Function at 0x1056b80
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x010657f0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x60], 0xffffffff
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x90], 0
mov byte [rsp + 0x91], 0
mov byte [rsp + 0x92], 0
mov byte [rsp + 0x93], 0
mov byte [rsp + 0x94], 0
mov byte [rsp + 0x95], 5
cmp qword [rsp + 0xc0], 0
jne 0x1056c1a
mov eax, 0x57
jmp 0x1056f62
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x68]
mov r8d, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1056c82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x3f0
je 0x1056c56
jmp 0x1056f0c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1056c82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
jmp 0x1056f0c
mov dword [rsp + 0x64], 0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1056cc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x7a
je 0x1056cc4
jmp 0x1056f0c
mov eax, dword [rsp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_malloc]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1056ceb
mov dword [rsp + 0x60], SQLFreeStmt
jmp 0x1056f0c
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x64]
mov r8, qword [rsp + 0x78]
mov edx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1056d22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
jmp 0x1056f0c
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1056d49
mov dword [rsp + 0x60], 0
jmp 0x1056f0c
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1056db5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
jmp 0x1056f0c
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1056ddc
mov dword [rsp + 0x60], 0xffffffff
jmp 0x1056f0c
mov dword [rsp + 0x64], 0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1056e1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x7a
je 0x1056e1e
jmp 0x1056f0c
mov eax, dword [rsp + 0x64]
mov rcx, rax
call qword [sym.imp.MSVCR80.dll_malloc]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x1056e45
mov dword [rsp + 0x60], SQLFreeStmt
jmp 0x1056f0c
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x64]
mov r8, qword [rsp + 0x70]
mov edx, 2
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1056e7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
jmp 0x1056f0c
mov dword [rsp + 0x98], 0
jmp 0x1056e9a
mov eax, dword [rsp + 0x98]
add eax, 1
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
cmp dword [rsp + 0x98], eax
jae 0x1056f04
mov eax, dword [rsp + 0x98]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + rax + 8]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1056f02
mov eax, dword [rsp + 0x98]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx + rax + 0x10]
and eax, 4
test eax, eax
je 0x1056ef8
mov dword [rsp + 0x60], 0
jmp 0x1056f0c
mov dword [rsp + 0x60], 0xffffffff
jmp 0x1056f0c
jmp 0x1056e89
mov dword [rsp + 0x60], 0xffffffff
cmp qword [rsp + 0x68], 0
je 0x1056f1f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x78], 0
je 0x1056f32
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.MSVCR80.dll_free]
cmp qword [rsp + 0x80], 0
je 0x1056f4b
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp qword [rsp + 0x70], 0
je 0x1056f5e
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCR80.dll_free]
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.010588f0
add rsp, 0xb8
ret