Function at 0x10009985
Capabilities:
Get token membership

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
cmp dword [esp + 0x9c], 0
mov eax, 0x2656ff08
mov ecx, 0x3e782bc1
cmove ecx, eax
mov dword [esp + 0x20], ecx
mov eax, 0x149788bf
lea ebp, [esp + 0x44]
lea ebx, [esp + 0x10]
cmp eax, 0xf6e8fad0
jle 0x10009a16
cmp eax, 0x369fdd32
jle 0x10009a68
cmp eax, 0x64cfeb04
jle 0x10009b00
cmp eax, 0x716f5bac
jle 0x10009cc7
cmp eax, 0x7599a968
jg 0x10009eef
cmp eax, 0x716f5bad
je 0x1000a3ee
cmp eax, 0x7362c269
je 0x1000a438
cmp eax, 0x74ace130
jne 0x100099b5
cmp dword [esp + 0x28], 0
setne byte [esp + 3]
mov eax, 0xa4dbb34b
jmp 0x100099b5
cmp eax, 0xbfd51c5b
jle 0x10009ab4
cmp eax, 0xd968fbfb
jle 0x10009b3c
cmp eax, 0xe7e9d64c
jg 0x10009d05
cmp eax, 0xe1e04fea
jle 0x10009f7d
cmp eax, 0xe1e04feb
je 0x1000a4a4
cmp eax, 0xe241f839
je 0x1000a4f0
cmp eax, 0xe361a46c
je 0x1000a649
jmp 0x100099b5
cmp eax, 0xd274581
jg 0x10009bea
cmp eax, 0x4dd407c
jg 0x10009d43
cmp eax, 0xfb78a314
jle 0x10009ff8
cmp eax, 0xfb78a315
je 0x1000a4fa
cmp eax, 0xfc332d4e
je 0x1000a55b
cmp eax, 0x10cf6fe
jne 0x100099b5
mov eax, 0x7e7624f4
jmp 0x100099b5
cmp eax, 0x98a00f39
jg 0x10009c7b
cmp eax, 0x89d3094c
jg 0x10009d79
cmp eax, 0x84445b7c
jle 0x1000a01c
cmp eax, 0x84445b7d
je 0x1000a57d
cmp eax, 0x84f835a9
je 0x1000a587
cmp eax, 0x88bc6bfa
jne 0x100099b5
mov eax, 0x4dd407d
jmp 0x100099b5
cmp eax, 0x5694e4c3
jg 0x10009e17
cmp eax, 0x401e08c9
jle 0x1000a09e
cmp eax, 0x401e08ca
je 0x1000a59c
cmp eax, 0x42af64c6
je 0x1000a5b7
cmp eax, 0x49358352
je 0x1000a866
jmp 0x100099b5
cmp eax, 0xc898b5fc
jg 0x10009e4d
cmp eax, 0xc13fe089
jle 0x1000a0c6
cmp eax, 0xc13fe08a
je 0x1000a5d1
cmp eax, 0xc18e4d86
je 0x1000a5e3
cmp eax, 0xc405f90b
jne 0x100099b5
cmp dword [esp + 0x18], 0
setne byte [esp + 4]
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x1691614a
mov edx, eax
and edx, 0xe96e9eb5
or edx, ecx
xor edx, 0xe96e9eb4
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne dl
cmp dword [0x10098de8], 0xa
setl ch
setge cl
and al, cl
or cl, dl
and ch, dl
or ch, al
mov edx, ecx
xor dl, ch
mov eax, 0x42af64c6
mov edi, 0xf6e8fad1
mov esi, 0x42af64c6
test ch, ch
jne 0x1000abce
mov esi, 0xf6e8fad1
jmp 0x1000abce
cmp eax, 0x2656ff07
jg 0x10009e83
cmp eax, 0x149788be
jle 0x1000a0e6
cmp eax, 0x149788bf
je 0x1000a5ff
cmp eax, 0x16e1d6de
je 0x1000a611
cmp eax, 0x1aca176d
jne 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x3cb39a84
and eax, 0xc34c657b
or eax, edx
xor eax, 0xc34c657a
xor ecx, eax
test ecx, eax
sete dl
cmp dword [0x10098de8], 0xa
setl cl
xor dl, cl
mov eax, edx
xor al, 1
and cl, al
xor al, cl
mov esi, 0x10cf6fe
mov eax, 0x7e7624f4
jne 0x10009c71
mov esi, 0x7e7624f4
test dl, dl
cmove eax, esi
jmp 0x1000a49a
cmp eax, 0xa52c0872
jg 0x10009eb9
cmp eax, 0x9da0777c
jle 0x1000a106
cmp eax, 0x9da0777d
je 0x1000a61b
cmp eax, 0xa30e72b4
je 0x1000a639
cmp eax, 0xa4dbb34b
jne 0x100099b5
cmp byte [esp + 3], 0
mov eax, 0x3e782bc1
jne 0x100099b5
jmp 0x10009eaf
cmp eax, 0x6a08aa9e
jle 0x1000a165
cmp eax, 0x6a08aa9f
je 0x1000a653
cmp eax, 0x6bd1ea29
je 0x1000a6ac
cmp eax, 0x6d542ba0
jne 0x100099b5
mov eax, dword [esp + 0xc]
mov dword [esp + 0x30], eax
mov eax, 0x9da0777d
jmp 0x100099b5
cmp eax, 0xf3258bea
jle 0x1000a1c1
cmp eax, 0xf3258beb
je 0x1000a6b6
cmp eax, 0xf36eed48
je 0x1000a723
cmp eax, 0xf5714462
jne 0x100099b5
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, 0x716f5bad
jmp 0x100099b5
cmp eax, 0x8d7ca72
jle 0x1000a1e9
cmp eax, 0x8d7ca73
je 0x1000a72d
cmp eax, 0x98b66c1
je 0x1000a79e
cmp eax, 0xc336e2c
jne 0x100099b5
mov eax, 0x79fa8752
jmp 0x100099b5
cmp eax, 0x8c81860c
jle 0x1000a249
cmp eax, 0x8c81860d
je 0x1000a7a8
cmp eax, 0x9383d862
je 0x1000a7f9
cmp eax, 0x94bc3478
jne 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xf3e75fd
and eax, 0xf0c18a02
or eax, edx
xor eax, 0xf3e75fc
or eax, ecx
xor eax, 0xffffffff
setne cl
sete al
cmp dword [0x10098de8], 0xa
setl dl
setge ah
and ah, al
and cl, dl
or cl, ah
mov ah, dl
xor ah, al
or dl, al
xor dl, 1
or dl, ah
mov ch, dl
xor ch, cl
mov esi, 0xeb91a2d
mov eax, 0x8a0392e
mov edi, 0xeb91a2d
test dl, dl
jne 0x1000ab50
mov edi, 0x8a0392e
jmp 0x1000ab50
cmp eax, 0x5ce570cb
jle 0x1000a273
cmp eax, 0x5ce570cc
je 0x1000a856
cmp eax, 0x5e439a8b
je 0x1000a870
cmp eax, 0x63b55cf7
jne 0x100099b5
mov eax, 0xfb78a315
jmp 0x100099b5
cmp eax, 0xcc32c5ea
jle 0x1000a2f6
cmp eax, 0xcc32c5eb
je 0x1000a5c7
cmp eax, 0xd3592567
je 0x1000aa16
cmp eax, 0xd3faf2ac
jne 0x100099b5
mov eax, 0x31392f94
jmp 0x100099b5
cmp eax, 0x2ad40bf5
jle 0x1000a371
cmp eax, 0x2ad40bf6
je 0x1000a8bb
cmp eax, 0x2d5c16bd
je 0x1000a8d9
cmp eax, 0x31392f94
jne 0x100099b5
mov eax, 0xc13fe08a
jmp 0x100099b5
cmp eax, 0xaee92088
jle 0x1000a391
cmp eax, 0xaee92089
je 0x1000a8eb
cmp eax, 0xb09ffd37
je 0x1000a8ff
cmp eax, 0xb9432a5b
jne 0x100099b5
mov eax, 0xb09ffd37
jmp 0x100099b5
cmp eax, 0x7599a969
je 0x1000a952
cmp eax, 0x79fa8752
je 0x1000a95c
cmp eax, 0x7e7624f4
jne 0x100099b5
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x98fc7532
mov edx, eax
and edx, 0x67038acd
or edx, ecx
xor edx, 0x67038acc
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
setne al
sete dl
cmp dword [0x10098de8], 0xa
setl cl
setge ch
and dl, ch
and cl, al
or cl, dl
or ch, al
mov dl, ch
xor dl, cl
mov esi, 0x10cf6fe
mov eax, 0x98b66c1
mov edi, 0x10cf6fe
test ch, ch
jne 0x1000abce
mov edi, 0x98b66c1
jmp 0x1000abce
cmp eax, 0xd968fbfc
je 0x1000a9c4
cmp eax, 0xda414b5e
jne 0x1000ac24
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x3bc14ed6
mov edx, eax
and edx, 0xc43eb129
or edx, ecx
xor edx, 0xc43eb128
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
setne al
cmp dword [0x10098de8], 0xa
setge ch
mov cl, ch
xor cl, al
or ch, al
mov dl, ch
xor dl, cl
mov esi, 0xe241f839
mov eax, 0x369fdd33
mov edi, 0xe241f839
test ch, ch
jne 0x1000abce
mov edi, 0x369fdd33
jmp 0x1000abce
cmp eax, 0xf6e8fad1
je 0x1000a9de
cmp eax, 0xfb32d470
jne 0x100099b5
mov eax, dword [esp + 0x1c]
mov eax, 0xf3258beb
jmp 0x100099b5
cmp eax, 0x8266c0f5
je 0x1000a9ec
cmp eax, 0x830b4f21
jne 0x100099b5
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xb7e02585
mov edx, eax
and edx, 0x481fda7a
or edx, ecx
xor edx, 0x481fda7b
and eax, 0xfffffffe
or eax, edx
xor eax, 0xe20f63aa
cmp eax, 0x1df09c55
sete dl
cmp dword [0x10098de8], 0xa
setl cl
xor dl, cl
mov eax, 0xdc1850e1
mov edi, 0xdc1850e1
jne 0x1000a086
mov edi, 0xc898b5fd
mov ch, dl
not ch
mov esi, 0xdc1850e1
test ch, cl
jne 0x1000a8ac
mov esi, edi
jmp 0x1000a8ac
cmp eax, 0x369fdd33
je 0x1000aa06
cmp eax, 0x3e782bc1
jne 0x100099b5
mov dword [esp + 8], 0
mov eax, 0x401e08ca
jmp 0x100099b5
cmp eax, 0xbfd51c5c
je 0x1000aa20
cmp eax, 0xc067bfb6
jne 0x100099b5
mov eax, 0xc9002b08
jmp 0x100099b5
cmp eax, 0xd274582
je 0x1000aa2a
cmp eax, 0xeb91a2d
jne 0x100099b5
mov eax, 0x8a0392e
jmp 0x100099b5
cmp eax, 0x98a00f3a
je 0x1000a5f5
cmp eax, 0x9ac9fdc2
jne 0x100099b5
mov eax, dword [0x10098de4]
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x10098de8], 0xa
setl dl
mov ecx, edx
xor cl, al
or dl, al
xor dl, 1
or dl, cl
mov eax, edx
xor al, cl
mov esi, 0x88bc6bfa
mov eax, 0x4dd407d
jne 0x1000a495
mov esi, 0x4dd407d
jmp 0x1000a495
cmp eax, 0x64cfeb05
je 0x1000aa34
cmp eax, 0x6802c49c
jne 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete ch
cmp dword [0x10098de8], 0xa
setl cl
setge dl
and ch, dl
and cl, al
or cl, ch
or dl, al
mov ch, dl
xor ch, cl
mov esi, 0xc898b5fd
mov eax, 0x830b4f21
test ch, 1
jne 0x1000a1b9
mov esi, 0x830b4f21
test dl, 1
jmp 0x1000a497
cmp eax, 0xe7e9d64d
je 0x1000aa83
cmp eax, 0xea1d159e
jne 0x100099b5
mov eax, dword [esp + 8]
mov dword [esp + 0x38], eax
mov eax, 0xd968fbfc
jmp 0x100099b5
cmp eax, 0x4dd407d
je 0x1000aa97
cmp eax, 0x8a0392e
jne 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx + 0x5d1d85fb]
imul eax, ecx
test al, 1
sete dl
cmp dword [0x10098de8], 0xa
setl ch
setge cl
or cl, al
xor ch, dl
mov dl, ch
xor dl, cl
mov eax, 0x6bd1ea29
mov edi, 0xeb91a2d
mov esi, 0x6bd1ea29
test ch, ch
jne 0x1000a941
mov esi, 0xeb91a2d
jmp 0x1000a941
cmp eax, 0x89d3094d
je 0x1000aaf7
cmp eax, 0x89e5087e
jne 0x100099b5
mov eax, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
jmp 0x100099b5
cmp eax, 0x5694e4c4
je 0x1000ab5f
cmp eax, 0x582751fe
jne 0x100099b5
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xb62b36df
mov edx, eax
and edx, 0x49d4c920
or edx, ecx
xor edx, 0x49d4c921
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
setne al
sete dl
cmp dword [0x10098de8], 0xa
setl cl
setge ch
and dl, ch
and cl, al
or cl, dl
or ch, al
mov dl, ch
xor dl, cl
mov esi, 0x7599a969
mov eax, 0x6a08aa9f
mov edi, 0x7599a969
test ch, ch
jne 0x1000abce
mov edi, 0x6a08aa9f
jmp 0x1000abce
cmp eax, 0xc898b5fd
je 0x1000abdd
cmp eax, 0xc9002b08
jne 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x6718b54a
and eax, 0x98e74ab5
or eax, edx
xor eax, 0x6718b54b
or eax, ecx
xor eax, 0xffffffff
sete al
setne dl
cmp dword [0x10098de8], 0xa
setl ch
setge cl
or cl, dl
xor ch, al
mov dl, ch
xor dl, cl
mov eax, 0xa63b7b01
mov edi, 0xf36eed48
mov esi, 0xa63b7b01
test ch, ch
jne 0x1000abce
mov esi, 0xf36eed48
jmp 0x1000abce
cmp eax, 0x2656ff08
je 0x1000abe7
cmp eax, 0x269c1e11
jne 0x100099b5
mov eax, 0xa30e72b4
jmp 0x100099b5
cmp eax, 0xa52c0873
je 0x1000ac09
cmp eax, 0xa63b7b01
jne 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete dl
cmp dword [0x10098de8], 0xa
setl ch
setge cl
or cl, al
xor ch, dl
mov edx, ecx
xor dl, ch
mov eax, 0x84f835a9
mov edi, 0xf36eed48
mov esi, 0x84f835a9
test ch, ch
jne 0x1000a941
mov esi, 0xf36eed48
jmp 0x1000a941
mov ecx, dword [0x10098de4]
lea eax, [ecx - 1]
imul eax, ecx
not al
or al, 0xfe
cmp al, 0xff
setne al
cmp dword [0x10098de8], 0xa
setge ch
mov cl, al
xor cl, ch
or ch, al
mov dl, ch
xor dl, cl
mov esi, 0xfb32d470
mov eax, 0xf3258beb
mov edi, 0xfb32d470
test ch, ch
jne 0x1000abce
mov edi, 0xf3258beb
jmp 0x1000abce
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x55c090ea
mov edx, eax
and edx, 0xaa3f6f15
or edx, ecx
xor edx, 0xaa3f6f14
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete cl
setne al
cmp dword [0x10098de8], 0xa
setge dl
setl ah
and ah, al
and cl, dl
or cl, ah
or dl, al
mov eax, edx
xor al, cl
mov esi, 0xf6e8fad1
mov eax, 0xc405f90b
jne 0x1000a495
mov esi, 0xc405f90b
test dl, dl
cmovne eax, esi
test cl, cl
cmove eax, esi
jmp 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx - 1]
imul eax, ecx
and eax, 1
sete dl
cmp dword [0x10098de8], 0xa
setl cl
setge ch
and dl, ch
and cl, al
or cl, dl
or ch, al
mov dl, ch
xor dl, cl
mov esi, 0xb9432a5b
mov eax, 0xb09ffd37
mov edi, 0xb9432a5b
test ch, ch
jne 0x1000abce
mov edi, 0xb09ffd37
jmp 0x1000abce
mov eax, 0xda414b5e
jmp 0x100099b5
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete al
setne dl
cmp dword [0x10098de8], 0xa
setge ah
setl ch
mov cl, ch
xor cl, dl
and cl, ch
and ah, al
and ch, dl
or ch, ah
mov dl, ch
xor dl, cl
mov esi, 0x5694e4c4
mov eax, 0x2ad40bf6
mov edi, 0x5694e4c4
test ch, ch
jne 0x1000a7ef
mov edi, 0x2ad40bf6
jmp 0x1000a7ef
push ebx
push 4
lea eax, [esp + 0x2c]
push eax
push 0x12
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [esp + 0x18], eax
mov eax, 0x7362c269
jmp 0x100099b5
mov eax, 0x9383d862
jmp 0x100099b5
cmp byte [esp + 7], 0
mov eax, 0x2d5c16bd
jne 0x100099b5
jmp 0x1000a8f5
mov dword [esp + 0x10], 0
mov eax, dword [0x10098be4]
mov dword [esp + 0x2c], eax
mov eax, 0xc18e4d86
jmp 0x100099b5
cmp byte [esp + 4], 0
mov eax, 0xf5714462
jne 0x100099b5
mov eax, 0x94bc3478
jmp 0x100099b5
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
mov eax, 0x6802c49c
jmp 0x100099b5
mov ecx, dword [esp + 0x2c]
mov eax, 0x16e1d6de
cmp ecx, 6
jae 0x100099b5
mov eax, 0x5e439a8b
jmp 0x100099b5
mov dword [esp + 0x14], 0
mov eax, 0x89e5087e
jmp 0x100099b5
mov eax, 0xfc332d4e
jmp 0x100099b5
push ebx
push 4
lea eax, [esp + 0x10]
push eax
push 0x13
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, 0x8c81860d
jmp 0x100099b5
cmp dword [esp + 0x34], 0
mov eax, 0xa52c0873
je 0x100099b5
mov eax, 0xea1d159e
jmp 0x100099b5
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete al
setne dl
cmp dword [0x10098de8], 0xa
setl ch
setge cl
or cl, dl
xor ch, al
mov edx, ecx
xor dl, ch
mov eax, 0xd3faf2ac
mov edi, 0x7599a969
mov esi, 0xd3faf2ac
test ch, ch
jne 0x1000abce
mov esi, 0x7599a969
jmp 0x1000abce
mov eax, 0xe1e04feb
jmp 0x100099b5
mov eax, dword [esp + 0x1c]
cmp eax, 3
sete byte [esp + 5]
mov ecx, dword [0x10098de4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete al
setne dl
cmp dword [0x10098de8], 0xa
setl ch
setge cl
and al, cl
or cl, dl
and ch, dl
or ch, al
mov edx, ecx
xor dl, ch
mov eax, 0x1aca176d
mov edi, 0xfb32d470
mov esi, 0x1aca176d
test ch, ch
jne 0x1000abce
mov esi, 0xfb32d470
jmp 0x1000abce
mov eax, 0xa63b7b01
jmp 0x100099b5
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x459354af
mov edx, eax
and edx, 0xba6cab50
or edx, ecx
xor edx, 0xba6cab51
and eax, 0xfffffffe
or eax, edx
xor eax, 0x27e21dc1
xor eax, 0xd81de23e
sete al
setne dl
cmp dword [0x10098de8], 0xa
setge ah
setl ch
mov cl, ch
xor cl, dl
and cl, ch
and ah, al
and ch, dl
or ch, ah
mov dl, ch
xor dl, cl
mov esi, 0xda414b5e
mov eax, 0xe241f839
mov edi, 0xda414b5e
test ch, ch
jne 0x1000a7ef
mov edi, 0xe241f839
jmp 0x1000a7ef
mov eax, 0x5ce570cc
jmp 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
sete dl
cmp dword [0x10098de8], 0xa
setge ch
setl dh
mov cl, dh
xor cl, al
and cl, dh
and ch, dl
and dh, al
or dh, ch
mov dl, cl
xor dl, dh
mov esi, 0x9383d862
mov eax, 0x84445b7d
mov edi, 0x9383d862
test dh, dh
jne 0x1000a7ef
mov edi, 0x84445b7d
test cl, cl
cmovne eax, edi
jmp 0x1000abd3
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
setne al
sete dl
cmp dword [0x10098de8], 0xa
setl cl
setge ch
and dl, ch
and cl, al
or cl, dl
or ch, al
mov dl, ch
xor dl, cl
mov esi, 0x84445b7d
mov eax, 0x49358352
mov edi, 0x84445b7d
test ch, ch
jne 0x1000abce
mov edi, 0x49358352
jmp 0x1000abce
cmp byte [esp + 5], 0
mov eax, 0x6d542ba0
jne 0x100099b5
mov eax, 0xcc32c5eb
jmp 0x100099b5
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp dword [0x10098de8], 0xa
setl cl
xor dl, cl
mov eax, 0x79fa8752
mov esi, 0x79fa8752
jne 0x1000a8a3
mov esi, 0xc336e2c
mov ch, dl
not ch
test ch, cl
cmovne esi, eax
test dl, dl
cmove eax, esi
test ch, cl
cmove eax, esi
jmp 0x100099b5
mov dword [esp + 0x10], 0x44
push ebx
push ebp
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov eax, 0x5694e4c4
jmp 0x100099b5
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
mov eax, 0xaee92089
jmp 0x100099b5
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x582751fe
jmp 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete dl
cmp dword [0x10098de8], 0xa
setl ch
setge cl
and dl, cl
or cl, al
and ch, al
or ch, dl
mov edx, ecx
xor dl, ch
mov eax, 0x98a00f3a
mov edi, 0xb9432a5b
mov esi, 0x98a00f3a
test ch, ch
jne 0x1000a941
mov esi, 0xb9432a5b
test cl, 1
cmovne esi, edi
test dl, 1
cmovne eax, esi
jmp 0x100099b5
mov eax, 0x6a08aa9f
jmp 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xdbdae9a8
and eax, 0x24251657
or eax, edx
mov esi, dword [esp + 8]
xor eax, 0x24251656
xor ecx, eax
test ecx, eax
setne dl
sete cl
cmp dword [0x10098de8], 0xa
mov dword [esp + 0x34], esi
setge al
xor cl, al
or dl, al
mov eax, ecx
xor al, dl
mov eax, 0x269c1e11
mov esi, 0x269c1e11
jne 0x1000a9b5
mov esi, 0xc336e2c
test dl, dl
cmovne eax, esi
test cl, cl
cmovne eax, esi
jmp 0x100099b5
cmp dword [esp + 0x38], 0
mov eax, 0x64cfeb05
je 0x100099b5
mov eax, 0x63b55cf7
jmp 0x100099b5
mov eax, dword [esp + 0x18]
mov eax, 0xc405f90b
jmp 0x100099b5
lea eax, [esp + 0x14]
push eax
push ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov eax, 0xd3592567
jmp 0x100099b5
cmp byte [esp + 6], 0
mov eax, 0x8266c0f5
jne 0x100099b5
mov eax, 0xe7e9d64d
jmp 0x100099b5
mov eax, 0x64cfeb05
jmp 0x100099b5
mov eax, 0x89d3094d
jmp 0x100099b5
mov ecx, dword [0x10098de4]
lea eax, [ecx - 1]
imul eax, ecx
not al
or al, 0xfe
cmp al, 0xff
sete al
cmp dword [0x10098de8], 0xa
setl ch
mov cl, ch
xor cl, al
or ch, al
xor ch, 1
or ch, cl
mov dl, ch
xor dl, cl
mov esi, 0xd274582
mov eax, 0x89d3094d
mov edi, 0xd274582
test ch, ch
jne 0x1000abce
mov edi, 0x89d3094d
jmp 0x1000abce
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xbfd51c5c
jmp 0x100099b5
cmp dword [esp + 0x9c], 0
sete byte [esp + 7]
mov ecx, dword [0x10098de4]
lea eax, [ecx - 1]
imul eax, ecx
test al, 1
sete ch
cmp dword [0x10098de8], 0xa
setl dl
setge cl
xor cl, al
mov eax, edx
xor al, ch
or dl, ch
xor dl, 1
or dl, al
mov ch, dl
xor ch, cl
mov esi, 0x88bc6bfa
mov eax, 0xc067bfb6
test ch, 1
jne 0x1000aae7
mov esi, 0xc067bfb6
test dl, dl
cmovne eax, esi
test cl, 1
cmove eax, esi
jmp 0x100099b5
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete al
setne ah
cmp dword [0x10098de8], 0xa
setl dl
xor ah, dl
mov ecx, eax
xor cl, dl
xor ah, 1
or dl, al
xor dl, 1
or dl, ah
mov ch, dl
xor ch, cl
mov esi, 0xd274582
mov eax, 0x9ac9fdc2
mov edi, 0xd274582
test dl, dl
jne 0x1000ab50
mov edi, 0x9ac9fdc2
test cl, cl
cmovne esi, edi
test ch, ch
cmovne eax, esi
jmp 0x100099b5
mov dword [esp + 0x10], 0x44
push ebx
push ebp
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
setne byte [esp + 6]
mov eax, dword [0x10098de4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete al
setne dl
cmp dword [0x10098de8], 0xa
setl ch
setge cl
and al, cl
or cl, dl
and ch, dl
or ch, al
mov edx, ecx
xor dl, ch
mov eax, 0x8d7ca73
mov edi, 0x2ad40bf6
mov esi, 0x8d7ca73
test ch, ch
jne 0x1000abce
mov esi, 0x2ad40bf6
test cl, cl
cmovne esi, edi
test dl, dl
cmovne eax, esi
jmp 0x100099b5
mov eax, 0x830b4f21
jmp 0x100099b5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push 0xa
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [esp + 0x28], eax
mov eax, 0x74ace130
jmp 0x100099b5
lea eax, [esp + 8]
push eax
push 1
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov eax, 0xe361a46c
jmp 0x100099b5
cmp eax, 0xdc1850e1
jne 0x100099b5
mov eax, dword [esp + 0x40]
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret