Function at 0x40f70a
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x41200c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
mov edi, ecx
push 0x4024fc
mov eax, 0xa1
lea esi, [ebp - 0x88]
mov dword [ebp - 0x60], edi
call fcn.0040df9a
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x48]
push ebx
push eax
mov dword [ebp - 0x54], ebx
mov esi, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
inc eax
push 4
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x94], 0x48
pop ecx
mov eax, 0x413478
mov byte [eax], bl
inc eax
dec ecx
jne 0x40f784
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x40f7b0
mov edi, 0x80070057
mov eax, 0xb0
mov dword [ebp - 0x88], edi
mov word [ebp - 0x82], ax
jmp 0x40f9f0
and dword [ebp - 0x88], ebx
mov eax, 0xb1
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x64]
push eax
push 4
lea eax, [ebp - 0x8c]
push eax
push 0x12
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40f7ec
call fcn.0040f196
mov edi, eax
mov eax, 0xb3
jmp 0x40f79e
and dword [ebp - 0x88], ebx
cmp dword [ebp - 0x8c], 3
mov eax, 0xb3
mov word [ebp - 0x84], ax
jne 0x40f8f1
lea eax, [ebp - 0x64]
push eax
push 4
lea eax, [ebp - 0x58]
push eax
push 0x13
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40f835
call fcn.0040f196
mov edi, eax
mov eax, 0xba
jmp 0x40f79e
mov esi, dword [ebp - 0x58]
and dword [ebp - 0x58], ebx
and dword [ebp - 0x88], ebx
mov eax, 0xbd
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x64]
push eax
push 4
lea eax, [ebp - 0x90]
push eax
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40f878
call fcn.0040f196
mov edi, eax
mov eax, 0xc0
jmp 0x40f79e
and dword [ebp - 0x88], ebx
cmp dword [ebp - 0x90], 1
mov eax, 0xc0
mov word [ebp - 0x84], ax
mov eax, dword [ebp - 0x54]
jne 0x40f8ce
test eax, eax
je 0x40f8a5
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x40f8a5
push eax
call edi
and dword [ebp - 0x54], ebx
lea eax, [ebp - 0x54]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x40f8c7
call fcn.0040f196
mov edi, eax
mov eax, 0xc6
jmp 0x40f79e
mov eax, 0xc6
jmp 0x40f92c
mov ecx, esi
xor esi, esi
mov dword [ebp - 0x58], ecx
test eax, eax
je 0x40f8e4
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x40f8e4
push eax
call edi
mov ecx, dword [ebp - 0x58]
and dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ecx
mov eax, 0xcb
jmp 0x40f92c
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x40f903
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x40f903
push eax
call edi
and dword [ebp - 0x54], ebx
lea eax, [ebp - 0x54]
push eax
push 2
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x40f927
call fcn.0040f196
mov edi, eax
mov eax, 0xd0
jmp 0x40f79e
mov eax, 0xd0
and dword [ebp - 0x88], ebx
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push reloc.KERNEL32.dll_InterlockedPopEntrySList
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x40f963
call fcn.0040f196
mov edi, eax
mov eax, 0xd7
jmp 0x40f79e
and dword [ebp - 0x88], ebx
mov eax, 0xd7
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40f99b
call fcn.0040f196
mov edi, eax
mov eax, 0xda
jmp 0x40f79e
mov eax, 0xda
mov word [ebp - 0x84], ax
mov eax, dword [ebp - 0x8c]
xor edi, edi
mov dword [ebp - 0x88], edi
dec eax
je 0x40f9db
dec eax
je 0x40f9ca
dec eax
jne 0x40f9ea
mov ebx, dword [ebp - 0x5c]
neg ebx
sbb ebx, ebx
add ebx, 4
jmp 0x40f9ea
xor ebx, ebx
cmp dword [ebp - 0x5c], ebx
sete bl
lea ebx, [ebx*4 + 2]
jmp 0x40f9ea
xor ebx, ebx
cmp dword [ebp - 0x5c], ebx
sete bl
lea ebx, [ebx*4 + 1]
mov dword [0x413478], ebx
test esi, esi
je 0x40fa00
cmp esi, reloc.ADVAPI32.dll_TraceMessage
je 0x40fa00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x40fa17
cmp ecx, reloc.ADVAPI32.dll_TraceMessage
je 0x40fa17
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x54], 0
lea eax, [ebp - 0x88]
call fcn.0040e073
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410d69
leave
ret