Function at 0x10357a1
Capabilities:
Get token membership
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1040190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x68], eax
mov byte [eax], 0
push edi
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x6c], esi
call dword [sym.imp.ntdll.dll_RtlGetNtProductType]
test al, al
jne 0x10357ea
mov edi, 0xc0000001
jmp 0x1035988
lea eax, [ebp - 0x54]
push eax
push 1
push 8
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtOpenThreadToken]
mov edi, eax
cmp edi, 0xc000007c
jne 0x1035814
lea eax, [ebp - 0x54]
push eax
push 8
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov edi, eax
cmp edi, esi
jl 0x1035988
lea eax, [ebp - 0x80]
push eax
push 0x4c
lea eax, [ebp - 0x50]
push eax
push 1
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov edi, eax
cmp edi, esi
jl 0x1035988
mov eax, dword [ebp - 0x50]
lea esi, [eax + 1]
cmp byte [esi], 5
mov dword [ebp - 0x7c], eax
jne 0x1035988
push ebx
push 4
pop ebx
push 6
pop ecx
xor eax, eax
mov byte [esi], bl
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
push 1
lea eax, [ebp - 0x98]
push eax
push 0
call sub.ADVAPI32.dll_LsaOpenPolicy
mov edi, eax
test edi, edi
jl 0x1035987
lea eax, [ebp - 0x5c]
push eax
push 5
push dword [ebp - 0x58]
call sub.ADVAPI32.dll_LsaQueryInformationPolicy
mov edi, eax
test edi, edi
jl 0x1035987
lea eax, [ebp - 0x60]
push eax
push 0x20019
push 0
push 0x1012858
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x10358b9
jle 0x10358ed
jmp 0x10358e3
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0x10359d4
push dword [ebp - 0x60]
mov dword [ebp - 0x78], ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, 2
je 0x10358f9
test eax, eax
je 0x10358f4
jle 0x10358ed
and eax, 0xffff
or eax, 0xc0070000
mov edi, eax
jmp 0x1035987
cmp dword [ebp - 0x74], ebx
je 0x10358fd
and dword [ebp - 0x64], 0
mov ebx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x5c]
push ebx
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlEqualSid]
test al, al
je 0x1035917
cmp dword [ebp - 0x70], 2
jne 0x1035987
test byte [ebp - 0x64], 1
je 0x1035925
mov eax, dword [ebp - 0x68]
mov byte [eax], 1
jmp 0x1035987
movzx eax, byte [esi]
mov dword [ebx + eax*4 + 8], 0x20d
inc byte [esi]
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 0x54]
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_CheckTokenMembership]
test eax, eax
je 0x1035952
cmp dword [ebp - 0x6c], 0
mov ecx, dword [ebp - 0x68]
setne al
mov byte [ecx], al
jmp 0x1035987
mov eax, dword [ebp - 0x68]
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
je 0x1035982
dec eax
je 0x103597b
sub eax, 0x3e0
je 0x1035974
mov edi, 0xc0000001
jmp 0x1035987
mov edi, 0xc0000005
jmp 0x1035987
mov edi, 0xc0000008
jmp 0x1035987
mov edi, 0xc0000022
pop ebx
xor esi, esi
cmp dword [ebp - 0x60], esi
je 0x1035998
push dword [ebp - 0x60]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x5c], esi
je 0x10359a5
push dword [ebp - 0x5c]
call sub.ADVAPI32.dll_LsaFreeMemory
cmp dword [ebp - 0x58], esi
je 0x10359b2
push dword [ebp - 0x58]
call sub.ADVAPI32.dll_LsaClose
cmp dword [ebp - 0x54], esi
je 0x10359c0
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.010024b0
leave
ret 4