Function at 0x535900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x22c], 0x104
mov dword [ebp - 0x228], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x800
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x5359bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
test byte [0x9538a8], 8
je 0x5359aa
push esi
push str.Failed_to_get_the_thread_handle_for_the_currentthread._err___d._n
push 0xe0
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_get_cli_user_name_alloc
push dword [0x7d0124]
push 8
call fcn.004f21c0
add esp, 0x1c
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x535a2b
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
test eax, eax
jne 0x535a1b
call esi
push eax
call fcn.004f1a60
add esp, 4
mov edi, eax
test byte [0x9538a8], 1
je 0x535a9f
push edi
push str.Failed_to_impersonate._err___d._n
push 0xe9
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_get_cli_user_name_alloc
push dword [0x7d0124]
push 1
call fcn.004f21c0
add esp, 0x1c
jmp 0x535a9f
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x21c], 1
lea ecx, [ebp - 0x214]
push ecx
push 0
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x535b4a
call esi
mov esi, eax
push esi
call fcn.004f1a60
add esp, 4
mov edi, eax
cmp esi, 0x3f0
jne 0x535b13
cmp dword [ebp - 0x218], ebx
jne 0x535b13
test byte [0x9538a8], 8
je 0x535a99
push str.Thread_is_not_impersonating_and_has_no_token
push 0xf7
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_get_cli_user_name_alloc
push dword [0x7d0124]
push 8
call fcn.004f21c0
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x535ab0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x21c], 0
je 0x535c65
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x535c65
test byte [0x9538a8], 1
je 0x535b01
call esi
push eax
call fcn.004f1a60
push eax
push str.RevertToSelf_function_failed_with_error__d
push 0x12d
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_get_cli_user_name_alloc
push dword [0x7d0124]
push 1
call fcn.004f21c0
add esp, 0x20
call esi
push eax
call fcn.004f1a60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test byte [0x9538a8], 1
je 0x535a99
push edi
push str.Failed_to_open_the_thread_token._err___d._n
push 0xfc
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_cmdi_cmdi_process.c
push str.cmdi_get_cli_user_name_alloc
push dword [0x7d0124]
push 1
call fcn.004f21c0
add esp, 0x1c
jmp 0x535a99
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x535a9f
push 0x48494351
push dword [ebp - 0x210]
call fcn.004f3590
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x535a9f
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x210]
push ebx
push 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x535bd2
call esi
push eax
call fcn.004f1a60
add esp, 4
mov edi, eax
test byte [0x9538a8], 1
je 0x535a9f
push edi
push str.GetTokenInformation_failed._err___d.
push 0x10c
jmp 0x5359fc
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebx]
call fcn.005588c0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x535c0d
test byte [0x9538a8], 1
je 0x535a9f
push edi
push str.LookupAccountSid_failed._err___d._n
push 0x114
jmp 0x5359fc
mov eax, dword [ebp - 0x22c]
push 0x49494351
lea eax, [eax*2 + 2]
push eax
mov dword [ebp - 0x218], eax
call fcn.004f3590
mov edx, eax
add esp, 8
mov eax, dword [ebp - 0x224]
mov dword [eax], edx
test edx, edx
jne 0x535c44
lea edi, [edx + 0xc]
jmp 0x535a9f
mov ecx, dword [ebp - 0x218]
mov eax, ecx
shr eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push ecx
push edx
call fcn.004f38e0
add esp, 0x10
jmp 0x535a9f
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x535c7e
push ebx
call fcn.004f3570
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret