Function at 0x41b0cc
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x4d04c0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
call fcn.0041aac3
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call edi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___start
call fcn.00414401
pop ecx
pop ecx
push 0x41ac5c
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor ebx, ebx
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x68], ebx
mov word [esp + 0x6c], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, 1
jne 0x41b177
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [esp + 0xc]
dec eax
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 0x10], ebx
jne 0x41b1a7
push 0x10
push str.Error
push str.You_must_be_logged_in_as_administrator_when_installing_this_program.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047a0fb
mov esp, ebp
pop ebp
ret 0x10
call fcn.0041cfd4
test al, al
jne 0x41b1d3
call edi
mov ecx, dword [0x4d4770]
push eax
push str._ERROR___d___LoadLocalXml_fail_
call fcn.00414401
pop ecx
pop ecx
push 0x10
push str.Error
push str.Load_product_xml_error.
jmp 0x41b189
call edi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___ReadRunConfig
call fcn.00414401
pop ecx
pop ecx
call fcn.0041ee4f
lea eax, [esp + 0x18]
push eax
call fcn.0040d300
call edi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___loadLangXML
call fcn.00414401
cmp dword [0x4d491c], 8
mov eax, dword [0x4d4908]
pop ecx
pop ecx
jae 0x41b21f
mov eax, 0x4d4908
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
push ecx
call fcn.004025df
lea eax, [esp + 0x1c]
push eax
call fcn.0040d666
test eax, eax
jne 0x41b273
push 0x10
push str.Error
push str.Load_lang_xml_error.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
call fcn.00402a23
lea eax, [esp + 0x28]
push eax
call fcn.0040dbca
lea eax, [esp + 0x18]
push eax
call fcn.0040dbca
jmp 0x41b190
push 0x4d4924
lea esi, [esp + 0x48]
call fcn.00402109
lea eax, [esp + 0x60]
push str._wae
push eax
mov ebx, esi
call fcn.0040475c
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
pop ecx
pop ecx
jae 0x41b2a1
mov eax, esi
cmp dword [esp + 0x74], 8
mov esi, dword [esp + 0x60]
jae 0x41b2b0
lea esi, [esp + 0x60]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
push ecx
call fcn.004025df
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push esi
push eax
call fcn.004025df
call fcn.00422cad
pop ecx
pop ecx
test eax, eax
jne 0x41b30b
call edi
mov ecx, dword [0x4d4770]
push eax
push str._WARN___d___CheckPreInstance_fail_
call fcn.00414401
pop ecx
pop ecx
push 0
push 1
lea ecx, [esp + 0x68]
call fcn.00402a5a
push 0
push 1
lea ecx, [esp + 0x4c]
call fcn.00402a5a
jmp 0x41b24e
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x41b327
push esi
push 1
lea ecx, [esp + 0x68]
call fcn.00402a5a
push esi
jmp 0x41b2fb
push dword [esp + 0x14]
call fcn.00429c11
pop ecx
call fcn.0041af41
call edi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___WaeWnd
call fcn.00414401
push 0xcc0
call fcn.0047a357
add esp, 0xc
cmp eax, esi
je 0x41b36d
lea ecx, [esp + 0x18]
push ecx
push dword [esp + 0x18]
push eax
call fcn.004237e5
mov ebx, eax
jmp 0x41b36f
xor ebx, ebx
cmp ebx, esi
jne 0x41b3ca
call edi
mov ecx, dword [0x4d4770]
push eax
push str._ERROR___d___create_WaeWnd_fail_
call fcn.00414401
or edi, 0xffffffff
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x68]
call fcn.00402a5a
push esi
push 1
lea ecx, [esp + 0x4c]
call fcn.00402a5a
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
call fcn.00402a23
lea eax, [esp + 0x28]
push eax
call fcn.0040dbca
lea eax, [esp + 0x18]
push eax
call fcn.0040dbca
mov eax, edi
jmp 0x41b193
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x41b3d9
lea eax, [esp + 0x44]
push esi
push 0x190
push 0x1f4
push esi
push esi
push esi
push 0x80b
push eax
push esi
mov ecx, ebx
call fcn.004316a1
push 0x65
mov ecx, ebx
mov dword [0x4d4f88], eax
call fcn.00431200
call edi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___CenterWindow
call fcn.00414401
pop ecx
pop ecx
mov ecx, ebx
call fcn.004310c0
push 1
push 1
mov ecx, ebx
call fcn.00431085
call edi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___MessageLoop
call fcn.00414401
pop ecx
pop ecx
call fcn.00430791
call edi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___MessageLoop_end
call fcn.00414401
pop ecx
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
call edi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___exit_
call fcn.00414401
xor edi, edi
jmp 0x41b389