Function at 0x41adb1
Capabilities:
Get user security identifier
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x7fe8]
mov eax, 0x8068
call fcn.0041d7b0
mov eax, dword [0x450970]
xor eax, ebp
mov dword [ebp + 0x7fe4], eax
mov eax, dword [ebp + 0x7ff0]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x7ff8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x7ffc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x8000]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x8004]
push ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x8008]
push str.advapi32.dll
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebx, ebx
cmp eax, ebx
jne 0x41ae1f
xor eax, eax
jmp 0x41b20d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ConvertSidToStringSidW
push eax
call esi
mov dword [ebp - 0x54], eax
cmp eax, ebx
jne 0x41ae3c
xor eax, eax
jmp 0x41b20c
push edi
push str.netapi32.dll
call fcn.0041acba
mov edi, eax
pop ecx
cmp edi, ebx
je 0x41b209
push str.NetLocalGroupAdd
push edi
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x41b209
push str.NetLocalGroupGetInfo
push edi
call esi
mov dword [ebp - 0x48], eax
cmp eax, ebx
je 0x41b209
push str.NetApiBufferFree
push edi
call esi
mov dword [ebp - 0x60], eax
cmp eax, ebx
je 0x41b209
push str.NetUserAdd
push edi
call esi
mov dword [ebp - 0x50], eax
cmp eax, ebx
je 0x41b209
push str.NetUserGetInfo
push edi
call esi
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x41b209
push str.NetLocalGroupAddMembers
push edi
call esi
mov dword [ebp - 0x44], eax
cmp eax, ebx
je 0x41b209
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x58]
xor eax, eax
push esi
mov word [ebp + 0x3fe4], ax
call fcn.0041b8f7
push dword [ebp - 0x38]
mov dword [ebp - 0x5c], eax
push esi
call fcn.0041b8f7
push dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
push esi
call fcn.0041b8f7
push dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
push esi
call fcn.0041b8f7
push dword [ebp - 0x2c]
mov edi, eax
push esi
mov dword [ebp - 0x30], edi
call fcn.0041b8f7
xor esi, esi
add esp, 0x28
inc esi
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x1d], bl
cmp edi, ebx
je 0x41afb7
cmp byte [ebp + 0x800c], bl
je 0x41af81
push ebx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x4c]
push eax
push esi
push ebx
mov dword [ebp - 0x4c], edi
call dword [ebp - 0x28]
mov edi, eax
mov eax, 0x8af
mov ecx, 0x563
cmp edi, ebx
je 0x41af4f
cmp edi, eax
je 0x41af57
cmp edi, ecx
jne 0x41af5f
cmp edi, eax
je 0x41af57
cmp edi, ecx
jne 0x41af76
cmp byte [ebp + 0x8010], bl
je 0x41af76
push edi
push esi
lea eax, [ebp + 0x3fe4]
push str._d__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp edi, ebx
mov edi, dword [ebp - 0x30]
sete byte [ebp - 0x1d]
jmp 0x41afb7
lea eax, [ebp - 0x24]
push eax
push esi
push edi
push ebx
mov dword [ebp - 0x24], ebx
call dword [ebp - 0x48]
cmp eax, ebx
jne 0x41af9f
cmp dword [ebp - 0x24], ebx
je 0x41afb7
push dword [ebp - 0x24]
call dword [ebp - 0x60]
jmp 0x41afb7
push eax
push 6
lea eax, [ebp + 0x3fe4]
push str._d__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp + 0x3fe4]
push eax
call fcn.0041da4b
pop ecx
test eax, eax
jne 0x41b19c
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push ebx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], ebx
call dword [ebp - 0x50]
cmp eax, ebx
jne 0x41b181
lea eax, [ebp - 0x28]
push eax
push 0x17
push dword [ebp - 0x80]
mov dword [ebp - 0x28], ebx
push ebx
call dword [ebp - 0x34]
cmp eax, ebx
jne 0x41b167
cmp edi, ebx
je 0x41b052
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x10]
push esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push ebx
push edi
push ebx
call dword [ebp - 0x44]
cmp eax, ebx
je 0x41b052
cmp eax, 0x562
je 0x41b052
push eax
push 4
lea eax, [ebp + 0x3fe4]
push str._d__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp + 0x3fe4]
push eax
call fcn.0041da4b
pop ecx
test eax, eax
jne 0x41b15a
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], ebx
push dword [eax + 0x10]
call dword [ebp - 0x54]
lea eax, [ebp + 0x3fe4]
cmp dword [ebp - 0x24], ebx
je 0x41b149
push dword [ebp - 0x24]
push eax
call fcn.0041dfba
pop ecx
pop ecx
cmp edi, ebx
je 0x41b13e
mov esi, 0x2000
push esi
mov dword [ebp - 0x34], esi
call fcn.0041d963
pop ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x34]
push ecx
push eax
push edi
push ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x44], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x41b135
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
mov dword [ebp - 0x2c], ebx
call dword [ebp - 0x54]
cmp dword [ebp - 0x2c], ebx
je 0x41b135
mov esi, 0x43a348
lea eax, [ebp + 0x3fe4]
push esi
push eax
call fcn.0041df8c
push dword [ebp - 0x2c]
lea eax, [ebp + 0x3fe4]
push eax
call fcn.0041df8c
lea eax, [ebp + 0x3fe4]
push esi
push eax
call fcn.0041df8c
add esp, 0x18
mov eax, str.true
cmp byte [ebp - 0x1d], bl
jne 0x41b11d
mov eax, str.false
push eax
lea eax, [ebp + 0x3fe4]
push eax
call fcn.0041df8c
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x30]
call fcn.0041d558
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x41b15a
push 5
push 0x442018
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp - 0x28], ebx
je 0x41b19c
push dword [ebp - 0x28]
call dword [ebp - 0x60]
jmp 0x41b19c
push eax
push 3
lea eax, [ebp + 0x3fe4]
push str._d__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x41b19c
push dword [ebp - 0x48]
push eax
push 2
lea eax, [ebp + 0x3fe4]
push str._d__d__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push dword [ebp - 0x5c]
call fcn.0041d558
push dword [ebp - 0x38]
call fcn.0041d558
pop ecx
pop ecx
cmp dword [ebp - 0x40], ebx
je 0x41b1bc
push dword [ebp - 0x40]
call fcn.0041d558
pop ecx
cmp edi, ebx
je 0x41b1c7
push edi
call fcn.0041d558
pop ecx
cmp dword [ebp - 0x3c], ebx
je 0x41b1d5
push dword [ebp - 0x3c]
call fcn.0041d558
pop ecx
lea eax, [ebp + 0x3fe4]
push eax
call fcn.0041da4b
pop ecx
test eax, eax
je 0x41b209
lea eax, [ebp + 0x3fe4]
push eax
call fcn.0041da4b
pop ecx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
push eax
lea eax, [ebp + 0x3fe4]
push eax
push ecx
call dword [edx + 0x28c]
jmp 0x41b20b
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp + 0x7fe4]
xor ecx, ebp
pop ebx
call fcn.0041d798
add ebp, 0x7fe8
leave
ret 0x24