Function at 0x44ae82
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x44aea2
mov ecx, dword [ebp + 8]
push 0x4a7de0
call fcn.004363fb
jmp 0x44b1dc
push ebx
xor ecx, ecx
lea eax, [ebp + 0xc]
push eax
push ecx
push ecx
push 2
push edi
mov dword [ebp + 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x44af46
call ebx
cmp eax, 0x7a
je 0x44af46
xor ebx, ebx
push ebx
push eax
lea eax, [ebp - 0x44]
push str.GetTokenInformation__
push eax
call fcn.00436b55
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.0043641b
lea ecx, [ebp - 0x44]
call fcn.0043645f
lea ecx, [ebp - 0x30]
call fcn.0043ff50
cmp eax, 0x7d1
lea eax, [ebp - 0x30]
push ebx
jl 0x44af30
push ebx
push 0x588
push 0x49a510
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00406ae7
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043641b
lea ecx, [ebp - 0x44]
call fcn.0043645f
jmp 0x44af39
mov ecx, dword [ebp + 8]
push eax
call fcn.0043641b
lea ecx, [ebp - 0x30]
call fcn.0043645f
jmp 0x44b1db
push esi
push dword [ebp + 0xc]
call fcn.00452ad5
mov esi, eax
pop ecx
test esi, esi
jne 0x44afdb
xor ebx, ebx
lea eax, [ebp - 0x44]
push ebx
push str.Failed_to_allocate_buffer_for_the_token_information_structure
push 0x4a49f0
push 3
push eax
call fcn.004363a7
add esp, 0x10
lea ecx, [ebp - 0x30]
push eax
call fcn.0043641b
lea ecx, [ebp - 0x44]
call fcn.0043645f
lea ecx, [ebp - 0x30]
call fcn.0043ff50
cmp eax, 0x7d1
lea eax, [ebp - 0x30]
push ebx
jl 0x44afd0
push ebx
push 0x590
push 0x49a510
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00406ae7
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043641b
lea ecx, [ebp - 0x44]
call fcn.0043645f
lea ecx, [ebp - 0x30]
call fcn.0043645f
push ebx
jmp 0x44b1d4
mov ecx, dword [ebp + 8]
push eax
call fcn.0043641b
jmp 0x44afc2
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0044a00f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0043641b
lea ecx, [ebp - 0x44]
call fcn.0043645f
lea ecx, [ebp - 0x30]
call fcn.0043ff50
cmp eax, 0x7d1
jl 0x44b047
push 0
push 0
push 0x595
lea eax, [ebp - 0x30]
push 0x49a510
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00406ae7
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043641b
lea ecx, [ebp - 0x44]
call fcn.0043645f
lea ecx, [ebp - 0x30]
jmp 0x44b1ce
lea ecx, [ebp - 0x30]
call fcn.0043645f
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push esi
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x44b0be
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
call ebx
xor ebx, ebx
push ebx
push eax
lea eax, [ebp - 0x44]
push str.GetTokenInformation__
push eax
call fcn.00436b55
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.0043641b
lea ecx, [ebp - 0x44]
call fcn.0043645f
lea ecx, [ebp - 0x30]
call fcn.0043ff50
cmp eax, 0x7d1
lea eax, [ebp - 0x30]
push ebx
jl 0x44b0b3
push ebx
push 0x599
jmp 0x44b01c
mov ecx, dword [ebp + 8]
push eax
call fcn.0043641b
jmp 0x44b03f
push 0x4a7e84
lea ecx, [ebp - 0x1c]
call fcn.004363fb
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x44b0f4
lea eax, [esi + 4]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x44b12e
mov eax, dword [ebp - 8]
inc ebx
add eax, 8
mov dword [ebp - 8], eax
cmp ebx, dword [esi]
jb 0x44b0d7
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x10], 0x3e9
jne 0x44b1be
push 1
call fcn.00445244
pop ecx
test al, al
je 0x44b1be
mov eax, dword [sym.imp.ADVAPI32.dll_IsTokenRestricted]
cmp eax, ebx
jne 0x44b172
mov dword [ebp - 0x10], 0x7e2
jmp 0x44b180
test byte [esi + ebx*8 + 8], 4
lea ecx, [ebp - 0x1c]
je 0x44b14d
xor eax, eax
mov dword [ebp - 0x10], 0x3e9
push eax
push eax
mov byte [ebp - 0xc], al
call fcn.004415dc
jmp 0x44b0f4
test byte [esi + ebx*8 + 8], 0x10
je 0x44b169
mov dword [ebp - 0x10], 0x2904
xor ebx, ebx
push ebx
push ebx
mov byte [ebp - 0xc], bl
call fcn.004415dc
jmp 0x44b0f6
mov dword [ebp - 0x10], 0x2905
jmp 0x44b15b
push edi
call eax
test eax, eax
je 0x44b18f
mov dword [ebp - 0x10], 0x2906
push ebx
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0xc], bl
call fcn.004415dc
jmp 0x44b1be
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
test eax, eax
je 0x44b1be
call edi
push eax
lea eax, [ebp - 0x44]
push str.::IsTokenRestricted__
push eax
call fcn.00436b55
add esp, 0xc
mov ecx, eax
call fcn.0043ff50
lea ecx, [ebp - 0x44]
call fcn.0043645f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0043641b
lea ecx, [ebp - 0x1c]
call fcn.0043645f
push esi
call fcn.0046b30d
pop ecx
pop esi
pop ebx
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret