Function at 0x1025361
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x108ca26
call fcn.01026ef8
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 0x1002e34
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x24], bl
cmp byte [ebp + 8], bl
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], ebx
je 0x10253ad
push 8
lea ecx, [ebp - 0x2c]
call fcn.01024b11
mov edi, eax
cmp edi, ebx
jl 0x1025597
jmp 0x102540c
lea eax, [ebp + 8]
push eax
push 1
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1025401
call esi
cmp eax, 0x3f0
je 0x10253e6
cmp eax, ebx
jle 0x1025500
and eax, 0xffff
or eax, 0x80070000
jmp 0x1025500
lea eax, [ebp + 8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10254f8
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.01024bc6
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x28]
mov dword [ebp - 0x10], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call ebx
call esi
cmp eax, 0x7a
je 0x102542d
test eax, eax
jmp 0x10253d1
push dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.01023fc3
mov edi, eax
test edi, edi
jl 0x1025597
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push 1
push dword [ebp - 0x28]
call ebx
test eax, eax
je 0x10254f8
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x10254f8
cmp dword [ebp + 0x10], 0
je 0x102558a
and dword [ebp + 8], 0
push 0x1002dcc
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1025497
mov dword [ebp + 8], 1
push 0x1002dd8
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10254ac
or dword [ebp + 8], 2
lea eax, [ebp - 0x10]
push eax
xor edi, edi
push edi
push edi
push 2
push dword [ebp - 0x28]
mov dword [ebp - 0x10], edi
call ebx
call esi
cmp eax, 0x7a
je 0x10254cc
cmp eax, edi
jmp 0x10253d1
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.01023fc3
mov edi, eax
test edi, edi
jl 0x1025597
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push 2
push dword [ebp - 0x28]
call ebx
test eax, eax
jne 0x1025519
call esi
test eax, eax
jg 0x1025507
call esi
mov edi, eax
jmp 0x1025597
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x1025597
and dword [ebp - 0x18], 0
cmp dword [edi], 0
jbe 0x1025582
lea esi, [edi + 4]
test byte [esi + 4], 4
je 0x1025575
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0x1002de8
push dword [esi]
call ebx
test eax, eax
je 0x1025542
or dword [ebp + 8], 4
push 0x1002df8
push dword [esi]
call ebx
test eax, eax
je 0x1025553
or dword [ebp + 8], 8
push 0x1002e08
push dword [esi]
call ebx
test eax, eax
je 0x1025564
or dword [ebp + 8], 0x10
push 0x1002e18
push dword [esi]
call ebx
test eax, eax
je 0x1025575
or dword [ebp + 8], 0x20
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add esi, 8
cmp eax, dword [edi]
jb 0x1025525
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
call fcn.01017edc
xor edi, edi
cmp dword [ebp - 0x14], 0
je 0x10255a6
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x1c]
push eax
call fcn.01023b2c
lea eax, [ebp - 0x20]
push eax
call fcn.01023b2c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x1002e34
call fcn.01024aee
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc