Function at 0x14000c930
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
xor eax, eax
test eax, eax
je 0x14000cb4e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
outsd dx, dword [rsi]
outsd dx, dword [rsi]
imul eax, dword [rbx + 0x6c], 0x61
jae 0x14000c9cc
push rsp
outsb dx, byte [rsi]
jne 0x14000c9ae
in al, dx
mov eax, esi
call fcn.140005b34
pop rdi
pop rsi
pop rbx
mov esp, ebp
pop rbp
ret 0x6d
invalid
cld
call 0x14002c9b6
or ah, al
pop rsi
add byte [rdi], r8b
invalid
mov dword [rax + 0x24], edx
call 0x146013640
outsb dx, byte [rsi]
jae 0x14000ca3d
jb 0x14000ca4e
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
loopne 0x14000c980
jb 0x14000c9f5
mov eax, dword [rbp - 0x10]
cdq
xor eax, edx
sub eax, edx
invalid
inc dword [rbx + 0x4408be8]
test byte [rax + rdx*4 + 8], 1
je 0x14000ca6e
push qword [rbx]
push 0xffffffffb9663c20
add al, byte [rax]
add byte [rax], al
cmp al, 0x66
mov ecx, 2
call 0x13ff39e04
ret
add r11b, al
lea eax, [rax]
mov edx, 0xff000005
cmp byte [rax + 0x2d2], 2
xor eax, eax
test eax, eax
je 0x14000cd65
nop
nop
nop
nop
nop
nop
nop
nop
or al, ch
cmp dl, byte [rdx]
fdiv st(7), st(0)
xor eax, eax
pop rdx
pop rcx
pop rcx
mov dword fs:[rax], edx
push 0x50104553
movzx eax, byte [rbp + 0xc]
push rax
movzx eax, byte [rbp + 8]
push rax
mov eax, ebx
call 0x1958e216a
out 0xf, eax
mov dh, 0x45
out 0xe8, al
sub bl, dh
invalid
xor eax, eax
test eax, eax
je 0x14000cf7c
nop
lea edx, [rsp + 0x10]
mov eax, ebx
mov ecx, dword [rax]
call qword [rcx + 0x70]
lea edx, [rsp + 0x10]
sldt word [rax]
mov ecx, dword [rbx]
cmp word [rcx + rdx*2 - 2], 0x2c
je 0x14000cdf0
jne 0x14000cd82
sub byte [rsp + rbp*2], ch
insb byte [rdi], dx
add byte [rdi + rbx*8 + 0x44a4004f], dh
insb byte [rdi], dx
add byte [rax], al
hlt
add ah, dh
dec dword [rsi + riz + 0x4c]
add byte [rdx], al
hlt
xor eax, eax
test eax, eax
je 0x14000d193
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
invalid
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 5
xor eax, eax
test eax, eax
je 0x14000d3d9
nop
nop
nop
nop
insd dword [rdi], dx
add dword [rax], eax
invalid
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000d88f
xor eax, eax
test eax, eax
je 0x14000d64b
nop
nop
add al, 0
add byte [rax], al
pop rsi
pop rbx
ret
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000d884
ror byte [rdi], 0x85
invalid
xor eax, eax
test eax, eax
je 0x14000d87c
nop
xor byte [0x151bcd6c7], ch
push rcx
add byte [rax - 0x47ffae4b], bl
mov ch, 0x51
add byte [rax], al
add byte [rcx], al
add byte [rdx], al
jg 0x14000d65e
add byte [r10], al
add byte [rdx], al
add byte [rax], al
add byte [rbx + rax], dh
add byte [rax + rax], cl
add ecx, dword [rax]
mov word [rdx + 0x47], cs
add byte [rax], al
add byte [rbp - 0x1a], al
jmp 0x14000d7b0
push rsi
mov eax, dword [rbp - 4]
mov ecx, 1
mov edx, dword [0x14041e98b]
call 0x10034481a
push rbp
push 0x53fcb1
push qword fs:[rax]
mov dword fs:[rax], esp
add ah, dh
invalid
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
test eax, eax
je 0x14000daa6
nop
nop
nop
nop
nop
nop
nop
push rsi
cmp dl, byte [rax + 0x6e]
je 0x14000d8b6
mov byte [rax + 0x6e], dl
test dl, dl
je 0x14000d8b6
mov si, 0xee
add byte [rax + 0x4f0e003e], al
outsb dx, byte [rsi]
outsb dx, byte [rsi]
outsd dx, dword [rsi]
outsb dx, byte [rsi]
je 0x14000d922
js 0x14000d933
push rax
add dword [rax], eax
add al, ch
and al, 0x1a
lock dec dword [rbx - 0x47c28]
je 0x14000d92e
mov eax, dword [rax]
or dword [rcx + 0x43], eax
outsd dx, dword [rsi]
insd dword [rdi], dx
jo 0x14000d939
jb 0x14000d93f
jb 0x14000d8de
add byte [rdx], al
add byte [rcx + 2], cl
add byte [0x1a5654730], al
js 0x14000d8eb
add byte [rdx], al
add byte [rax + rax + 0x28], bl
insb byte [rdi], dx
adc cl, cl
add r8b, bpl
cmp eax, 0xc3000000
push rbx
push rsi
mov esi, edx
ror byte [rdi], 0x84
ja 0x14000d936
add byte [rax], al
xor edx, edx
add byte [rbx], dh
ror byte [rcx - 0x247a0bab], cl
mov dword [rbp - 0xc], edx
test ebx, ebx
je 0x14000d955
adc eax, 0x65666552
jb 0x14000d9ab
push rdx
jb 0x14000d9ab
outsb dx, byte [rsi]
invalid
jp 0x14000d9b8
jb 0x14000d9bd
push rax
invalid
outsd dx, dword [rsi]
imul edi, dword [rax], 0xffffffe9
push rdx
add byte [rax], al
adc byte [rax], al
add al, 8
adc al, 0x5a
pop rbp
add byte [rax], al
add byte [rbx + rdx*2], al
push rbx
insb byte [rdi], dx
jns 0x14000d9fe
push rbx
jns 0x14000da38
je 0x14000da2c
insd dword [rdi], dx
push rsp
jns 0x14000da3c
outsb dx, byte [rsi]
outsw dx, word [rsi]
sub edx, eax
mov dword [rbx + 0x24], edx
jmp 0x14000d9dc
mov esi, dword [rbx + 0x14]
test dword [rdx], eax
hlt
add al, byte [rax]
inc ebx
jmp 0x13ff44c84
add byte [rax + rdx + 0x25ff40], bl
invalid
jmp qword [0x1406e6992]
insd dword [rdi], dx
add byte [rbx + 0x6d756ec0], cl
jb 0x14000daa7
je 0x14000dab7
jb 0x14000da7f
add byte [rax + 0x60047df], bl
test al, 0x78
invalid
retf 0x7b9
mov eax, dword [rsp + 0x60]
and al, 0x60
invalid
invalid