Function at 0x6886e0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0
push 0x1192b8
mov edx, dword [ebp - 4]
mov eax, 0x688928
call fcn.00683764
xor eax, eax
push ebp
push 0x688765
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x15], 1
cmp byte [ebp - 0x15], 0
je 0x688733
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x688733
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
jne 0x68875b
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x68875b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x688914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x688779
push 0
push 0x1cdabc
push 0
push 0x1cdabc
call fcn.00683710
push edx
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x68879c
cmp eax, dword [esp]
pop edx
pop eax
je 0x6888e9
xor eax, eax
push ebp
push 0x6888df
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffe955b3
push 0
push 0x16aa4d
call fcn.00683710
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x15e034
push 0
push 0x15e034
call fcn.00683710
push eax
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0040f7e8
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6888cb
xor eax, eax
push ebp
push 0x6888c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x6888b7
push ebp
call fcn.006885d0
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x6888ae
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*8 + 4]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x6888a6
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*8 + 8]
and eax, 0x10
cmp eax, 0x10
jne 0x688890
push 0
push 0x11093b
mov edx, dword [ebp - 4]
mov eax, 0x68897c
call fcn.00683764
jmp 0x6888ae
push 0
push 0x1aac4a
mov edx, dword [ebp - 4]
mov eax, 0x6889c8
call fcn.00683764
jmp 0x6888ae
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x688850
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6888cb
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040f7f8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6888e9
xor eax, eax
push ebp
push 0x68890a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x688914
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret