Function at 0x4302e1
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x6c8370]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x168], 0
lea eax, [ebp - 0x158]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x170], ecx
and dword [ebp - 0x16c], esi
and dword [ebp - 0x164], esi
and dword [ebp - 0x160], esi
push 0x110
push esi
push eax
mov dword [ebp - 0x15c], 0x114
call fcn.004f3cc0
add esp, 0xc
lea eax, [ebp - 0x16c]
push eax
push 0xa
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43035d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x43052e
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x430350
cmp dword [ebp - 0x158], 6
jb 0x4303c2
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x160]
push eax
push 4
lea eax, [ebp - 0x174]
push eax
push 0x12
push dword [ebp - 0x16c]
call edi
test eax, eax
je 0x430350
cmp dword [ebp - 0x174], 3
jne 0x4303c2
lea eax, [ebp - 0x160]
push eax
push 4
lea eax, [ebp - 0x164]
push eax
push 0x13
push dword [ebp - 0x16c]
call edi
test eax, eax
je 0x430350
cmp dword [ebp - 0x164], esi
jne 0x4303e7
lea eax, [ebp - 0x164]
push eax
push 1
push dword [ebp - 0x16c]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x430350
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x160], 0x44
push eax
push 0
push 0x1a
call ebx
test eax, eax
je 0x430511
mov edi, dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x164]
call edi
test eax, eax
je 0x430511
cmp dword [ebp - 0x168], esi
mov ecx, dword [ebp - 0x170]
setne al
mov dword [ebp - 0x160], 0x44
mov byte [ecx], al
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x1b
call ebx
test eax, eax
je 0x430511
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x164]
call edi
test eax, eax
je 0x430511
cmp dword [ebp - 0x168], esi
mov ecx, dword [ebp - 0x170]
setne al
mov dword [ebp - 0x160], 0x44
mov byte [ecx + 1], al
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x1c
call ebx
test eax, eax
je 0x430511
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x164]
call edi
test eax, eax
je 0x430511
cmp dword [ebp - 0x168], esi
mov ecx, dword [ebp - 0x170]
setne al
mov dword [ebp - 0x160], 0x44
mov byte [ecx + 2], al
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x1d
call ebx
test eax, eax
je 0x430511
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x164]
call edi
test eax, eax
jne 0x43051b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x43052d
cmp dword [ebp - 0x168], esi
mov ecx, dword [ebp - 0x170]
setne al
mov byte [ecx + 3], al
pop ebx
cmp dword [ebp - 0x16c], 0
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x43054c
push dword [ebp - 0x16c]
call edi
and dword [ebp - 0x16c], 0
cmp dword [ebp - 0x164], 0
je 0x43055d
push dword [ebp - 0x164]
call edi
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.004da18b
mov esp, ebp
pop ebp
ret