Function at 0x10010b94
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1002d1b0]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1002d1b4], 0xa
setl al
or al, cl
push eax
push eax
mov ecx, esp
push eax
mov esi, esp
test al, al
je 0x10010bba
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x10]
mov dword [eax], 0
push eax
push 8
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp dword [0x1002d1b4], 0xa
mov dword [ebp - 0x20], esi
jl 0x10010c6f
mov ecx, dword [0x1002d1b0]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10010c6f
xor edi, edi
dec edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x10]
push esi
mov eax, 8
push eax
push edi
call ebx
xor eax, eax
mov dword [ebp - 0x10], eax
push esi
mov eax, 8
push eax
push edi
call ebx
cmp dword [0x1002d1b4], 0xa
jl 0x10010c40
mov eax, dword [0x1002d1b0]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10010c06
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 8
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp dword [0x1002d1b4], 0xa
jl 0x10010c6f
mov ecx, dword [0x1002d1b0]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x10010c06
test eax, eax
je 0x10010e54
xor esi, esi
lea ebx, [ebp - 0x1c]
mov eax, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x1c], esi
mov edi, ebx
push ebx
push esi
push esi
push 1
push dword [ebp - 0x10]
call eax
mov ecx, dword [0x1002d1b0]
mov edx, dword [0x1002d1b4]
cmp edx, 0xa
jl 0x10010cc5
lea ebx, [ecx + 1]
imul ebx, ecx
and ebx, 1
je 0x10010cc5
mov dword [ebp - 0x1c], esi
mov ebx, edi
push edi
push esi
push esi
push 1
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov eax, edi
jmp 0x10010c81
xor ebx, ebx
test eax, eax
jne 0x10010f06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1002d1b0]
mov edx, dword [0x1002d1b4]
cmp edx, 0xa
jl 0x10010d17
lea esi, [ecx + 1]
imul esi, ecx
and esi, 1
je 0x10010d17
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
mov ecx, dword [0x1002d1b0]
mov edx, dword [0x1002d1b4]
cmp edx, 0xa
jl 0x10010d17
lea ebx, [ecx + 1]
imul ebx, ecx
and ebx, 1
jne 0x10010cf7
cmp eax, 0x7a
jne 0x10010ee1
mov esi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10010ed5
mov esi, eax
mov ecx, dword [ebp - 0x1c]
push edi
mov dword [ebp - 0x24], ecx
push ecx
push eax
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [0x1002d1b4], 0xa
mov dword [ebp - 0x14], esi
jl 0x10010db3
mov ecx, dword [0x1002d1b0]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10010db3
mov esi, dword [ebp - 0x14]
mov ebx, edi
push edi
push dword [ebp - 0x24]
push esi
xor eax, eax
inc eax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edi
push dword [ebp - 0x24]
push esi
xor eax, eax
inc eax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [0x1002d1b4], 0xa
jl 0x10010db3
mov ecx, dword [0x1002d1b0]
lea edx, [ecx + 1]
imul edx, ecx
xor ecx, ecx
inc ecx
and edx, ecx
jne 0x10010d71
test eax, eax
je 0x10010ee5
xor ecx, ecx
xorps xmm0, xmm0
movaps xmm1, xmmword [0x10024300]
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x18]
mov dword [eax], ecx
mov word [eax + 4], 0x500
mov dword [ebx], ecx
sub esp, 0x2c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ecx
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 4], xmm1
mov dword [esp], eax
call esi
cmp dword [0x1002d1b4], 0xa
jl 0x10010e5b
mov ecx, dword [0x1002d1b0]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10010e5b
xor eax, eax
mov dword [edi], eax
mov word [edi + 4], 0x500
mov dword [ebx], eax
sub esp, 0x2c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [0x10024300]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call esi
movaps xmm1, xmmword [0x10024300]
xorps xmm0, xmm0
mov eax, edi
xor ecx, ecx
jmp 0x10010dd6
xor ebx, ebx
jmp 0x10010f65
mov dword [ebp - 0x18], 0
test eax, eax
je 0x10010ec8
mov esi, dword [ebx]
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
cmp dword [0x1002d1b4], 0xa
jl 0x10010eb7
mov ecx, dword [0x1002d1b0]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10010eb7
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
push esi
push edi
call ebx
push esi
push edi
call ebx
cmp dword [0x1002d1b4], 0xa
jl 0x10010eb7
mov ecx, dword [0x1002d1b0]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x10010e95
test eax, eax
je 0x10010f6f
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ebx, dword [ebp - 0x18]
jmp 0x10010ee7
mov ecx, dword [0x1002d1b0]
mov edx, dword [0x1002d1b4]
xor ebx, ebx
jmp 0x10010f06
xor ebx, ebx
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1002d1b0]
mov edx, dword [0x1002d1b4]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp edx, 0xa
setl al
or al, cl
test al, al
je 0x10010f19
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d1b4], 0xa
jl 0x10010f65
mov eax, dword [0x1002d1b0]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10010f65
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push esi
call edi
cmp dword [0x1002d1b4], 0xa
jl 0x10010f65
mov eax, dword [0x1002d1b0]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10010f46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
push esi
mov eax, dword [ebp - 0x14]
push dword [eax]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp dword [0x1002d1b4], 0xa
mov ebx, dword [ebp - 0x20]
jl 0x10010ec8
mov eax, dword [0x1002d1b0]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10010ec8
mov edi, dword [ebp - 0x14]
push esi
push dword [edi]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
push esi
push dword [edi]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp dword [0x1002d1b4], 0xa
jl 0x10010fcd
mov eax, dword [0x1002d1b0]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10010fa4
push esi
mov eax, dword [ebp - 0x14]
push dword [eax]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp dword [0x1002d1b4], 0xa
jl 0x10010ec8
mov eax, dword [0x1002d1b0]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10010fa4
jmp 0x10010ec8