Function at 0x412a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x28], 0x960bb411
jmp 0x412ac0
mov dword [esi + 0x28], 0xa142fa5c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0x28]
cmp eax, 0x91baf7a1
jg 0x412ae0
cmp eax, 0x8024c44a
jne 0x412ac0
jmp 0x412aad
cmp eax, 0x7af5713b
jg 0x412ca0
cmp eax, 0x960bb410
jg 0x412cc6
cmp eax, 0x91baf7a2
jne 0x412ac0
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x24], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x1c], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x18], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x20], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x14], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x10], esp
mov eax, 0x8c
call fcn.00416c10
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
mov eax, 4
call fcn.00416c10
mov dword [esi + 0xc], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 8], esp
mov eax, 4
call fcn.00416c10
mov eax, 4
call fcn.00416c10
mov dword [esi + 4], esp
mov eax, 4
call fcn.00416c10
mov edi, esp
mov eax, 4
call fcn.00416c10
mov eax, 4
call fcn.00416c10
mov eax, 4
call fcn.00416c10
mov ecx, esp
mov eax, 4
call fcn.00416c10
mov eax, 0x400
call fcn.00416c10
mov eax, 0x400
call fcn.00416c10
mov eax, 8
call fcn.00416c10
mov dword [esi], esp
mov eax, dword [ebp + 0x14]
mov edx, dword [esi + 0x24]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [esi + 0x1c]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [esi + 0x18]
mov dword [edx], eax
mov eax, dword [esi + 0x14]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0xd
mov eax, dword [esi + 8]
mov dword [eax], 0
mov eax, dword [esi + 4]
mov dword [eax], 0
mov dword [edi], 0x400
mov dword [ecx], 0xffffffff
mov eax, dword [ebp + 8]
mov edi, dword [esi + 0x20]
mov dword [edi], eax
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 8], 0x8c
mov dword [esp + 4], 0
call fcn.00403dc0
add esp, 0xc
mov eax, dword [edi]
sub esp, 0xc
mov dword [esp + 4], eax
mov edi, dword [esi]
mov dword [esp], edi
mov dword [esp + 8], 5
call fcn.00402ad0
add esp, 0xc
sub esp, 0xc
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], 5
call fcn.00413a40
add esp, 0xc
mov dword [esi + 0x28], 0xcd798645
jmp 0x412ac0
cmp eax, 0x7af5713c
jne 0x412ac0
mov ecx, dword [esi + 0x44]
mov eax, 0x21e62833
cmp dword [ecx + 0x14], 0
jne 0x412cbe
mov eax, 0xe218e766
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0x98170cbf
jg 0x412ce4
cmp eax, 0x960bb411
jne 0x412ac0
mov dword [esi + 0x28], 0xcd798645
jmp 0x412ac0
cmp eax, 0xa142fa5b
jg 0x412d02
cmp eax, 0x98170cc0
jne 0x412ac0
mov dword [esi + 0x28], 0x6b8c3d06
jmp 0x412ac0
cmp eax, 0xa243073d
jg 0x412d20
cmp eax, 0xa142fa5c
jne 0x412ac0
mov dword [esi + 0x28], 0xd7cd744f
jmp 0x412ac0
cmp eax, 0xa5fb3674
jg 0x412d47
cmp eax, 0xa243073e
jne 0x412ac0
mov eax, dword [esi + 0x64]
mov dword [eax], 0
mov dword [esi + 0x28], 0x7af5713c
jmp 0x412ac0
cmp eax, 0xabc43635
jg 0x412d72
cmp eax, 0xa5fb3675
jne 0x412ac0
mov al, byte [esi + 0x79]
test al, al
mov eax, 0x24bd8e5b
jne 0x412d6a
mov eax, 0x2c92545f
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0xaf72ad4e
jg 0x412d9a
cmp eax, 0xabc43636
jne 0x412ac0
mov eax, dword [esi + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esi + 0x58]
mov dword [ecx], eax
mov dword [esi + 0x28], 0x28bf9a5c
jmp 0x412ac0
cmp eax, 0x720b7824
jg 0x412dcd
cmp eax, 0x711a084f
jg 0x412df2
cmp eax, 0x6b8c3d05
jg 0x412e13
cmp eax, 0xb056e60b
jg 0x412e23
cmp eax, 0xaf72ad4f
jne 0x412ac0
mov dword [esi + 0x28], 0x65eb5b6c
jmp 0x412ac0
cmp eax, 0x720b7825
jne 0x412ac0
mov ecx, dword [esi + 0x54]
mov eax, 0xfe406b70
cmp dword [ecx], 0
je 0x412dea
mov eax, 0x434fc126
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0x711a0850
jne 0x412ac0
mov eax, dword [esi + 0x58]
cmp dword [eax], 0
setne byte [esi + 0x7b]
mov dword [esi + 0x28], 0xd1bd9705
jmp 0x412ac0
cmp eax, 0x6b8c3d06
jne 0x412ac0
jmp 0x413a2f
cmp eax, 0xb3790739
jg 0x412eb1
cmp eax, 0xb056e60c
jne 0x412ac0
mov eax, dword [esi + 0x50]
mov eax, dword [eax]
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x30]
mov edi, dword [esi + 0x4c]
mov edi, dword [edi]
add edi, dword [edx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edi
call fcn.00402ad0
add esp, 0xc
mov eax, dword [esi + 0x50]
mov eax, dword [eax]
mov ecx, dword [esi + 0x4c]
add eax, dword [ecx]
mov ecx, dword [esi + 0x4c]
mov dword [ecx], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x2c]
mov ecx, dword [ecx]
mov edx, 0x42bc50e5
add ecx, edx
sub ecx, dword [eax]
add ecx, 0xbd43af1b
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x58]
mov dword [eax], 0x400
mov eax, dword [esi + 0x58]
mov eax, dword [eax]
mov ecx, dword [esi + 0x2c]
cmp dword [ecx], eax
setb al
mov byte [esi + 0x7a], al
mov dword [esi + 0x28], 0x2d08677e
jmp 0x412ac0
cmp eax, 0xb4a52724
jg 0x412eea
cmp eax, 0xb379073a
jne 0x412ac0
mov eax, dword [esi + 0x50]
mov dword [eax], 0x400
mov eax, dword [esi + 0x50]
mov ecx, dword [eax]
mov edx, dword [esi + 0x2c]
mov eax, 0x582ee833
cmp ecx, dword [edx]
ja 0x412ee2
mov eax, 0xe6e0383d
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0xb63b638f
jg 0x412f31
cmp eax, 0xb4a52725
jne 0x412ac0
mov eax, dword [esi + 0x44]
mov eax, dword [eax + 0xc]
sub esp, 4
mov dword [esp], eax
call fcn.00418030
add esp, 4
mov ecx, dword [esi + 0x44]
mov dword [ecx + 0x14], eax
mov ecx, dword [esi + 0x44]
mov eax, 0xe23ffe48
cmp dword [ecx + 0x14], 0
jne 0x412f29
mov eax, 0x176d85d5
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0xb9ac0718
jg 0x412f59
cmp eax, 0xb63b6390
jne 0x412ac0
mov eax, dword [esi + 0x34]
mov eax, dword [eax]
mov ecx, dword [esi + 0x50]
mov dword [ecx], eax
mov dword [esi + 0x28], 0x6325ed88
jmp 0x412ac0
cmp eax, 0xc4825941
jg 0x412f77
cmp eax, 0xb9ac0719
jne 0x412ac0
mov dword [esi + 0x28], 0xcd006c76
jmp 0x412ac0
cmp eax, 0xc5e18c3b
jg 0x412f95
cmp eax, 0xc4825942
jne 0x412ac0
mov dword [esi + 0x28], 0xdbf4b787
jmp 0x412ac0
cmp eax, 0xc9344309
jg 0x412fb3
cmp eax, 0xc5e18c3c
jne 0x412ac0
mov dword [esi + 0x28], 0x28bf9a5c
jmp 0x412ac0
cmp eax, 0xcd006c75
jg 0x412fd1
cmp eax, 0xc934430a
jne 0x412ac0
mov dword [esi + 0x28], 0x1948e536
jmp 0x412ac0
cmp eax, 0xcd798644
jg 0x412fef
cmp eax, 0xcd006c76
jne 0x412ac0
mov dword [esi + 0x28], 0x711a0850
jmp 0x412ac0
cmp eax, 0xcf66a785
jg 0x4131d0
cmp eax, 0xcd798645
jne 0x412ac0
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x2c], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x30], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x34], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x38], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x3c], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x40], esp
mov eax, 0x8c
call fcn.00416c10
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x44], eax
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x48], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x4c], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x50], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x54], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x58], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x5c], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x60], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x64], esp
mov eax, 4
call fcn.00416c10
mov dword [esi + 0x68], esp
mov eax, 0x400
call fcn.00416c10
mov dword [esi + 0x6c], esp
mov eax, 0x400
call fcn.00416c10
mov dword [esi + 0x70], esp
mov eax, 8
call fcn.00416c10
mov edi, esp
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [esi + 0x34]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x38]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [esi + 0x3c]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov dword [eax], 0
mov eax, dword [esi + 0x48]
mov dword [eax], 0xd
mov eax, dword [esi + 0x4c]
mov dword [eax], 0
mov eax, dword [esi + 0x54]
mov dword [eax], 0
mov eax, dword [esi + 0x58]
mov dword [eax], 0x400
mov eax, dword [esi + 0x64]
mov dword [eax], 0xffffffff
mov eax, dword [esi + 0x44]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 0x8c
mov dword [esp + 4], 0
call fcn.00403dc0
add esp, 0xc
mov eax, dword [esi + 0x38]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], 5
call fcn.00402ad0
add esp, 0xc
mov eax, dword [esi + 0x44]
sub esp, 0xc
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 8], 5
call fcn.00413a40
add esp, 0xc
test eax, eax
setne byte [esi + 0x77]
mov dword [esi + 0x28], 0xcf66a786
jmp 0x412ac0
cmp eax, 0xd16e9e65
jg 0x4131fb
cmp eax, 0xcf66a786
jne 0x412ac0
mov al, byte [esi + 0x77]
test al, al
mov eax, 0x64e12651
jne 0x4131f3
mov eax, 0xc4825942
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0xd1bd9704
jg 0x41327a
cmp eax, 0xd16e9e66
jne 0x412ac0
mov eax, dword [esi + 0x50]
mov eax, dword [eax]
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x30]
mov edi, dword [esi + 0x4c]
mov edi, dword [edi]
add edi, dword [edx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edi
call fcn.00402ad0
add esp, 0xc
mov eax, dword [esi + 0x50]
mov eax, dword [eax]
mov ecx, dword [esi + 0x4c]
add eax, dword [ecx]
mov ecx, dword [esi + 0x4c]
mov dword [ecx], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x2c]
mov ecx, dword [ecx]
add ecx, 0xe8dba07c
sub ecx, dword [eax]
add ecx, 0x17245f84
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x58]
mov dword [eax], 0x400
mov eax, dword [esi + 0x58]
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x28], 0xb056e60c
jmp 0x412ac0
cmp eax, 0xd69f7f46
jg 0x4132a5
cmp eax, 0xd1bd9705
jne 0x412ac0
mov al, byte [esi + 0x7b]
test al, al
mov eax, 0x720b7825
jne 0x41329d
mov eax, 0xa243073e
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0xd7cd744e
jg 0x4132c3
cmp eax, 0xd69f7f47
jne 0x412ac0
mov dword [esi + 0x28], 0xee06e4a4
jmp 0x412ac0
cmp eax, 0xdbf4b786
jg 0x4132e9
cmp eax, 0xd7cd744f
jne 0x412ac0
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x40]
mov dword [ecx], eax
mov dword [esi + 0x28], 0xc934430a
jmp 0x412ac0
cmp eax, 0xdeff1e4a
jg 0x413347
cmp eax, 0xdbf4b787
jne 0x412ac0
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x44]
mov ecx, dword [ecx + 4]
neg ecx
sub ecx, dword [eax]
neg ecx
mov eax, 0x300
shl eax, cl
neg eax
mov ecx, 0x736
sub ecx, eax
add ecx, ecx
sub esp, 4
mov dword [esp], ecx
call fcn.00418030
add esp, 4
mov ecx, dword [esi + 0x44]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x44]
cmp dword [eax + 0x10], 0
setne byte [esi + 0x78]
mov dword [esi + 0x28], 0x2bed0338
jmp 0x412ac0
cmp eax, 0xe218e765
jg 0x413379
cmp eax, 0xdeff1e4b
jne 0x412ac0
mov eax, dword [esi + 0x44]
mov eax, dword [eax + 0x10]
sub esp, 4
mov dword [esp], eax
call fcn.00416c3b
add esp, 4
mov dword [esi + 0x28], 0xf4152996
jmp 0x412ac0
cmp eax, 0xe23ffe47
jg 0x4133a6
cmp eax, 0xe218e766
jne 0x412ac0
mov ecx, dword [esi + 0x44]
mov eax, 0x4f7c29b7
cmp dword [ecx + 0x10], 0
jne 0x41339e
mov eax, 0x6b8c3d06
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0xe6e0383c
jg 0x4133c4
cmp eax, 0xe23ffe48
jne 0x412ac0
mov dword [esi + 0x28], 0xe907c026
jmp 0x412ac0
cmp eax, 0xe907c025
jg 0x4133e2
cmp eax, 0xe6e0383d
jne 0x412ac0
mov dword [esi + 0x28], 0xb056e60c
jmp 0x412ac0
cmp eax, 0xee06e4a3
jg 0x41342c
cmp eax, 0xe907c026
jne 0x412ac0
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x40]
mov dword [ecx], eax
mov eax, dword [esi + 0x34]
mov eax, dword [eax]
add eax, 0xfffffff3
mov ecx, dword [esi + 0x34]
mov dword [ecx], eax
mov eax, dword [esi + 0x44]
mov dword [eax + 0x84], 0xfffffffe
mov eax, dword [esi + 0x44]
mov dword [eax + 0x58], 0
mov dword [esi + 0x28], 0x720b7825
jmp 0x412ac0
cmp eax, 0xef86b802
jg 0x41344a
cmp eax, 0xee06e4a4
jne 0x412ac0
mov dword [esi + 0x28], 0x7af5713c
jmp 0x412ac0
cmp eax, 0xf4152995
jg 0x413477
cmp eax, 0xef86b803
jne 0x412ac0
mov eax, dword [esi + 0x50]
mov dword [eax], 0x400
mov eax, dword [esi + 0x50]
mov eax, dword [esi + 0x34]
mov dword [esi + 0x28], 0x5ba264c9
jmp 0x412ac0
cmp eax, 0xf9e5e02a
jg 0x4134a9
cmp eax, 0xf4152996
jne 0x412ac0
mov eax, dword [esi + 0x44]
mov eax, dword [eax + 0x10]
sub esp, 4
mov dword [esp], eax
call fcn.00416c3b
add esp, 4
mov dword [esi + 0x28], 0x98170cc0
jmp 0x412ac0
cmp eax, 0xfd1a45e4
jg 0x4134c7
cmp eax, 0xf9e5e02b
jne 0x412ac0
mov dword [esi + 0x28], 0x65eb5b6c
jmp 0x412ac0
cmp eax, 0xfe406b6f
jg 0x4134e5
cmp eax, 0xfd1a45e5
jne 0x412ac0
mov dword [esi + 0x28], 0x7af5713c
jmp 0x412ac0
cmp eax, 0xfe77151d
jg 0x413511
cmp eax, 0xfe406b70
jne 0x412ac0
mov ecx, dword [esi + 0x34]
mov eax, 0xfe77151e
cmp dword [ecx], 0
jne 0x413509
mov eax, 0x434fc126
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0x5aa6834
jg 0x41352f
cmp eax, 0xfe77151e
jne 0x412ac0
mov dword [esi + 0x28], 0x5ba264c9
jmp 0x412ac0
cmp eax, 0xe84d547
jg 0x413554
cmp eax, 0x5aa6835
jne 0x412ac0
mov eax, dword [sym.imp.ADVAPI32.dll_CopySid]
mov edi, dword [eax]
mov dword [esi + 0x28], 0x4fe2620c
jmp 0x412ac0
cmp eax, 0x10667754
jg 0x41357a
cmp eax, 0xe84d548
jne 0x412ac0
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x40]
mov dword [ecx], eax
mov dword [esi + 0x28], 0xd7cd744f
jmp 0x412ac0
cmp eax, 0x176d85d4
jg 0x4135cc
cmp eax, 0x10667755
jne 0x412ac0
mov eax, dword [esi + 0x44]
mov ecx, dword [eax]
mov eax, dword [esi + 0x44]
add ecx, dword [eax + 4]
mov eax, 0x300
shl eax, cl
neg eax
mov ecx, 0x736
sub ecx, eax
add ecx, ecx
sub esp, 4
mov dword [esp], ecx
call fcn.00418030
add esp, 4
mov ecx, dword [esi + 0x44]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x28], 0xdbf4b787
jmp 0x412ac0
cmp eax, 0x1948e535
jg 0x4135ea
cmp eax, 0x176d85d5
jne 0x412ac0
mov dword [esi + 0x28], 0xd69f7f47
jmp 0x412ac0
cmp eax, 0x20ceaa5a
jg 0x413616
cmp eax, 0x1948e536
jne 0x412ac0
mov ecx, dword [esi + 0x68]
mov eax, 0x2133ce5a
cmp dword [ecx], 0
jne 0x41360e
mov eax, 0xb9ac0719
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0x2133ce59
jg 0x413648
cmp eax, 0x20ceaa5b
jne 0x412ac0
call fcn.0040e4c0
mov ecx, dword [esi + 0x44]
mov eax, 0xb4a52725
cmp dword [ecx + 0xc], 0
jne 0x413640
mov eax, 0x69faefb1
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0x21e62832
jg 0x413666
cmp eax, 0x2133ce5a
jne 0x412ac0
mov dword [esi + 0x28], 0x7af5713c
jmp 0x412ac0
cmp eax, 0x24bd8e5a
jg 0x413698
cmp eax, 0x21e62833
jne 0x412ac0
mov eax, dword [esi + 0x44]
mov eax, dword [eax + 0x14]
sub esp, 4
mov dword [esp], eax
call fcn.00416c3b
add esp, 4
mov dword [esi + 0x28], 0xe218e766
jmp 0x412ac0
cmp eax, 0x28bf9a5b
jg 0x4136b6
cmp eax, 0x24bd8e5b
jne 0x412ac0
mov dword [esi + 0x28], 0x6325ed88
jmp 0x412ac0
cmp eax, 0x2bed0337
jg 0x4136de
cmp eax, 0x28bf9a5c
jne 0x412ac0
mov eax, dword [esi + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esi + 0x58]
mov dword [ecx], eax
mov dword [esi + 0x28], 0x8024c44a
jmp 0x412ac0
cmp eax, 0x2c92545e
jg 0x413709
cmp eax, 0x2bed0338
jne 0x412ac0
mov al, byte [esi + 0x78]
test al, al
mov eax, 0x20ceaa5b
jne 0x413701
mov eax, 0xf9e5e02b
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0x2d08677d
jg 0x41378f
cmp eax, 0x2c92545f
jne 0x412ac0
mov eax, dword [esi + 0x50]
mov eax, dword [eax]
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x48]
mov edx, dword [edx]
add edx, dword [ecx]
mov ecx, dword [esi + 0x6c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00402ad0
add esp, 0xc
mov eax, dword [esi + 0x50]
xor ecx, ecx
sub ecx, dword [eax]
mov eax, dword [esi + 0x48]
sub ecx, dword [eax]
neg ecx
mov eax, dword [esi + 0x48]
mov dword [eax], ecx
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x34]
mov ecx, dword [ecx]
add ecx, 0x3536109f
sub ecx, dword [eax]
add ecx, 0xcac9ef61
mov eax, dword [esi + 0x34]
mov dword [eax], ecx
mov eax, dword [esi + 0x50]
mov eax, dword [eax]
mov ecx, dword [esi + 0x54]
mov dword [ecx], eax
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x3c]
mov dword [ecx], eax
mov dword [esi + 0x28], 0x434fc126
jmp 0x412ac0
cmp eax, 0x434fc125
jg 0x4137ba
cmp eax, 0x2d08677e
jne 0x412ac0
mov al, byte [esi + 0x7a]
test al, al
mov eax, 0xc5e18c3c
jne 0x4137b2
mov eax, 0xa142fa5c
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0x47908e08
jg 0x4138a3
cmp eax, 0x434fc126
jne 0x412ac0
mov eax, dword [esi + 0x54]
cmp dword [eax], 0
sete al
movzx eax, al
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x58]
mov eax, dword [ecx]
mov dword [esi + 0x20], eax
mov edx, dword [esi + 0x40]
mov eax, dword [edx]
mov dword [esi + 0x1c], eax
mov edi, dword [esi + 0x54]
mov eax, dword [edi]
mov dword [esi + 0x18], eax
mov ebx, dword [esi + 0x3c]
mov ebx, dword [ebx]
mov edx, dword [esi + 0x44]
mov ecx, dword [esi + 0x5c]
mov eax, dword [esi + 0x60]
sub esp, 0x20
mov edi, dword [esi + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esi + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.00413e70
add esp, 0x20
mov ecx, dword [esi + 0x68]
mov dword [ecx], eax
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x54]
mov ecx, dword [ecx]
mov edx, 0xbd5147
add ecx, edx
sub ecx, dword [eax]
add ecx, 0xff42aeb9
mov eax, dword [esi + 0x54]
mov dword [eax], ecx
mov eax, dword [esi + 0x5c]
mov eax, dword [eax]
mov ecx, dword [esi + 0x3c]
add eax, dword [ecx]
mov ecx, dword [esi + 0x3c]
mov dword [ecx], eax
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x58]
mov ecx, dword [ecx]
sub ecx, dword [eax]
mov eax, dword [esi + 0x58]
mov dword [eax], ecx
mov eax, dword [esi + 0x60]
mov eax, dword [eax]
mov ecx, dword [esi + 0x40]
add eax, dword [ecx]
mov ecx, dword [esi + 0x40]
mov dword [ecx], eax
mov ecx, dword [esi + 0x58]
mov eax, 0xb379073a
cmp dword [ecx], 0
je 0x41389b
mov eax, 0x1948e536
mov dword [esi + 0x28], eax
jmp 0x412ac0
cmp eax, 0x47deb97f
jg 0x4138c1
cmp eax, 0x47908e09
jne 0x412ac0
mov dword [esi + 0x28], 0xd69f7f47
jmp 0x412ac0
cmp eax, 0x4f7c29b6
jg 0x4138e6
cmp eax, 0x47deb980
jne 0x412ac0
mov eax, dword [sym.imp.ADVAPI32.dll_CopySid]
mov edi, dword [eax]
mov dword [esi + 0x28], 0x5aa6835
jmp 0x412ac0
cmp eax, 0x4fe2620b
jg 0x413904
cmp eax, 0x4f7c29b7
jne 0x412ac0
mov dword [esi + 0x28], 0xf4152996
jmp 0x412ac0
cmp eax, 0x582ee832
jg 0x413922
cmp eax, 0x4fe2620c
jne 0x412ac0
mov dword [esi + 0x28], 0x7af5713c
jmp 0x412ac0
cmp eax, 0x5ba264c8
jg 0x41394a
cmp eax, 0x582ee833
jne 0x412ac0
mov eax, dword [esi + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esi + 0x50]
mov dword [ecx], eax
mov dword [esi + 0x28], 0xe6e0383d
jmp 0x412ac0
cmp eax, 0x5e1137c2
jg 0x413981
cmp eax, 0x5ba264c9
jne 0x412ac0
mov eax, dword [esi + 0x50]
mov dword [eax], 0x400
mov eax, dword [esi + 0x50]
mov eax, dword [eax]
mov ecx, dword [esi + 0x34]
cmp dword [ecx], eax
setb al
mov byte [esi + 0x79], al
mov dword [esi + 0x28], 0xa5fb3675
jmp 0x412ac0
cmp eax, 0x6325ed87
jg 0x4139a2
cmp eax, 0x5e1137c3
jne 0x412ac0
mov eax, dword [esi + 0x58]
mov dword [esi + 0x28], 0x711a0850
jmp 0x412ac0
cmp eax, 0x64e12650
jg 0x4139ca
cmp eax, 0x6325ed88
jne 0x412ac0
mov eax, dword [esi + 0x34]
mov eax, dword [eax]
mov ecx, dword [esi + 0x50]
mov dword [ecx], eax
mov dword [esi + 0x28], 0x69d94228
jmp 0x412ac0
cmp eax, 0x65eb5b6b
jg 0x4139e8
cmp eax, 0x64e12651
jne 0x412ac0
mov dword [esi + 0x28], 0x5aa6835
jmp 0x412ac0
cmp eax, 0x65eb5b6c
je 0x413a02
cmp eax, 0x69d94228
jne 0x413a0e
mov dword [esi + 0x28], 0x2c92545f
jmp 0x412ac0
mov dword [esi + 0x28], 0xfd1a45e5
jmp 0x412ac0
cmp eax, 0x69faefb1
jne 0x412ac0
mov eax, dword [esi + 0x44]
mov dword [eax + 0x14], 0
mov dword [esi + 0x28], 0xe907c026
jmp 0x412ac0
mov eax, dword [esi + 0x64]
mov eax, dword [eax]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret