Function at 0x4a75f0
Capabilities:
Compare security identifiers
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov edx, dword [0x52718c]
mov eax, dword [str.ACCOUNT_OPERATORS]
mov dword [esp + 0x24], edx
mov edx, dword [str.SERVER_OPERATORS]
mov ecx, dword [0x527188]
mov dword [esp + 0x2e], edx
mov edx, dword [0x52717c]
mov dword [esp + 0x1c], eax
mov eax, dword [0x527190]
mov dword [esp + 0x3a], edx
mov edx, dword [0x527160]
mov dword [esp + 0x28], eax
mov eax, dword [0x527174]
mov dword [esp + 0x44], edx
mov dx, word [0x52716c]
mov dword [esp + 0x20], ecx
mov cx, word [0x527194]
mov word [esp + 0x50], dx
mov edx, dword [0x527150]
mov dword [esp + 0x32], eax
mov al, byte [0x527180]
mov word [esp + 0x2c], cx
mov ecx, dword [0x527178]
push ebx
mov dword [esp + 0x5e], edx
push esi
mov byte [esp + 0x46], al
mov eax, dword [0x527164]
lea edx, [esp + 0x14]
push edi
xor ebx, ebx
mov dword [esp + 0x42], ecx
mov ecx, dword [str.PRINTER_OPERATORS]
push edx
mov dword [esp + 0x58], eax
mov eax, dword [str.BACKUP_OPERATORS]
push ebx
mov dword [esp + 0x54], ecx
mov ecx, dword [0x527168]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push ebx
mov dword [esp + 0x6e], eax
mov eax, dword [0x527154]
push ebx
mov dword [esp + 0x6c], ecx
mov ecx, dword [0x52714c]
push ebx
push ebx
mov dword [esp + 0x86], eax
push 0x224
mov dword [esp + 0x82], ecx
mov cl, byte [0x527158]
push 0x20
lea eax, [esp + 0x34]
push 2
push eax
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 5
mov byte [esp + 0x77], bl
mov byte [esp + 0x9a], cl
mov byte [esp + 0x9b], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4a7725
push str.AllocateAndInitializeSid
call edi
push eax
call fcn.004a7590
add esp, 8
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x225
push 0x20
push 2
push edx
call esi
test eax, eax
jne 0x4a7754
push str.AllocateAndInitializeSid
call edi
push eax
call fcn.004a7590
add esp, 8
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x226
push 0x20
push 2
push ecx
call esi
test eax, eax
jne 0x4a7783
push str.AllocateAndInitializeSid
call edi
push eax
call fcn.004a7590
add esp, 8
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x227
push 0x20
push 2
push eax
call esi
test eax, eax
jne 0x4a77b2
push str.AllocateAndInitializeSid
call edi
push eax
call fcn.004a7590
add esp, 8
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 5
push 2
push edx
call esi
test eax, eax
jne 0x4a77dd
push str.AllocateAndInitializeSid
call edi
push eax
call fcn.004a7590
add esp, 8
mov eax, dword [esp + 0x88]
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
push ebp
mov ebp, dword [esp + 0x78]
mov dword [eax], 4
lea esi, [esp + 0x1c]
mov ecx, dword [esi]
push ecx
push ebp
call edi
test eax, eax
jne 0x4a7814
inc ebx
add esi, 4
cmp ebx, 4
jl 0x4a77f9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4a7838
mov ecx, dword [esp + 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebx + ebx*8]
lea eax, [esp + edx*2 + 0x2c]
push eax
push ecx
call esi
mov edx, dword [esp + 0x84]
push str.BUILTIN
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_EqualPrefixSid]
test eax, eax
pop ebp
je 0x4a7855
mov ecx, dword [esp + 0x78]
push str.LOGON_SID
push ecx
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_FreeSid]
lea esi, [esp + 0x18]
mov edi, 4
mov edx, dword [esi]
push edx
call ebx
add esi, 4
dec edi
jne 0x4a7864
mov eax, dword [esp + 0xc]
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x64
ret