Function at 0x688940
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0
push 0x1bbd3d
mov edx, dword [ebp - 4]
mov eax, 0x688b88
call fcn.0067d9b4
xor eax, eax
push ebp
push 0x6889c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x15], 1
cmp byte [ebp - 0x15], 0
je 0x688993
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x688993
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
jne 0x6889bb
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x6889bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x688b74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6889d9
push 0
push 0x1cd4ba
push 0
push 0x1cd4ba
call fcn.0067d81c
push edx
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x6889fc
cmp eax, dword [esp]
pop edx
pop eax
je 0x688b49
xor eax, eax
push ebp
push 0x688b3f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffe25935
push 0
push 0x1da6cb
call fcn.0067d81c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
push 0xffe6f7e3
push 0
push 0x19081d
call fcn.0067d81c
push eax
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x14]
push eax
call fcn.0040f7d8
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x688b2b
xor eax, eax
push ebp
push 0x688b21
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x688b17
push ebp
call fcn.00688888
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x688b0e
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [eax + edx*8 + 4]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x688b06
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [eax + edx*8 + 8]
and eax, 0x10
cmp eax, 0x10
jne 0x688af0
push 0
push 0x19c020
mov edx, dword [ebp - 4]
mov eax, 0x688bac
call fcn.0067d9b4
jmp 0x688b0e
push 0
push 0x1a835a
mov edx, dword [ebp - 4]
mov eax, 0x688bc4
call fcn.0067d9b4
jmp 0x688b0e
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x688ab0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x688b2b
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040f7e8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x688b49
xor eax, eax
push ebp
push 0x688b6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x688b74
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret