Function at 0x1000e641
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x1005cc3d
call fcn.1005c388
sub esp, 0x58
push ebx
push esi
mov byte [ebp - 0x18], dl
mov dword [ebp - 0x1c], 0x5804
cmp dword [ebp - 0x1c], 0x58c6
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
jle 0x1000e6c0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x48]
or eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e69b
mov eax, dword [eax]
push eax
call fcn.100443ac
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10005611
inc edi
cmp edi, 0x2025
jl 0x1000e682
inc esi
cmp esi, 0x30ed
jl 0x1000e680
cmp dword [ebp - 0x1c], 0x5492
jge 0x1000e6d4
push str.mpy_qyak_bge_azkz_mvwxo_olqplr_cwtfx_twgi_kpvg_mqzerzvzj_hdfigh
call fcn.100443ac
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x18], 0
je 0x1000e92a
mov dword [ebp - 0x1c], 0x277f
cmp dword [ebp - 0x1c], 0x2ade
jle 0x1000e722
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor edi, edi
mov esi, 0x10075fb8
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, esi
cdq
push edx
push eax
call fcn.10004fa9
inc ebx
cmp ebx, 0x5d06
jl 0x1000e701
inc edi
cmp edi, 0x2c65
jl 0x1000e6ff
jmp 0x1000e727
mov esi, 0x10075fb8
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x2664
jge 0x1000e764
mov edx, str.vrlurh_qlyjgif_cvkedaytc_pzbpnyjb_phfzlo_zllls
mov ecx, esi
call fcn.1000736a
jmp 0x1000e764
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x74b3
cmp dword [ebp - 0x24], 0x775a
jle 0x1000e7db
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
and dword [ebp - 0x2c], 0
mov ecx, ebx
mov ebx, edi
mov dword [ebp - 0x28], edi
mov edi, dword [ebp - 0x2c]
shl ebx, cl
mov eax, ebx
mov ecx, esi
xor eax, edi
cdq
push edx
push eax
call fcn.10004fa9
inc edi
cmp edi, 0x26a1
jl 0x1000e792
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x28f
jl 0x1000e782
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x523f
jl 0x1000e77d
push 0xe83
push 0
push 0xea3
push 0x2c
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [ebp - 4], 4
cmp dword [ebp - 0x24], 0x71c8
jge 0x1000e7f7
mov edx, str.vxgeyfk_uteegfj_hjh_msj_jjsmc_xom_ywllapnl_isuqz_koepmfafk_hnm_cyjiaykb_bmiz_trfckg
mov ecx, esi
call fcn.1000736a
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x7018
cmp dword [ebp - 0x20], 0x70e1
jle 0x1000e86a
xor esi, esi
mov dword [ebp - 0x24], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x60]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e836
mov eax, dword [eax]
push eax
call fcn.100443ac
pop ecx
push 0
push 1
lea ecx, [ebp - 0x60]
call fcn.10005611
inc ebx
cmp ebx, 0x546f
jl 0x1000e81b
mov esi, dword [ebp - 0x24]
inc edi
cmp edi, 0x3d29
jl 0x1000e812
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x336b
jl 0x1000e810
cmp dword [ebp - 0x20], 0x6ee3
jge 0x1000e87e
push str.ota_houdmj_duxr_sebzg_tcjswd_eatqdzy
call fcn.100443ac
pop ecx
mov eax, dword [ebp + 0x24]
mov edi, dword [ebp + 0x34]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x30]
mov eax, dword [eax]
dec dword [edi]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
imul ecx, dword [eax]
imul eax, ecx, 3
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ecx]
mov ecx, dword [ebp + 0x2c]
mov dword [ecx], eax
mov edx, dword [ecx]
xor ecx, ecx
mov eax, dword [esi]
cmp edx, eax
mov eax, dword [ebx]
sete cl
xor edx, edx
imul ecx, ecx, 0x5f19
add ecx, 0xfffffffc
cmp eax, ecx
mov eax, dword [ebp + 0x20]
setl dl
xor ecx, ecx
mov eax, dword [eax]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
cmp eax, edx
mov eax, dword [ebp + 0x28]
setg cl
xor edx, edx
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0x14]
setl dl
xor ecx, ecx
mov eax, dword [eax]
sub edx, eax
mov eax, dword [esi]
cmp edx, eax
mov eax, dword [edi]
mov edx, 0xb445acee
setl cl
cmp edx, eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp + 0x30]
setl dl
imul ecx, edx
mov dword [eax], ecx
jmp 0x1000e934
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret