Function at 0x4a249e
Capabilities:
Get token membership

Disassembly:
push 0xd8
mov eax, 0x524e3d
call fcn.004d8af2
mov eax, edx
mov dword [ebp - 0xc0], eax
mov ebx, ecx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x80], ebx
lea ecx, [ebp - 0xbc]
and dword [ebp - 0xa4], 0
mov byte [eax], 0
call fcn.0040687a
and dword [ebp - 4], 0
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0xb8]
call fcn.0046c865
lea ecx, [ebp - 0x7c]
call fcn.0040687a
mov byte [ebp - 4], 2
cmp dword [ebp - 0xb8], 0
jge 0x4a25cc
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0x71], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 3
call fcn.0044f24f
push dword [ebp - 0xb4]
mov esi, dword [ebp - 0xb0]
mov edi, eax
push dword [ebp - 0xb8]
lea eax, [ebp - 0x90]
push esi
push str._ws_0x_08x___d
push eax
call fcn.004011e0
add esp, 0x10
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x80], esp
mov edx, str.Error_
push eax
call fcn.004093b4
mov ecx, esp
mov byte [ebp - 4], 5
push str.Silent.WinStaName
call fcn.00406fea
push 0
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0044ed57
mov ecx, dword [ebp - 0x90]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x71]
mov byte [ebp - 4], 2
call fcn.0044f694
lea eax, [ebp - 0xb8]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x7c]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [esi - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0xbc]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, ebx
jmp 0x4a2e04
mov edi, dword [ebp - 0xbc]
lea eax, [edi - 0x10]
mov ecx, eax
mov dword [ebp - 0x8c], eax
call fcn.004070e7
lea esi, [eax + 0x10]
mov dword [ebp - 0xc4], esi
mov edx, str.Service_
mov byte [ebp - 4], 6
mov ecx, esi
call fcn.0042981b
test al, al
je 0x4a262f
push str.Service_0x0_3e7_
push esi
call fcn.004e3849
pop ecx
pop ecx
test eax, eax
je 0x4a262f
mov esi, str.Service_xyz
push esi
call fcn.004ddaa2
pop ecx
push eax
push esi
lea ecx, [ebp - 0xc4]
call fcn.00406efb
mov esi, dword [ebp - 0xc4]
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0x71], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 7
call fcn.0044f24f
push ecx
mov dword [ebp - 0x90], eax
mov ebx, esp
lea eax, [esi - 0x10]
mov dword [ebp - 0x80], esp
mov ecx, eax
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x88], eax
call fcn.004070e7
add eax, 0x10
mov dword [ebx], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 8
push str.Silent.WinStaName
call fcn.00406fea
mov ecx, dword [ebp - 0x90]
xor ebx, ebx
push ebx
mov byte [ebp - 4], 7
call fcn.0044ed57
lea ecx, [ebp - 0x71]
mov byte [ebp - 4], 6
call fcn.0044f694
push str.WinSta0
push edi
call fcn.004e3849
pop ecx
pop ecx
test eax, eax
jne 0x4a26f5
mov esi, dword [ebp - 0x84]
lea ecx, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], ebx
call fcn.0040687a
mov ecx, dword [ebp - 0x88]
call fcn.00407189
mov ecx, dword [ebp - 0x7c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0xb0]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
jmp 0x4a2dfd
push 0x37f
push ebx
push str.WinSta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov edi, eax
test edi, edi
jne 0x4a2cea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x57d3ec]
mov ebx, eax
add ecx, 0x54
mov byte [ebp - 0x71], 1
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 9
call fcn.0044f24f
push ecx
mov ecx, esp
mov dword [ebp - 0x80], esp
push ebx
push str.Failed_open___d
push ecx
mov edi, eax
call fcn.004011e0
add esp, 8
mov byte [ebp - 4], 0xa
mov ecx, esp
push str.Silent.SwitchToWinSta0_0
call fcn.00406fea
push 0
mov ecx, edi
mov byte [ebp - 4], 9
call fcn.0044ed57
lea ecx, [ebp - 0x71]
mov byte [ebp - 4], 6
call fcn.0044f694
and dword [ebp - 0xac], 0
lea eax, [ebp - 0x70]
push 0x12
push 1
push 0x53d240
push eax
call fcn.004d6394
add esp, 0x10
mov dword [ebp - 0xa4], 0x20
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea ecx, [ebp - 0x70]
call fcn.004d6486
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0x71], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xb
call fcn.0044f24f
cmp dword [ebp - 0xac], 0
mov edi, eax
push ecx
mov edx, esp
mov dword [ebp - 0x80], esp
mov eax, str.non_SYSTEM
mov ecx, 0x552bb8
cmove ecx, eax
push ecx
push esi
push ebx
push str.Failed_open___d___ws___ws
push edx
call fcn.004011e0
add esp, 0x10
mov byte [ebp - 4], 0xc
mov ecx, esp
push str.Silent.SwitchToWinSta0._0.Detailed
call fcn.00406fea
push 0
mov ecx, edi
mov byte [ebp - 4], 0xb
call fcn.0044ed57
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x71]
call fcn.0044f694
cmp ebx, 5
je 0x4a2898
movzx ecx, bx
or ecx, 0x80070000
test ebx, ebx
push 0x508f
cmovle ecx, ebx
test ecx, ecx
mov eax, 0x80004005
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, dword [ebp - 0x84]
call fcn.00406620
mov ecx, dword [ebp - 0x88]
call fcn.00407189
mov ecx, dword [ebp - 0x7c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0xb0]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x8c]
call fcn.00407189
mov eax, dword [ebp - 0x84]
jmp 0x4a2e04
mov dl, 1
lea ecx, [ebp - 0xa0]
call fcn.0046c9b6
cmp dword [ebp - 0xa0], 0
mov ecx, dword [ebp - 0xc0]
sete al
mov byte [ebp - 0x71], 1
mov byte [ecx], al
mov eax, dword [0x57d3ec]
add eax, 0x54
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xe
call fcn.0044f24f
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0xc8], eax
test ecx, ecx
js 0x4a2939
push 0x10
pop edi
jne 0x4a28fd
push str.success
lea ecx, [ebp - 0x80]
call fcn.00406fea
mov byte [ebp - 4], 0xf
push 0x22
jmp 0x4a2912
push str.found__unexpected_
lea ecx, [ebp - 0x94]
call fcn.00406fea
mov dword [ebp - 4], edi
push 0x24
mov ecx, dword [eax]
pop ebx
sub ecx, edi
mov dword [ebp - 0xa4], ebx
call fcn.004070e7
lea edi, [eax + 0x10]
mov dword [ebp - 0xc0], edi
mov dword [ebp - 4], 0x11
or ebx, 8
mov ecx, edi
jmp 0x4a296c
push dword [ebp - 0x9c]
lea eax, [ebp - 0xcc]
push ecx
push dword [ebp - 0x98]
push str._ws_0x_08x___d
push eax
call fcn.004011e0
add esp, 0x14
mov dword [ebp - 4], 0x12
mov ecx, dword [eax]
mov edi, dword [ebp - 0xc0]
push 0x30
pop ebx
push ecx
mov dword [ebp - 0xa4], ebx
add ecx, 0xfffffff0
mov dword [ebp - 0x90], ebx
mov ebx, esp
mov dword [ebp - 0xa8], esp
mov dword [ebp - 0x78], ebx
call fcn.004070e7
add eax, 0x10
mov dword [ebx], eax
push ecx
mov ecx, esp
mov dword [ebp - 4], 0x13
push str.Silent.WinSta0AddAce
call fcn.00406fea
mov ecx, dword [ebp - 0xc8]
push 0
mov byte [ebp - 4], 0x12
call fcn.0044ed57
mov ebx, dword [ebp - 0x90]
test bl, 0x10
je 0x4a29d2
mov ecx, dword [ebp - 0xcc]
and ebx, 0xffffffef
lea ecx, [ecx - 0x10]
call fcn.00407189
test bl, 8
je 0x4a29e2
lea ecx, [edi - 0x10]
and ebx, 0xfffffff7
call fcn.00407189
test bl, 4
je 0x4a29f8
mov ecx, dword [ebp - 0x94]
and ebx, 0xfffffffb
lea ecx, [ecx - 0x10]
call fcn.00407189
mov dword [ebp - 4], 0xe
test bl, 2
je 0x4a2a0f
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x71]
call fcn.0044f694
mov ecx, dword [ebp - 0x98]
add ecx, 0xfffffff0
call fcn.00407189
push 0x37f
xor ebx, ebx
push ebx
push str.WinSta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov edi, eax
test edi, edi
jne 0x4a2cea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x57d3ec]
mov edi, eax
add ecx, 0x54
mov byte [ebp - 0x71], 1
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x14
call fcn.0044f24f
cmp dword [ebp - 0xac], 0
mov ebx, eax
push ecx
mov edx, esp
mov dword [ebp - 0x78], esp
mov eax, str.non_SYSTEM
mov ecx, 0x552bb8
cmove ecx, eax
push ecx
push esi
push edi
push str.Failed_open___d___ws___ws
push edx
call fcn.004011e0
add esp, 0x10
mov byte [ebp - 4], 0x15
mov ecx, esp
push str.Silent.SwitchToWinSta0._1.Detailed
call fcn.00406fea
push 0
mov ecx, ebx
mov byte [ebp - 4], 0x14
call fcn.0044ed57
lea ecx, [ebp - 0x71]
mov byte [ebp - 4], 6
call fcn.0044f694
xor ebx, ebx
lea eax, [ebp - 0x78]
push ebx
push ebx
push ebx
push 1
push eax
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0xa0]
call fcn.0045fdd3
add esp, 0x14
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0xa0], ebx
jge 0x4a2b5c
cmp dword [ebp - 0x9c], ebx
mov eax, 0x50a5
cmovne eax, dword [ebp - 0x9c]
push eax
push dword [ebp - 0xa0]
push ecx
mov esi, esp
mov dword [ebp - 0x78], esi
mov ecx, dword [ebp - 0x98]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0xd8]
mov dword [esi], eax
call fcn.00406620
mov ecx, dword [ebp - 0x84]
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x17
call fcn.0040121b
mov ecx, dword [ebp - 0xd0]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x98]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x4a285e
mov ecx, dword [ebp - 0x98]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0xd8]
call fcn.0046008f
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0xa0], 0
jge 0x4a2c0e
cmp dword [ebp - 0x9c], 0
mov eax, 0x50a7
cmovne eax, dword [ebp - 0x9c]
push eax
push dword [ebp - 0xa0]
push ecx
mov esi, esp
mov dword [ebp - 0x78], esi
mov edi, dword [ebp - 0x98]
lea ecx, [edi - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0xe4]
mov dword [esi], eax
call fcn.00406620
mov ecx, dword [ebp - 0x84]
lea eax, [ebp - 0xe4]
push eax
mov byte [ebp - 4], 0x1a
call fcn.0040121b
mov ecx, dword [ebp - 0xdc]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x4a285e
mov ecx, dword [ebp - 0x98]
add ecx, 0xfffffff0
call fcn.00407189
push 0x37f
push ebx
push str.WinSta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov edi, eax
test edi, edi
jne 0x4a2ce4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x57d3ec]
mov ebx, eax
add ecx, 0x54
mov byte [ebp - 0x71], 1
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1b
call fcn.0044f24f
cmp dword [ebp - 0xac], 0
mov edi, eax
push ecx
mov ecx, esp
mov dword [ebp - 0x78], esp
mov edx, str.non_SYSTEM
mov eax, 0x552bb8
cmove eax, edx
push eax
push esi
push ebx
push str.Failed_open___d___ws___ws
push ecx
call fcn.004011e0
add esp, 0x10
mov byte [ebp - 4], 0x1c
mov ecx, esp
push str.Silent.SwitchToWinSta0._2.Detailed
call fcn.00406fea
push 0
mov ecx, edi
mov byte [ebp - 4], 0x1b
call fcn.0044ed57
lea ecx, [ebp - 0x71]
call fcn.0044f694
movzx ecx, bx
mov eax, 0x80004005
or ecx, 0x80070000
test ebx, ebx
push 0x50ad
cmovle ecx, ebx
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, dword [ebp - 0x84]
call fcn.00406620
jmp 0x4a2c03
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push edi
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
jne 0x4a2d6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x57d3ec]
mov edi, eax
add ecx, 0x54
mov byte [ebp - 0x71], 1
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1d
call fcn.0044f24f
push ecx
mov ecx, esp
mov dword [ebp - 0x78], esp
push edi
push str.Failed_set___d
push ecx
mov esi, eax
call fcn.004011e0
add esp, 8
mov byte [ebp - 4], 0x1e
mov ecx, esp
push str.Silent.SwitchToWinSta0
call fcn.00406fea
push ebx
mov ecx, esi
mov byte [ebp - 4], 0x1d
call fcn.0044ed57
lea ecx, [ebp - 0x71]
call fcn.0044f694
movzx ecx, di
or ecx, 0x80070000
test edi, edi
push 0x50b7
cmovle ecx, edi
jmp 0x4a2840
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0x71], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1f
call fcn.0044f24f
push ecx
mov ecx, esp
mov dword [ebp - 0x78], esp
push str.success
mov esi, eax
call fcn.00406fea
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x20
push str.Silent.SwitchToWinSta0
call fcn.00406fea
push ebx
mov ecx, esi
mov byte [ebp - 4], 0x1f
call fcn.0044ed57
lea ecx, [ebp - 0x71]
call fcn.0044f694
mov esi, dword [ebp - 0x84]
lea ecx, [esi + 8]
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0040687a
mov ecx, dword [ebp - 0x88]
call fcn.00407189
mov ecx, dword [ebp - 0x7c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0xb0]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x8c]
call fcn.00407189
mov eax, esi
call fcn.004d8aa1
ret