Function at 0x6ea348
Capabilities:
Get session integrity level

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, 0x6dde30
call fcn.00410180
xor eax, eax
push ebp
push 0x6ea5e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.00697e14
mov edx, dword [ebp - 0x14]
mov eax, 0x743588
call fcn.00409f0c
xor edx, edx
push ebp
push 0x6ea59a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x70b4a8]
cmp dword [eax], 0
jne 0x6ea3ba
mov ecx, 0x6ea604
mov dl, 1
mov eax, dword [0x6ba518]
call fcn.0042a864
call fcn.004091d8
mov eax, dword [0x70b238]
cmp byte [eax], 0
je 0x6ea41d
mov eax, 0x743584
call fcn.00409b1c
mov ecx, eax
mov edx, 0x6ea638
mov eax, dword [0x743588]
call fcn.00697d10
test al, al
je 0x6ea3fd
xor edx, edx
mov eax, dword [0x743584]
call fcn.00423ba4
mov edx, eax
mov eax, dword [0x6bb504]
call fcn.006be360
jmp 0x6ea41d
call sub.shell32.dll_IsUserAnAdmin
test eax, eax
jne 0x6ea41d
mov eax, dword [0x743588]
call fcn.006bc1e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ea5cc
call sub.shell32.dll_IsUserAnAdmin
test eax, eax
jne 0x6ea437
mov dl, 1
mov eax, dword [0x6ba8b4]
call fcn.006bf324
call fcn.004091d8
mov ecx, dword [0x743588]
mov dl, 1
mov eax, dword [0x6bb5b0]
call fcn.006be61c
mov eax, dword [0x70b6d0]
mov eax, dword [eax]
cmp byte [eax + 0x34], 1
jne 0x6ea4e4
mov eax, 0x74358c
call fcn.00409b1c
mov ecx, eax
mov edx, 0x6ea654
mov eax, dword [0x743588]
call fcn.00697d10
test al, al
je 0x6ea49b
mov eax, dword [0x74358c]
call fcn.00580db4
test al, al
je 0x6ea49b
mov eax, dword [0x70b6d0]
mov eax, dword [eax]
mov edx, dword [0x74358c]
call fcn.006bf094
jmp 0x6ea4e4
lea eax, [ebp - 0x18]
call fcn.00581b3c
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
call fcn.00580aa8
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.00577f08
test al, al
je 0x6ea4d2
mov ecx, 0x6ea66c
mov dl, 1
mov eax, dword [0x6ba744]
call fcn.0042a864
call fcn.004091d8
call fcn.006bc050
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ea5cc
mov eax, dword [0x70b478]
mov eax, dword [eax]
call fcn.0056cfbc
mov eax, dword [0x70b478]
mov eax, dword [eax]
mov dl, 1
call fcn.0056ee60
mov eax, dword [0x70b6d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
call fcn.006c0a80
mov eax, dword [0x70b6d0]
mov eax, dword [eax]
test byte [eax + 0x35], 8
je 0x6ea56c
mov eax, dword [0x70b6d0]
mov eax, dword [eax]
mov dl, 1
call fcn.006bedb8
mov eax, dword [0x70b6d0]
mov eax, dword [eax]
call fcn.006bf06c
test al, al
je 0x6ea55e
lea edx, [ebp - 0x20]
mov eax, dword [0x70b6d0]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
call fcn.0057ce68
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x6ba688]
call fcn.0042a864
call fcn.004091d8
mov eax, dword [0x70b6d0]
mov eax, dword [eax]
call fcn.006bee48
jmp 0x6ea590
mov ecx, dword [0x70af9c]
mov eax, dword [0x70b478]
mov eax, dword [eax]
mov edx, dword [0x6dc834]
call fcn.0056cfd4
mov eax, dword [0x70b478]
mov eax, dword [eax]
call fcn.0056d134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ea5cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ea5f0
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00409b7c
pop eax
jmp eax