Function at 0x437eb0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x48da48
push 0x480e70
mov eax, dword fs:[0]
push eax
je 0x438178
jne 0x438178
push 0xa10148
push 0x1148e6b4
push 0x114af838
lea ebx, [ebp - 0xf4]
mov dword [ebp - 0x470], edi
mov byte [0xdd95a5], bl
push 0x102a4290
mov dword [0xcf3ea0], eax
xchg esi, eax
mov al, 0xa2
mov bh, bh
mov cl, byte [ecx + 0x57]
cli
pushfd
inc ebp
adc byte [esi], cl
in eax, 0x18
pop ebx
je 0x4380e1
jne 0x4380e1
mov eax, 0xa946d4
push 0x100e8e18
push 0x114705ac
mov dword [esi], 0xa8849c
push 0x697e7110
mov ecx, 0x109dac0
mov dword [0x11542b90], ecx
xlatb
jge 0x437f6c
sti
out dx, eax
push cs
sub al, 0x11
xchg ebp, eax
mov eax, dword [0xfc5d8921]
mov dword [ebp - 0x24], ebx
jmp 0x437fc9
push 0xa741fc
call dword [0x69783514]
push 0xa856cc
mov dword [ebp - 0x58], edi
mov eax, 0x10081018
mov dword [esp + 0x10], 0x696c92f0
mov dword [0x4559e0], 1
mov dword [edi], 0xd9deb4
mov edx, dword [ebp - 0x330]
push 0xcef058
mov dword [0x44ed70], 0
add dword [esi + 0x8c], edx
add ebx, dword [edx + 0x18]
fdiv st(5)
shr edx, 0xf4
mov bl, 0x92
xchg edx, eax
ljmp 0xed92
mov word [ebp - 0x20], 0x500
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push ebx
je 0x438317
jne 0x438317
push 0x1153cac8
mov eax, dword [0x10066aa4]
push 0x697814b0
fld qword [edx*8 + 0xcd18c8]
mov byte [esi + 0xe6d], 0
mov dword [0x42d534], eax
jmp dword [esi*4 + 0x99fb98]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00480aee
mov esp, ebp
pop ebp
je 0x43842f
jne 0x43842f
mov dword [0x471824], eax
and edx, 0xf000
add esi, dword [0x436d98]
mov dword [esi + 0x18], 0x1111e720
mov dword [0x44719c], 1
and dword [ebp - 0x34], 0
xchg ebx, eax
fcomp qword [edi + 0x6a0ef1ed]
scasd eax, dword es:[edi]
xchg dword [eax - 0x73], edx
inc ebp
invalid
sub esp, 0x1c
push 0x43801b
ret
mov dword [ebp - 4], 0xfffffffe
push 0x4383c7
ret
test eax, eax
jne 0x438462
mov dword [ebp - 0x28], ebx
je 0x438462
jne 0x438462
sbb eax, 0x1d983f11
mov dword [ebp - 0x18], 8
mov eax, dword [edx + 0x450]
mov eax, 0xa10b58
fmul dword [eax - 0x14]
mov dword [ebp - 0x4ac], 3
lea esi, [esi + 0x44565c]
mov dword [esi], 0xb505f8
push 0x10032fa4
push 0xbec85422
xchg esi, eax
pop esi
jmp 0x437f0d
push ebx
push ebx
push ebx
je 0x43835f
jne 0x43835f
mov eax, 0x2d
push 0x65ddd0
push 0xadb76c
mov dword [ecx + esi + 0x148], 0x102fef74
lea ecx, [edi + edi*8 + 0xd7e7ac]
push 0x49fdf0
mov dword [0xd136a4], 0x53ea40
test al, 0xab
pushfd
adc byte [edi + 0x72], cl
pop eax
out 0xec, al
push 0x220
push 0x20
push 2
je 0x438514
jne 0x438514
lea edx, [eax + 0x2f8]
push 0x11489fb4
mov eax, 0x53cb40
lea ecx, [esi + 0xed8]
cmp dword [edx + 4], 0xf4240
mov eax, 0xfb3598
mov ecx, dword [0x40b028]
mov esi, dword [0x40c190]
push 0x41c91c
mov eax, 0x1001ae28
push dword [0x42bbe4]
mov dword [0x1153b908], eax
mov byte [edi], bh
adc ebx, dword [esi + 0x17571188]
nop
test eax, 0xb2e870c3
mov al, 0x8b
dec ebp
invalid
ret
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x4384b1
mov eax, dword [ebp - 0x28]
jmp 0x4381c2
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x4381c2
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
jmp 0x43827b