
mov ecx, edi
call fcn.004102f4
push str.resolve_link
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x4482bc
mov ecx, edi
call fcn.004102f4
push str.get_binary_type
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x448432
mov ecx, edi
call fcn.004102f4
push str.string_sha1
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x4484f3
mov ecx, edi
call fcn.004102f4
push str.file_sha1
mov edx, esi
mov ecx, edi
call fcn.00410549
mov esi, 0x44699d
mov ecx, edi
push 0
mov edx, esi
call fcn.004102f4
push 0x54a0bc
mov edx, 0xffffd8ee
mov ecx, edi
call fcn.00410549
push 0
mov edx, esi
mov ecx, edi
call fcn.004102f4
add esp, 0x40
mov esi, 0xffffd8ee
mov edx, esi
mov ecx, edi
push str.readreg
call fcn.00410549
push 0
mov edx, 0x44698f
mov ecx, edi
call fcn.004102f4
push str.regglob
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x446981
mov ecx, edi
call fcn.004102f4
push str.fileglob
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x447b64
mov ecx, edi
call fcn.004102f4
push str.fileattr
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x4a97a0
mov ecx, edi
call fcn.004102f4
push str.compareversions
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x4a991b
mov ecx, edi
call fcn.004102f4
push str.versioncheck
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x4a9a50
mov ecx, edi
call fcn.004102f4
push str.is_accessible
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x4a9af6
mov ecx, edi
call fcn.004102f4
push 0x54a164
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x448a25
mov ecx, edi
call fcn.004102f4
add esp, 0x40
mov edx, esi
mov ecx, edi
push str.match_uninstall_keys
call fcn.00410549
push 0
mov edx, 0x448a4e
mov ecx, edi
call fcn.004102f4
push str.match_uninstall_keys32
mov edx, esi
mov ecx, edi
call fcn.00410549
push 0
mov edx, 0x448a39
mov ecx, edi
call fcn.004102f4
push str.match_uninstall_keys64
mov edx, esi
mov ecx, edi
call fcn.00410549
add esp, 0x14
lea ecx, [ebp - 0x1d0]
call fcn.00407c33
xor eax, eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
lea eax, [ebp - 0x1e0]
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x1c8]
mov ecx, ebx
push eax
call fcn.004a9c42
pop ecx
mov byte [ebp - 4], 0xf
or dword [ebp - 0x1a4], 8
cmp dword [ebx], 0
jl 0x473537
lea ecx, [ebp - 0x194]
mov byte [ebp - 0x195], 0
call fcn.0040687a
mov dword [ebp - 4], 0x10
mov esi, dword [ebp - 0x1e0]
mov ecx, dword [ebp - 0x1dc]
cmp esi, ecx
je 0x4734c6
mov bl, byte [ebp - 0x195]
mov eax, dword [esi]
sub eax, 0
je 0x473472
sub eax, 1
je 0x47346d
sub eax, 3
jne 0x473474
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x194]
call fcn.00405d6e
mov ecx, dword [ebp - 0x1dc]
jmp 0x473474
mov bl, byte [esi + 0x10]
jmp 0x473474
xor bl, bl
add esi, 0x18
cmp esi, ecx
jne 0x473445
test bl, bl
mov ebx, dword [ebp - 0x1f4]
je 0x4734c6
and dword [ebp - 0x1c0], 0
lea ecx, [ebp - 0x1b8]
and dword [ebp - 0x1bc], 0
call fcn.0040687a
lea eax, [ebp - 0x1c0]
mov byte [ebp - 4], 0x11
push eax
mov ecx, ebx
call fcn.004032ed
mov ecx, dword [ebp - 0x1b8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov esi, dword [ebp - 0x194]
jmp 0x47352f
and dword [ebp - 0x1bc], 0
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0x1c0], 1
call fcn.0040687a
lea eax, [ebp - 0x1c0]
mov byte [ebp - 4], 0x12
push eax
mov ecx, ebx
call fcn.004032ed
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x1b8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov esi, dword [ebp - 0x194]
cmp dword [esi - 0xc], 0
je 0x47352f
lea eax, [ebp - 0x194]
lea edi, [ebx + 8]
push eax
mov ecx, edi
call fcn.00405d6e
mov ecx, dword [ebp - 0x1d4]
push edi
call fcn.00405d6e
lea ecx, [esi - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x1e0]
call fcn.004a9749
mov ecx, dword [ebp - 0x1c4]
test ecx, ecx
je 0x473551
call fcn.00405adf
mov edx, dword [ebp - 0x1b4]
call fcn.004b63d0
push 0x10
push dword [ebp - 0x1b4]
call fcn.004d840d
pop ecx
mov eax, ebx
pop ecx
call fcn.004d8aa1
ret 0x20