Function at 0x417c2c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
mov eax, 0x4d2d0c
push ebx
push esi
push edi
call fcn.004865d0
mov word [ebp - 0x34], 8
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x48], eax
xor esi, esi
mov word [ebp - 0x34], 8
mov dword [ebp - 0x4c], edx
xor eax, eax
mov edx, dword [0x4d1810]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], edx
lea ecx, [ebp - 0x48]
mov dx, word [0x4d1814]
mov word [ebp - 0x54], dx
push ecx
push 0x20008
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x417e00
lea eax, [ebp - 0x50]
push eax
push 0
push esi
push 2
mov edx, dword [ebp - 0x48]
push edx
call sub.ADVAPI32.DLL_GetTokenInformation
mov word [ebp - 0x34], 0x14
mov esi, dword [ebp - 0x50]
xor eax, eax
inc dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 8], ecx
inc dword [ebp - 0x28]
test esi, esi
je 0x417ce3
cmp esi, 0x80
jbe 0x417cd8
push esi
call fcn.004852d0
pop ecx
mov edi, eax
jmp 0x417ce5
push esi
call fcn.004a6014
pop ecx
mov edi, eax
jmp 0x417ce5
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
add eax, esi
mov dword [ebp - 8], eax
inc dword [ebp - 0x28]
dec dword [ebp - 0x28]
mov byte [ebp - 0x59], 0
mov edi, dword [ebp - 0x18]
mov edx, esi
add edx, edi
mov dword [ebp - 0x60], edx
mov cl, byte [ebp - 0x59]
mov byte [ebp - 0x61], cl
mov eax, dword [ebp - 0x60]
sub eax, edi
push eax
xor edx, edx
mov dl, byte [ebp - 0x61]
push edx
push edi
call fcn.004860f0
add edi, esi
add esp, 0xc
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x50]
inc dword [ebp - 0x28]
mov word [ebp - 0x34], 0x38
mov esi, dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x50]
push edx
push esi
push 2
mov ecx, dword [ebp - 0x48]
push ecx
call sub.ADVAPI32.DLL_GetTokenInformation
test eax, eax
setne al
and eax, 1
mov byte [ebp - 0x62], al
mov edx, dword [ebp - 0x48]
push edx
call sub.KERNEL32.DLL_CloseHandle
cmp byte [ebp - 0x62], 0
je 0x417dbf
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x58]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push eax
call sub.ADVAPI32.DLL_AllocateAndInitializeSid
test eax, eax
je 0x417dbf
xor edx, edx
lea edi, [esi + 4]
mov dword [ebp - 0x68], edx
jmp 0x417dab
mov eax, dword [edi]
push eax
mov edx, dword [ebp - 0x4c]
push edx
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
setne bl
and ebx, 1
inc dword [ebp - 0x68]
add edi, 8
test bl, bl
jne 0x417db6
mov eax, dword [esi]
cmp eax, dword [ebp - 0x68]
ja 0x417d91
mov edx, dword [ebp - 0x4c]
push edx
call sub.ADVAPI32.DLL_FreeSid
dec dword [ebp - 0x28]
mov word [ebp - 0x34], 0x38
dec dword [ebp - 0x28]
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sub edi, eax
mov esi, eax
test esi, esi
je 0x417df4
cmp edi, 0x80
jbe 0x417dea
push esi
call fcn.0048529c
pop ecx
jmp 0x417df4
push edi
push esi
call fcn.004a63c4
add esp, 8
dec dword [ebp - 0x28]
dec dword [ebp - 0x28]
mov word [ebp - 0x34], 8
mov word [ebp - 0x34], 0
jmp 0x417e15
mov eax, ebx
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret