Function at 0x1001325b
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x1002d1a8]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1002d1ac], 0xa
setl al
or al, cl
push eax
mov ecx, esp
push eax
mov esi, esp
push eax
mov edi, esp
sub esp, 0x44
mov ebx, esp
test al, al
je 0x10013281
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
test eax, eax
mov dword [ebp - 0x10], ecx
jne 0x100132c0
lea eax, [ebp - 0x14]
push eax
push 0xa
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x1001341e
xor eax, eax
mov dword [ecx], eax
mov dword [esi], eax
cmp dword [0x1002cec0], 6
jb 0x1001336a
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x14]
push esi
push 4
push edi
push 0x12
mov dword [ebp - 0x20], eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [0x1002d1ac], 0xa
jl 0x1001334a
mov ecx, dword [0x1002d1a8]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1001334a
mov ebx, dword [ebp - 0x20]
push esi
mov eax, 4
push eax
push edi
mov eax, 0x12
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push esi
mov eax, 4
push eax
push edi
mov eax, 0x12
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [0x1002d1ac], 0xa
jl 0x1001334a
mov ecx, dword [0x1002d1a8]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x10013306
test eax, eax
je 0x10013364
cmp dword [edi], 3
jne 0x10013364
push esi
push 4
push dword [ebp - 0x10]
push 0x13
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x1c]
cmp dword [ecx], 0
jne 0x1001337e
push ecx
push 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov ecx, dword [ebp - 0x10]
cmp dword [ecx], 0
je 0x10013418
mov dword [esi], 0x44
push esi
push ebx
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x100133ad
lea eax, [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov eax, dword [0x1002d1a8]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1002d1ac], 0xa
setl al
or al, cl
test al, al
je 0x100133ca
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d1ac], 0xa
jl 0x10013418
mov eax, dword [0x1002d1a8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10013418
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push esi
call edi
cmp dword [0x1002d1ac], 0xa
jl 0x10013418
mov eax, dword [0x1002d1a8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100133f9
cmp dword [ebp + 8], 0
je 0x10013429
mov eax, dword [ebp - 0x18]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d1ac], 0xa
jl 0x1001341e
mov eax, dword [0x1002d1a8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1001341e
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push esi
call edi
cmp dword [0x1002d1ac], 0xa
jl 0x1001341e
mov eax, dword [0x1002d1a8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10013452
jmp 0x1001341e