Function at 0x45215b
Capabilities:
Get token membership

Disassembly:
push 0x26c
mov eax, 0x4c8826
call fcn.00498256
xor ebx, ebx
push 0x110
lea eax, [ebp - 0x16c]
push ebx
push eax
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x170], 0x114
call fcn.0048e2b0
add esp, 0xc
lea eax, [ebp - 0x17c]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x452263
lea eax, [ebp - 0x278]
push eax
call fcn.00405267
lea eax, [ebp - 0x270]
push 0x4e3b90
push eax
mov dword [ebp - 4], ebx
call fcn.00405d69
pop ecx
pop ecx
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x278]
call fcn.004052f9
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x452204
mov eax, dword [eax + 4]
jmp 0x452207
add eax, 4
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00425a3b
push eax
lea eax, [ebp - 0x1f0]
push eax
mov byte [ebp - 4], 2
call fcn.004167e3
add esp, 0x10
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 0x10
jb 0x452237
mov eax, dword [eax + 4]
jmp 0x45223a
add eax, 4
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x194]
call fcn.0048ec72
push 0x4f7698
lea eax, [ebp - 0x194]
push eax
call fcn.0048febc
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x170]
push eax
mov dword [ebp - 4], 4
call dword [0x50cb00]
test eax, eax
jne 0x4522f8
lea eax, [ebp - 0x278]
push eax
call fcn.00405267
lea eax, [ebp - 0x270]
push 0x4e36a8
push eax
mov byte [ebp - 4], 5
call fcn.00405d69
pop ecx
pop ecx
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x278]
call fcn.004052f9
mov byte [ebp - 4], 6
cmp dword [eax + 0x18], 8
jb 0x4522cb
mov eax, dword [eax + 4]
jmp 0x4522ce
add eax, 4
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00425a3b
push eax
lea eax, [ebp - 0x1d4]
push eax
mov byte [ebp - 4], 7
call fcn.004167e3
add esp, 0x10
mov byte [ebp - 4], 8
jmp 0x45222c
cmp dword [ebp - 0x16c], 6
jb 0x452436
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x188]
push eax
push 4
lea eax, [ebp - 0x184]
push eax
push 0x12
push dword [ebp - 0x17c]
call esi
test eax, eax
jne 0x45239a
lea eax, [ebp - 0x278]
push eax
call fcn.00405267
lea eax, [ebp - 0x270]
push 0x4eb6dc
push eax
mov byte [ebp - 4], 9
call fcn.00405d69
pop ecx
pop ecx
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x278]
call fcn.004052f9
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x18], 8
jb 0x45236d
mov eax, dword [eax + 4]
jmp 0x452370
add eax, 4
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00425a3b
push eax
lea eax, [ebp - 0x1d4]
push eax
mov byte [ebp - 4], 0xb
call fcn.004167e3
add esp, 0x10
mov byte [ebp - 4], 0xc
jmp 0x45222c
cmp dword [ebp - 0x184], 3
jne 0x452436
lea eax, [ebp - 0x188]
push eax
push 4
lea eax, [ebp - 0x180]
push eax
push 0x13
push dword [ebp - 0x17c]
call esi
test eax, eax
jne 0x452436
lea eax, [ebp - 0x278]
push eax
call fcn.00405267
lea eax, [ebp - 0x270]
push 0x4eb6dc
push eax
mov byte [ebp - 4], 0xd
call fcn.00405d69
pop ecx
pop ecx
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x278]
call fcn.004052f9
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x18], 8
jb 0x452409
mov eax, dword [eax + 4]
jmp 0x45240c
add eax, 4
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00425a3b
push eax
lea eax, [ebp - 0x1d4]
push eax
mov byte [ebp - 4], 0xf
call fcn.004167e3
add esp, 0x10
mov byte [ebp - 4], 0x10
jmp 0x45222c
cmp dword [ebp - 0x180], ebx
jne 0x4524cc
lea eax, [ebp - 0x180]
push eax
push 1
push dword [ebp - 0x17c]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x4524cc
lea eax, [ebp - 0x278]
push eax
call fcn.00405267
lea eax, [ebp - 0x270]
push 0x4eb704
push eax
mov byte [ebp - 4], 0x11
call fcn.00405d69
pop ecx
pop ecx
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x278]
call fcn.004052f9
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x18], 8
jb 0x45249f
mov eax, dword [eax + 4]
jmp 0x4524a2
add eax, 4
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00425a3b
push eax
lea eax, [ebp - 0x1d4]
push eax
mov byte [ebp - 4], 0x13
call fcn.004167e3
add esp, 0x10
mov byte [ebp - 4], 0x14
jmp 0x45222c
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x15
push eax
mov dword [ebp - 0x188], 0x44
call fcn.00452122
test eax, eax
pop ecx
pop ecx
jne 0x45256d
lea eax, [ebp - 0x278]
push eax
call fcn.00405267
lea eax, [ebp - 0x270]
push str.CreateWellKnownSid
push eax
mov byte [ebp - 4], 0x16
call fcn.00405d69
pop ecx
pop ecx
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x278]
call fcn.004052f9
mov byte [ebp - 4], 0x17
cmp dword [eax + 0x18], 8
jb 0x452540
mov eax, dword [eax + 4]
jmp 0x452543
add eax, 4
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00425a3b
push eax
lea eax, [ebp - 0x1d4]
push eax
mov byte [ebp - 4], 0x18
call fcn.004167e3
add esp, 0x10
mov byte [ebp - 4], 0x19
jmp 0x45222c
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x180]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4525f9
lea eax, [ebp - 0x278]
push eax
call fcn.00405267
lea eax, [ebp - 0x270]
push 0x4eb74c
push eax
mov byte [ebp - 4], 0x1a
call fcn.00405d69
pop ecx
pop ecx
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x278]
call fcn.004052f9
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x18], 8
jb 0x4525cc
mov eax, dword [eax + 4]
jmp 0x4525cf
add eax, 4
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00425a3b
push eax
lea eax, [ebp - 0x1d4]
push eax
mov byte [ebp - 4], 0x1c
call fcn.004167e3
add esp, 0x10
mov byte [ebp - 4], 0x1d
jmp 0x45222c
cmp dword [ebp - 0x19c], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
setne byte [ebp - 0x175]
cmp dword [ebp - 0x184], ebx
je 0x45261c
push dword [ebp - 0x184]
call esi
cmp dword [ebp - 0x198], ebx
je 0x45262c
push dword [ebp - 0x198]
call esi
mov al, byte [ebp - 0x175]
call fcn.004982d9
ret