Function at 0x4020bc
Capabilities:
Get token membership
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
inc esi
push ecx
push ecx
push esi
push ecx
mov dword [ebp - 0x28], edi
mov ebx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x20000
push esi
call fcn.00408275
push eax
call dword [sym.imp.msvcrt.dll__fileno]
pop ecx
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__setmode]
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x402122
push 0x4011e8
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
xor ecx, ecx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
test eax, eax
je 0x4023d6
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 8], ebx
je 0x4023d6
cmp dword [ebp + 8], 2
jge 0x40218e
push 0x40001001
jmp 0x4023db
push 2
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
jns 0x4021a7
push 0x4000100e
jmp 0x4023db
mov eax, esi
mov dword [ebp - 8], eax
mov edi, dword [edi + eax*4]
movzx eax, word [edi]
cmp eax, 0x2d
je 0x4021c0
cmp eax, 0x2f
jne 0x4023c3
add edi, 2
push 0x40121c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4021e4
test ebx, ebx
jne 0x4023c3
mov ebx, esi
jmp 0x4022f8
push 0x40122c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x402206
test ebx, ebx
jne 0x4023c3
push 2
pop ebx
jmp 0x4022f8
push 8
push 0x401244
push edi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40223e
test ebx, ebx
jne 0x4023c3
push 0x3d
pop eax
cmp word [edi + 0x10], ax
jne 0x4023c3
lea ecx, [edi + 0x12]
push 3
mov dword [ebp - 0x1c], ecx
pop ebx
jmp 0x4022fb
push 0xa
push 0x401258
push edi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40226f
test ebx, ebx
jne 0x4023c3
push 0x3d
pop eax
cmp word [edi + 0x14], ax
jne 0x4023c3
lea ecx, [edi + 0x16]
push 4
jmp 0x402235
push 0xa
push 0x401270
push edi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40229c
push 0x3d
pop eax
cmp word [edi + 0x14], ax
jne 0x4023c3
mov ecx, dword [ebp - 0x1c]
add edi, 0x16
mov dword [ebp - 0x20], edi
jmp 0x4022fe
push 9
push 0x401288
push edi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4022cc
push 0x3d
pop eax
cmp word [edi + 0x12], ax
jne 0x4023c3
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + 0x14]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
jmp 0x402301
push 0xa
push 0x40129c
push edi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4023c3
push 0x3d
pop eax
cmp word [edi + 0x14], ax
jne 0x4023c3
lea edx, [edi + 0x16]
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
mov edx, dword [ebp - 0x24]
jge 0x40231a
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x28]
jmp 0x4021ac
test ebx, ebx
je 0x4023c3
cmp ebx, 4
je 0x40232c
cmp ebx, 3
jne 0x402342
test ecx, ecx
je 0x4023c3
xor edx, edx
cmp word [ecx], dx
mov edx, dword [ebp - 0x24]
je 0x4023c3
xor ecx, ecx
test edi, edi
je 0x402356
cmp word [edi], cx
je 0x4023c3
test eax, eax
je 0x4023c3
cmp word [eax], cx
je 0x4023c3
test eax, eax
je 0x402368
cmp word [eax], cx
je 0x4023c3
test edi, edi
je 0x4023c3
cmp word [edi], cx
je 0x4023c3
test edx, edx
je 0x4023ae
cmp word [edx], cx
je 0x4023c3
test eax, eax
je 0x4023c3
test edi, edi
je 0x4023c3
push 0x4012b4
push 0x4012b8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x4023a0
mov eax, dword [ebp - 0x24]
push eax
push 0x4012e4
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x4023ab
push 0x40001014
call fcn.00402718
pop ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
push eax
push edi
call fcn.0040250e
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x4023ce
push 0x40001001
call fcn.00402718
pop ecx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
jmp 0x4023e1
push 0x40001005
call fcn.00402718
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407be0
leave
ret