Function at 0x401438
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
push edi
mov dword [ebp - 0x110], 0
jmp 0x40145d
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
cmp ecx, dword [0x479584]
jae 0x4014a0
mov edx, dword [ebp - 0x110]
mov eax, dword [0x479580]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40149e
mov ecx, dword [ebp - 0x110]
mov edx, dword [0x479580]
mov eax, dword [edx + ecx*4]
jmp 0x401939
jmp 0x40144e
push 0x1c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x320], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov dword [ebp - 0x42c], eax
mov edx, dword [ebp - 0x42c]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x320]
mov ecx, dword [ebp - 0x540]
mov dword [eax], ecx
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x320]
mov edx, dword [ecx]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ax, word [0x478210]
mov word [ebp - 0x428], ax
mov cl, byte [0x478212]
mov byte [ebp - 0x426], cl
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x425]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0x104
mov dword [ebp - 0x114], 0x104
mov edx, dword [ebp - 0x320]
add edx, 0x18
push edx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x426]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x401686
mov eax, dword [ebp - 0x320]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x544], ecx
mov edx, dword [ebp - 0x544]
sub edx, 1
mov dword [ebp - 0x544], edx
cmp dword [ebp - 0x544], 5
ja case.0x4015aa.1
mov eax, dword [ebp - 0x544]
jmp dword [eax*4 + 0x40193e]
lea ecx, [ebp - 0x10c]
push ecx
push 0x478214
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x401668
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x426]
push ecx
push 0x478218
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x401668
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x426]
push ecx
push 0x478220
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x401668
movsx eax, byte [ebp - 0x426]
test eax, eax
je 0x40164c
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x426]
push edx
push 0x478230
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x401668
lea ecx, [ebp - 0x10c]
push ecx
push 0x478238
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
mov ecx, dword [ebp - 0x320]
mov dword [ecx + 4], eax
jmp 0x401839
cmp dword [ebp + 0xc], 0
je 0x4017cd
mov edx, dword [ebp - 0x320]
add edx, 0x18
push edx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x426]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x4017cd
mov edx, dword [ebp - 0x320]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x548], eax
mov ecx, dword [ebp - 0x548]
sub ecx, 1
mov dword [ebp - 0x548], ecx
cmp dword [ebp - 0x548], 5
ja case.0x4016f4.1
mov edx, dword [ebp - 0x548]
jmp dword [edx*4 + 0x401956]
lea eax, [ebp - 0x10c]
push eax
push 0x47823c
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x4017b2
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x426]
push eax
push 0x478240
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x4017b2
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x426]
push eax
push str._s_s_Deleted_
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x4017b2
movsx edx, byte [ebp - 0x426]
test edx, edx
je 0x401796
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x426]
push ecx
push 0x478258
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x4017b2
lea eax, [ebp - 0x10c]
push eax
push 0x478260
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
mov ecx, dword [ebp - 0x320]
mov dword [ecx + 4], eax
jmp 0x401839
call fcn.0040103f
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x401810
push str.Power_Users
lea eax, [ebp - 0x31c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
mov edx, dword [ebp - 0x320]
mov dword [edx + 4], eax
jmp 0x401839
mov eax, dword [ebp + 8]
push eax
call fcn.004012b5
add esp, 4
mov ecx, dword [ebp - 0x320]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x320]
mov dword [edx + 0x18], 8
mov byte [ebp - 0x31c], 0
mov eax, dword [ebp - 0x320]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x320]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x320]
mov dword [edx + 0xc], 0
mov eax, dword [ebp - 0x320]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x320]
cmp dword [ecx + 0x18], 1
jne 0x4018b5
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x534], 0
cmp dword [ebp + 0xc], 0
je 0x4018b5
mov edx, dword [ebp + 0xc]
push edx
push str._s
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x530]
mov dword [ebp + 0xc], ecx
mov edx, dword [0x479584]
cmp edx, dword [0x479588]
jb 0x40190f
cmp dword [0x479588], 0
je 0x4018db
mov eax, dword [0x479588]
shl eax, 1
mov dword [ebp - 0x54c], eax
jmp 0x4018e5
mov dword [ebp - 0x54c], 0x400
mov ecx, dword [ebp - 0x54c]
mov dword [0x479588], ecx
mov edx, dword [0x479588]
shl edx, 2
push edx
mov eax, dword [0x479580]
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [0x479580], eax
mov ecx, dword [0x479584]
mov edx, dword [0x479580]
mov eax, dword [ebp - 0x320]
mov dword [edx + ecx*4], eax
mov ecx, dword [0x479584]
add ecx, 1
mov dword [0x479584], ecx
mov eax, dword [ebp - 0x320]
pop edi
mov esp, ebp
pop ebp
ret