Function at 0x1400090a0
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
xor eax, eax
test eax, eax
je 0x1400092be
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub al, 0x13
add byte [rax], cl
add byte [rcx], al
or byte [rax + 0x401f], ah
add byte [rbx + rdx*2], al
sal byte [rbp + 8], 0x81
lldt word [rax]
add byte [rax], al
jmp 0x1400090ed
ret
xor eax, eax
test eax, eax
je 0x1400094d5
nop
nop
nop
nop
xor eax, eax
test eax, eax
je 0x1400096ec
nop
invalid
xor eax, eax
test eax, eax
je 0x140009903
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [rsp + 4], 0
call fcn.1400adb3c
test al, al
jne 0x1100a9793
add byte fs:[r9], al
add byte [0x1b56cf872], al
add al, byte gs:[rax]
add al, byte [rcx]
add bh, bh
movsb byte [rdi], byte [rsi]
add byte [rax], al
inc byte [rcx]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdi], 0xe4
add dword [rax], 0
test byte [rax], al
mov al, 0xef
invalid
cld
mov edx, dword [rax + 0x44c79090]
and al, 0x60
add byte [rax], al
add byte [rax], al
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 5
xor eax, eax
test eax, eax
je 0x140009b49
nop
nop
nop
nop
add eax, dword [rax]
add byte [rax], al
call 0x13fdbf500
jne 0x1400098fd
mov eax, dword [rbp - 0x10]
cld
mov dword [rbp - 8], edx
mov esi, eax
xor eax, eax
push rbp
push 0x51d5a9
add byte fs:[rax], al
add byte [rax], al
test qword [rcx], r11
add byte [rax], al
add byte [rax], al
push rdx
test dword [rcx], ebx
mov dword fs:[rax], edx
jmp 0x14000999b
ret
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140009fff
xor eax, eax
test eax, eax
je 0x140009dbb
nop
nop
invalid
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140009ff4
xor eax, eax
test eax, eax
je 0x140009fec
nop
sub byte [rsp + rbp*2], ch
sub byte [rsp + rbp*2], ch
sub byte [rsp + rbp*2], ch
sub byte [rsp + rbp*2], ch
mov edx, dword [0x140575822]
call 0x13fe97ed8
add esp, 4
mov eax, dword [rbp + 0x57]
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], 0
movabs al, byte [0x79530e000000401f]
jae 0x140009e8f
insd dword [rdi], dx
insb byte [rdi], dx
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdi], ch
jne 0x140009e34
outsb dx, byte [rsi]
add byte [rax + rax], dh
add byte [rax], al
add byte [rbp - 0x75], dl
in al, dx
cmp dword [rdi + rdx*4 - 0x723c0001], 0x40
add byte [rbx + 0x57], dl
push rbp
add esp, 0xffffffe8
mov ebp, edx
mov eax, dword [rax - 8]
mov eax, dword [rax + 0x1bc]
mov edx, dword [rbp + 8]
mov edx, dword [rdx - 8]
cmp edi, edi
lea eax, [rdi + rsi + 1]
mov dword [rbp - 0xc], eax
fldz
fld xword [rbp + 8]
fucompp
wait
add al, byte [rax]
add byte [rsi + 0x5b], bl
ret
add byte [rbx], bh
out dx, al
inc dword [rbp - 0x3c6af040]
mov eax, ebx
pop rsi
pop rbx
ret
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
test eax, eax
je 0x14000a216
nop
nop
nop
nop
nop
nop
nop
insb byte [rdi], dx
push rbp
jo 0x14000a017
add byte [rax], al
je 0x14000a065
push rax
add byte [rax + 1], ch
add byte [rax], al
or al, byte [rax]
add byte [rax], al
pop rsi
pop rbx
ret
shr al, cl
shr dword [rsi], 1
add dword [rax], eax
lea eax, [rsi + 4]
xor edx, edx
mov ah, 0x3c
add dword [rax], eax
mov eax, dword [rbp - 8]
mov eax, dword [rax + 0x30]
xor edx, edx
mov dword [rbp - 0x14], edx
lea eax, [rbp + rax*2 + 0x15030055]
push rsp
push rsp
push 0x64656d65
push r8
insb byte [rdi], dx
pushfq
retf 0x4a
mov eax, dword [rsp + 0x60]
add rsp, 0x88
ret