Function at 0x4015e0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x20]
push ebx
sub esp, 0x34
mov dword [ebp - 0x1c], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftPCHealthErrorReporting
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
sub esp, 0xc
test eax, eax
je 0x401830
mov eax, dword [sym.imp.advapi32.dll_RegDeleteValueA]
mov dword [ebp - 0x24], eax
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], 0
call sub.faultrep.dll_AddERExcludedApplicationA
sub esp, 4
mov esi, eax
call fcn.004019a0
mov dword [eax], 0x405107
mov dword [eax + 4], 0x55
mov eax, dword [ebx + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
xor eax, eax
test esi, esi
sete al
mov dword [esp + 4], str.got__d_and_0x_lx__expected_FALSE__n
mov dword [esp], eax
call fcn.004010f0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], 0x405005
call sub.faultrep.dll_AddERExcludedApplicationA
sub esp, 4
mov esi, eax
call fcn.004019a0
mov dword [eax], 0x405107
mov dword [eax + 4], 0x59
mov eax, dword [ebx + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
xor eax, eax
test esi, esi
sete al
mov dword [esp + 4], str.got__d_and_0x_lx__expected_FALSE__n
mov dword [esp], eax
call fcn.004010f0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], str.winetest_faultrep.exe
call sub.faultrep.dll_AddERExcludedApplicationA
mov dword [ebp - 0x14], 1
sub esp, 4
mov esi, eax
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [sym.imp.advapi32.dll_OpenProcessToken]
mov dword [esp + 4], 8
mov dword [esp], 0xffffffff
mov dword [ebp - 0x28], eax
call eax
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.advapi32.dll_GetTokenInformation]
sub esp, 0xc
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0x12
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x18]
sub esp, 0x14
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x2c], eax
call eax
sub esp, 4
cmp dword [ebp - 0x14], 3
jne 0x4017b8
call fcn.004019a0
mov dword [eax], 0x405107
mov dword [eax + 4], 0x61
mov eax, 1
test esi, esi
jne 0x401880
mov dword [esp + 8], esi
mov dword [esp + 4], str.AddERExcludedApplicationA_should_have_failed__got__d_n
mov dword [esp], eax
call fcn.004010f0
mov dword [esp + 4], str.winetest_faultrep.exe
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
call eax
mov eax, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 8
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004019a0
mov dword [eax], 0x405107
mov dword [eax + 4], 0x66
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.AddERExcludedApplicationA_failed__le0x_lx__n
call fcn.004010f0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], str.winetest_faultrep.exe
call sub.faultrep.dll_AddERExcludedApplicationA
sub esp, 4
mov esi, eax
call fcn.004019a0
mov dword [eax], 0x405107
mov dword [eax + 4], 0x6b
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.AddERExcludedApplicationA_failed__le0x_lx__n
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.004010f0
jmp 0x40177b
lea eax, [ebp - 0x1c]
mov dword [esp + 4], str.ExclusionList
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
mov ecx, dword [sym.imp.advapi32.dll_RegDeleteValueA]
sub esp, 0xc
mov dword [ebp - 0x24], ecx
test eax, eax
jne 0x40161f
mov dword [esp + 4], str.winetest_faultrep.exe
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, ecx
call eax
sub esp, 8
jmp 0x40161f
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov dword [esp], 0xffffffff
mov eax, dword [ebp - 0x28]
call eax
lea eax, [ebp - 0x10]
sub esp, 0xc
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0x18
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x18]
sub esp, 0x14
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
call eax
mov eax, dword [0x417030]
mov ecx, dword [ebp - 0x14]
sub esp, 4
test eax, eax
sete dl
xor eax, eax
test ecx, ecx
setne al
and eax, edx
jmp 0x401767