Function at 0x411c14
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
mov eax, 0x4d2b6c
push ebx
push esi
push edi
call fcn.0048c270
mov word [ebp - 0x34], 8
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x48], eax
xor esi, esi
mov word [ebp - 0x34], 8
mov dword [ebp - 0x4c], edx
xor eax, eax
mov edx, dword [0x4d2b18]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], edx
lea ecx, [ebp - 0x48]
mov dx, word [0x4d2b1c]
mov word [ebp - 0x54], dx
push ecx
push 0x20008
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x411de8
lea eax, [ebp - 0x50]
push eax
push 0
push esi
push 2
mov edx, dword [ebp - 0x48]
push edx
call sub.ADVAPI32.DLL_GetTokenInformation
mov word [ebp - 0x34], 0x14
mov esi, dword [ebp - 0x50]
xor eax, eax
inc dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 8], ecx
inc dword [ebp - 0x28]
test esi, esi
je 0x411ccb
cmp esi, 0x80
jbe 0x411cc0
push esi
call fcn.0048af70
pop ecx
mov edi, eax
jmp 0x411ccd
push esi
call fcn.004ac010
pop ecx
mov edi, eax
jmp 0x411ccd
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
add eax, esi
mov dword [ebp - 8], eax
inc dword [ebp - 0x28]
dec dword [ebp - 0x28]
mov byte [ebp - 0x59], 0
mov edi, dword [ebp - 0x18]
mov edx, esi
add edx, edi
mov dword [ebp - 0x60], edx
mov cl, byte [ebp - 0x59]
mov byte [ebp - 0x61], cl
mov eax, dword [ebp - 0x60]
sub eax, edi
push eax
xor edx, edx
mov dl, byte [ebp - 0x61]
push edx
push edi
call fcn.0048bd90
add edi, esi
add esp, 0xc
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x50]
inc dword [ebp - 0x28]
mov word [ebp - 0x34], 0x38
mov esi, dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x50]
push edx
push esi
push 2
mov ecx, dword [ebp - 0x48]
push ecx
call sub.ADVAPI32.DLL_GetTokenInformation
test eax, eax
setne al
and eax, 1
mov byte [ebp - 0x62], al
mov edx, dword [ebp - 0x48]
push edx
call sub.KERNEL32.DLL_CloseHandle
cmp byte [ebp - 0x62], 0
je 0x411da7
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x58]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push eax
call sub.ADVAPI32.DLL_AllocateAndInitializeSid
test eax, eax
je 0x411da7
xor edx, edx
lea edi, [esi + 4]
mov dword [ebp - 0x68], edx
jmp 0x411d93
mov eax, dword [edi]
push eax
mov edx, dword [ebp - 0x4c]
push edx
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
setne bl
and ebx, 1
inc dword [ebp - 0x68]
add edi, 8
test bl, bl
jne 0x411d9e
mov eax, dword [esi]
cmp eax, dword [ebp - 0x68]
ja 0x411d79
mov edx, dword [ebp - 0x4c]
push edx
call sub.ADVAPI32.DLL_FreeSid
dec dword [ebp - 0x28]
mov word [ebp - 0x34], 0x38
dec dword [ebp - 0x28]
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sub edi, eax
mov esi, eax
test esi, esi
je 0x411ddc
cmp edi, 0x80
jbe 0x411dd2
push esi
call fcn.0048af3c
pop ecx
jmp 0x411ddc
push edi
push esi
call fcn.004ac3c0
add esp, 8
dec dword [ebp - 0x28]
dec dword [ebp - 0x28]
mov word [ebp - 0x34], 8
mov word [ebp - 0x34], 0
jmp 0x411dfd
mov eax, ebx
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret