Function at 0x14003fb80
Capabilities:
Get token membership

Disassembly:
push rdi
sub rsp, 0xa0
mov rax, qword [0x140080fc0]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor edi, edi
mov word [rsp + 0x64], 0x500
lea rax, [rsp + 0x70]
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x48], edi
mov r9d, 0x220
mov dword [rsp + 0x40], edi
lea r8d, [rdi + 0x20]
mov dword [rsp + 0x38], edi
mov dl, 2
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14003fc0b
mov rdx, qword [rsp + 0x70]
lea r8, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp dword [rsp + 0x68], edi
jne 0x14003fc44
lea rdx, str.This_program_must_be_run_as_an_administrator_
call fcn.14003fea0
mov rcx, rax
lea rdx, [0x140040070]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov eax, 1
jmp 0x14003fe81
lea rdx, str.Insert:_Toggle_Menu
mov qword [rsp + 0xb0], rbx
call fcn.14003fea0
mov rcx, rax
lea rdx, [0x140040070]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Delete:_Exit
call fcn.14003fea0
mov rcx, rax
lea rdx, [0x140040070]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Counter_Strike_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
mov qword [0x140084aa8], rax
lea rdx, [rsp + 0x80]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x78]
mov r9d, dword [rsp + 0x80]
mov r8d, dword [rsp + 0x74]
mov eax, dword [rsp + 0x70]
sub eax, ecx
sub ecx, dword [rsp + 0x70]
sub eax, r9d
mov dword [0x140081004], ecx
add eax, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x7c]
cdq
sub ecx, r8d
sub eax, edx
sub r8d, dword [rsp + 0x7c]
sar eax, 1
sub r8d, eax
mov dword [0x140081000], ecx
add r8d, dword [rsp + 0x8c]
mov dword [0x140084a9c], r8d
lea ecx, [r9 + rax]
mov dword [0x140084a98], ecx
call fcn.140044360
mov edx, 1
mov ecx, 0x2000d
call fcn.1400430f0
mov edx, 1
mov ecx, 0x2000a
call fcn.1400430f0
xor edx, edx
mov ecx, 0x20005
call fcn.1400430f0
mov edx, 1
mov ecx, 0x20001
call fcn.1400430f0
mov edx, 1
mov ecx, 0x2200c
call fcn.1400430f0
mov edx, 1
mov ecx, 0x20007
call fcn.1400430f0
mov edx, dword [0x140081000]
lea r8, str.CS2External
mov ecx, dword [0x140081004]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
call fcn.1400427a0
mov rcx, rax
mov qword [0x1400848b8], rax
call fcn.140049980
call fcn.14003f470
call fcn.14003f750
call fcn.140034c40
call fcn.140033e80
mov rbx, qword [0x1400848a0]
mov qword [0x1400848a0], rbx
call fcn.14000a7a0
test rbx, rbx
mov qword [0x1400848a0], rdi
je 0x14003fe5b
mov rcx, rbx
call fcn.140021770
mov r8, qword [0x1400848a0]
test r8, r8
je 0x14003fe52
movsx rdx, word [r8 + 0x6228]
lea rcx, [r8 + 0x622c]
mov r9d, dword [r8 + 0x3fc0]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14003fe47
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6228], cx
movsx rax, cx
lea rcx, [r8 + 0x622c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], edi
inc word [rcx + 6]
inc dword [r8 + 0x6224]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.1400444f0
mov rcx, qword [0x1400848b8]
call fcn.140042c20
call fcn.1400444f0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov rbx, qword [rsp + 0xb0]
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140051cc0
add rsp, 0xa0
pop rdi
ret