Function at 0x4110d3
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x414004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
mov edi, ecx
lea ecx, [ebp - 0x88]
push 0xa1
push 0x403fc0
mov dword [ebp - 0x60], edi
call fcn.0040facc
xor ebx, ebx
lea eax, [ebp - 0x48]
push 0x40
push ebx
push eax
mov dword [ebp - 0x54], ebx
mov esi, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x64], ebx
xor eax, eax
mov dword [ebp - 0x58], ebx
inc eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x8c], eax
push 4
mov dword [ebp - 0x90], eax
mov eax, 0x4144e8
mov dword [ebp - 0x94], 0x48
pop ecx
mov byte [eax], bl
inc eax
dec ecx
jne 0x41114d
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x411179
mov edi, 0x80070057
mov eax, 0xb0
mov dword [ebp - 0x88], edi
mov word [ebp - 0x82], ax
jmp 0x4113b9
and dword [ebp - 0x88], ebx
mov eax, 0xb1
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x64]
push eax
push 4
lea eax, [ebp - 0x8c]
push eax
push 0x12
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4111b5
call fcn.00410d32
mov edi, eax
mov eax, 0xb3
jmp 0x411167
and dword [ebp - 0x88], ebx
mov eax, 0xb3
cmp dword [ebp - 0x8c], 3
mov word [ebp - 0x84], ax
jne 0x4112ba
lea eax, [ebp - 0x64]
push eax
push 4
lea eax, [ebp - 0x58]
push eax
push 0x13
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4111fe
call fcn.00410d32
mov edi, eax
mov eax, 0xba
jmp 0x411167
mov esi, dword [ebp - 0x58]
mov eax, 0xbd
and dword [ebp - 0x58], ebx
and dword [ebp - 0x88], ebx
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x64]
push eax
push 4
lea eax, [ebp - 0x90]
push eax
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x411241
call fcn.00410d32
mov edi, eax
mov eax, 0xc0
jmp 0x411167
and dword [ebp - 0x88], ebx
mov eax, 0xc0
cmp dword [ebp - 0x90], 1
mov word [ebp - 0x84], ax
mov eax, dword [ebp - 0x54]
jne 0x411297
test eax, eax
je 0x41126e
cmp eax, 0xffffffff
je 0x41126e
push eax
call edi
and dword [ebp - 0x54], ebx
lea eax, [ebp - 0x54]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x411290
call fcn.00410d32
mov edi, eax
mov eax, 0xc6
jmp 0x411167
mov eax, 0xc6
jmp 0x4112f5
mov ecx, esi
xor esi, esi
mov dword [ebp - 0x58], ecx
test eax, eax
je 0x4112ad
cmp eax, 0xffffffff
je 0x4112ad
push eax
call edi
mov ecx, dword [ebp - 0x58]
and dword [ebp - 0x58], ebx
mov eax, 0xcb
mov dword [ebp - 0x54], ecx
jmp 0x4112f5
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4112cc
cmp eax, 0xffffffff
je 0x4112cc
push eax
call edi
and dword [ebp - 0x54], ebx
lea eax, [ebp - 0x54]
push eax
push 2
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x4112f0
call fcn.00410d32
mov edi, eax
mov eax, 0xd0
jmp 0x411167
mov eax, 0xd0
and dword [ebp - 0x88], ebx
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x41132c
call fcn.00410d32
mov edi, eax
mov eax, 0xd7
jmp 0x411167
and dword [ebp - 0x88], ebx
mov eax, 0xd7
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x411364
call fcn.00410d32
mov edi, eax
mov eax, 0xda
jmp 0x411167
mov eax, 0xda
xor edi, edi
mov word [ebp - 0x84], ax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x88], edi
dec eax
je 0x4113a4
dec eax
je 0x411393
dec eax
jne 0x4113b3
mov ebx, dword [ebp - 0x5c]
neg ebx
sbb ebx, ebx
add ebx, 4
jmp 0x4113b3
xor ebx, ebx
cmp dword [ebp - 0x5c], ebx
sete bl
lea ebx, [ebx*4 + 2]
jmp 0x4113b3
xor ebx, ebx
cmp dword [ebp - 0x5c], ebx
sete bl
lea ebx, [ebx*4 + 1]
mov dword [0x4144e8], ebx
test esi, esi
je 0x4113c9
cmp esi, 0xffffffff
je 0x4113c9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x4113e0
cmp ecx, 0xffffffff
je 0x4113e0
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x54], 0
lea ecx, [ebp - 0x88]
call fcn.0040fbc2
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004129cd
mov esp, ebp
pop ebp
ret