Function at 0x1001716b
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 4
call fcn.100b8c3f
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
push ebx
push 0xe
call fcn.100b8c3f
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x100d952c
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 6
rep stosb byte es:[edi], al
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x1c], ebx
mov eax, 0x100d951e
push eax
push eax
mov ebx, eax
call fcn.100020b9
pop eax
sub ebx, eax
add ecx, ebx
push ecx
call fcn.100b8c3f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x1c]
mov ebx, dword [ebx]
push ebx
call fcn.100b8c45
add esp, 4
pop eax
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
mov eax, dword [ebp - 4]
push eax
push 6
call fcn.100b8c3f
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 6
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10017299
push 0x74
push 0x405a73b
push 6
call fcn.100b8c4b
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x20]
push ebx
mov edi, dword [ebp - 0x24]
push ebx
push edi
push 1
mov eax, 2
call fcn.100b96f0
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x100172d0
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x100172ce
imul eax, dword [edi]
jmp 0x100172c3
mov ecx, eax
cmp ecx, 6
jle 0x100172da
mov ecx, 6
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 6
call fcn.100b8c45
add esp, 4
pop eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x10017365
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10017331
push 0x133
push 0x405a73b
push 6
call fcn.100b8c4b
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10017360
push 0x15e
push 0x405a73b
push 6
call fcn.100b8c4b
add esp, 0xc
jmp 0x1001736f
mov eax, 0xffffffff
jmp 0x10017452
cmp dword [ebp - 0x10], 0
je 0x10017448
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x100173a9
push 0x24b
push 0x405a73b
push 6
call fcn.100b8c4b
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
xor eax, eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x100173dc
push 0x29c
push 0x405a73b
push 6
call fcn.100b8c4b
add esp, 0xc
test eax, eax
je 0x10017439
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10017410
push 0x309
push 0x405a73b
push 6
call fcn.100b8c4b
add esp, 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jle 0x1001742a
mov eax, dword [ebp - 0x14]
jmp 0x10017452
mov eax, 0xffffffff
jmp 0x10017452
mov eax, 0xffffffff
jmp 0x10017452
mov eax, 0xffffffff
jmp 0x10017452
push eax
mov ebx, dword [ebp - 4]
push ebx
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.100b8c45
add esp, 4
pop ebx
call fcn.100b8c45
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret