Function at 0x1015d97
Capabilities:
Get token privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x102c22c]
mov ecx, dword [ebp + 0x10]
xor edx, edx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov esi, 0x100
mov dword [edi], edx
mov dword [eax], edx
push esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edx
mov byte [ebp - 0xc], dl
mov byte [ebp - 0xb], dl
mov byte [ebp - 0xa], dl
mov byte [ebp - 9], dl
mov byte [ebp - 8], dl
mov byte [ebp - 7], 5
mov dword [ecx], edx
call sub.msvcrt.dll_malloc
mov ebx, eax
xor eax, eax
cmp ebx, eax
pop ecx
jne 0x1015e00
push 0x1004e30
push 0x1004e18
jmp 0x1015fbd
push edi
push eax
push eax
push eax
push eax
push eax
push eax
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1015e34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1004e30
push 0x1004dec
jmp 0x1015f8e
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1015e61
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1004e30
push 0x1004dc8
jmp 0x1015f8e
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push 4
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x1015edd
cmp dword [ebp - 0x10], esi
jbe 0x1015fe8
push esi
mov esi, 0x1004e30
push esi
push 0x1004d9c
call fcn.01015c8e
push ebx
call sub.msvcrt.dll_free
push dword [ebp - 0x10]
call sub.msvcrt.dll_malloc
mov ebx, eax
mov eax, dword [ebp - 0x10]
add esp, 0x14
test ebx, ebx
mov dword [ebp - 0x1c], eax
jne 0x1015eba
push esi
push 0x1004d78
jmp 0x1015fbd
lea ecx, [ebp - 0x10]
push ecx
push eax
push ebx
push 4
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x1015ee2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1004d40
jmp 0x1015f8e
mov esi, 0x1004e30
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edi, eax
push edi
call sub.msvcrt.dll_malloc
test eax, eax
pop ecx
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
jne 0x1015f07
push esi
push 0x1004d20
jmp 0x1015fbd
mov esi, dword [ebx]
mov ecx, edi
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push 1
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x1015f98
cmp dword [ebp - 0x10], esi
jbe 0x1015fe8
push esi
mov esi, 0x1004e30
push esi
push 0x1004cf8
call fcn.01015c8e
push ebx
call sub.msvcrt.dll_free
push dword [ebp - 0x10]
call sub.msvcrt.dll_malloc
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1015f6e
push esi
push 0x1004cd8
jmp 0x1015fbd
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ebx
push 1
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x1015f9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1004ca0
call fcn.01015c8e
add esp, 0xc
jmp 0x1015fe8
mov esi, 0x1004e30
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edi, eax
push edi
call sub.msvcrt.dll_malloc
test eax, eax
pop ecx
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jne 0x1015fcd
push esi
push 0x1004c84
call fcn.01015c8e
pop ecx
pop ecx
push 8
call fcn.0100d556
jmp 0x1015fe8
mov esi, dword [ebx]
mov ecx, edi
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x18], 1
push ebx
call sub.msvcrt.dll_free
xor edi, edi
cmp dword [ebp - 0x18], edi
pop ecx
jne 0x101601d
mov esi, dword [ebp - 0x28]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [esi], edi
mov esi, dword [ebp - 0x20]
push dword [esi]
call sub.msvcrt.dll_free
mov dword [esi], edi
mov esi, dword [ebp - 0x24]
push dword [esi]
call sub.msvcrt.dll_free
pop ecx
pop ecx
mov dword [esi], edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 0xc