Function at 0x14000c1c0
Capabilities:
Get thread local storage value
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400b5778]
xor rax, rsp
mov qword [rsp + 0x80], rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [0x1400b7250]
xor esi, esi
mov edi, eax
cmp ecx, 0xffffffff
je 0x14002ac00
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqTransportType]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14000c34b
cmp dword [rsp + 0x60], 4
jne 0x14002ac1e
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
mov ebx, 1
lea r9, [rsp + 0x70]
mov rcx, rax
mov r8d, ebx
lea edx, [rbx + 7]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x14000c35a
lea rax, [rsp + 0x68]
mov dword [rsp + 0x78], esi
mov qword [rsp + 0x50], rax
lea r8d, [rbx + 1]
mov dword [rsp + 0x48], esi
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], esi
movzx edx, bl
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov word [rsp + 0x7c], 0x500
mov qword [rsp + 0x68], rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x14002ac4c
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x64]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x14002ac28
cmp dword [rsp + 0x64], esi
jne 0x14000c2eb
mov ebx, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test ebx, ebx
js 0x14002ac70
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400126a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
cmp eax, 0x6bd
jne 0x14002ac08
mov ebx, esi
jmp 0x14000c30d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000c375
movzx ebx, ax
or ebx, 0x80070000
cmp ebx, 0x800703f0
je 0x14000c356
jmp 0x14000c30d
mov rax, rsi
jmp 0x14000c20f
test eax, eax
jle 0x14000c30d
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000c30d
mov ebx, 1
jmp 0x14000c30d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000c2eb
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000c2eb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000c2fc
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000c2fc
mov rcx, qword [0x1400b52f8]
lea rax, [0x1400b52f8]
cmp rcx, rax
je 0x14000c323
test byte [rcx + 0x44], 0x20
je 0x14000c323
mov rcx, qword [rcx + 0x38]
lea r8, [0x14009b640]
mov edx, 0x12
mov r9d, ebx
call fcn.14002d778
nop
jmp 0x14000c323