Function at 0x1400090a0
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
xor eax, eax
test eax, eax
je 0x1400092be
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movabs eax, dword [0x53dae8006d67a0]
add byte [rbx - 0x97ab110], cl
jl 0x1400090d1
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rbx], bl
push rbx
jns 0x140009153
add byte [rax + rax], al
add byte [rbx], dh
xor al, 0x81
mov eax, esi
xor eax, dword [rdx]
add edx, 4
mov edi, eax
sldt word [rax]
add byte [rcx + 0x64], cl
imul esi, dword [rbx + 0x70], 0x68637461
outsb dx, byte [rsi]
jbe 0x140009156
mov ebp, esp
add esp, 0xfffffde0
push rbx
push rsi
push rdi
xor ebx, ebx
mov dword [rbp + 0x400c700], ebx
add byte [rax], al
add byte [rcx + 0x6ceec4], ah
mov eax, dword [rax]
xor edx, edx
or dl, byte [rsi + 0x69]
jae 0x14000918e
invalid
imul ebp, dword gs:[rsi + 0x61], 0x72507972
outsb dx, byte [rsi]
invalid
call 0x1932efeec
jns 0x140009208
push rbp
je 0x140009201
insb byte [rdi], dx
jae 0x14000919b
add byte [rax], al
add byte [rdx], al
add byte [0x1405346cd], dl
call 0x13fed09fc
test al, al
je 0x1400091ba
movzx esp, byte [rax]
mov edx, dword [rbp + 0xc]
mov dword [rax + 0x24], edx
call fcn.140009168
pop rbp
ret 8
invalid
mov edx, 0xff000012
call 0x13ff5a004
mov eax, dword [rbp + 8]
mov esp, ebp
pop rbp
ret 0x20
xor eax, eax
test eax, eax
je 0x1400094d5
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0xc], eax
xor eax, eax
push rbp
push 0x46ddff
push qword fs:[rax]
mov eax, esi
invalid
xor eax, eax
test eax, eax
je 0x1400096ec
nop
add ah, dh
dec ecx
or al, byte [rbp]
add spl, sil
call qword [0x18200d9fb]
invalid
xor eax, eax
test eax, eax
je 0x140009903
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dl, 0x15
mov eax, dword [rbp - 4]
call 0x13fff452c
jmp 0x140009774
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
push rsp
push rdx
insb byte [rdi], dx
add byte [rax], cl
outsd dx, dword [rsi]
outsb dx, byte [rsi]
je 0x1400097ec
js 0x1400097fd
add al, byte [rax]
or dh, byte [rax]
invalid
add byte [rax], al
add byte [rax], al
add dword [rdx], eax
add byte [rdx], al
add byte [rax], al
add byte [rax], al
int3
push rsp
invalid
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 5
xor eax, eax
test eax, eax
je 0x140009b49
nop
nop
nop
nop
add byte [rdx], al
add byte [rsi], al
push rsi
invalid
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140009fff
xor eax, eax
test eax, eax
je 0x140009dbb
nop
nop
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140009ff4
xor eax, eax
test eax, eax
je 0x140009fec
nop
mov edx, dword [rbp - 0x3c]
mov eax, dword [rbp - 0x44]
sub edx, eax
sar edx, 1
jns 0x140009def
adc edx, 0
add ecx, dword [rax]
pop rsp
adc eax, 0x42
add al, 0x53
insb byte [rdi], dx
add al, byte [rax]
add byte [rax + rax + 0x4012b800], bl
add byte [rax], al
add byte [rax], al
invalid
invalid
invalid