Function at 0x18001c0b0
Capabilities:
Get token membership

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 0x68], rcx
mov rax, qword [0x1800950a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x5c], 0xcb3590e3
mov eax, dword [rbp - 0x5c]
mov dword [rbp - 0x6c], eax
sub eax, 0x8027a6fb
je 0x18001c3dc
jmp 0x18001c0e9
mov eax, dword [rbp - 0x6c]
sub eax, 0x81160bb6
je 0x18001c47d
jmp 0x18001c0fc
mov eax, dword [rbp - 0x6c]
sub eax, 0x95253ad0
je 0x18001c44a
jmp 0x18001c10f
mov eax, dword [rbp - 0x6c]
sub eax, 0xaaf28789
je 0x18001c381
jmp 0x18001c122
mov eax, dword [rbp - 0x6c]
sub eax, 0xcb3590e3
je 0x18001c244
jmp 0x18001c135
mov eax, dword [rbp - 0x6c]
sub eax, 0xe46c39d2
je 0x18001c427
jmp 0x18001c148
mov eax, dword [rbp - 0x6c]
sub eax, 0xe7cc6cc2
je 0x18001c366
jmp 0x18001c15b
mov eax, dword [rbp - 0x6c]
sub eax, 0xf55f6e40
je 0x18001c2b8
jmp 0x18001c16e
mov eax, dword [rbp - 0x6c]
sub eax, 0x1ad95964
je 0x18001c2ac
jmp 0x18001c181
mov eax, dword [rbp - 0x6c]
sub eax, 0x1f6c8998
je 0x18001c351
jmp 0x18001c194
mov eax, dword [rbp - 0x6c]
sub eax, 0x253b03bb
je 0x18001c411
jmp 0x18001c1a7
mov eax, dword [rbp - 0x6c]
sub eax, 0x291e02c5
je 0x18001c433
jmp 0x18001c1ba
mov eax, dword [rbp - 0x6c]
sub eax, 0x5bd30603
je 0x18001c468
jmp 0x18001c1cd
mov eax, dword [rbp - 0x6c]
sub eax, 0x620fead9
je 0x18001c3b3
jmp 0x18001c1e0
mov eax, dword [rbp - 0x6c]
sub eax, 0x638a56cd
je 0x18001c3f6
jmp 0x18001c1f3
mov eax, dword [rbp - 0x6c]
sub eax, 0x64088129
je 0x18001c264
jmp 0x18001c206
mov eax, dword [rbp - 0x6c]
sub eax, 0x6d2676ce
je 0x18001c2cc
jmp 0x18001c219
mov eax, dword [rbp - 0x6c]
sub eax, 0x72996eeb
je 0x18001c284
jmp 0x18001c22c
mov eax, dword [rbp - 0x6c]
sub eax, 0x7627cb68
je 0x18001c39c
jmp 0x18001c23f
jmp 0x18001c49b
mov eax, 0x10
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x5c], 0x64088129
jmp 0x18001c49b
mov eax, 0x10
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x5c], 0x72996eeb
jmp 0x18001c49b
mov eax, 0x10
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x5c], 0x1ad95964
jmp 0x18001c49b
mov dword [rbp - 0x5c], 0xf55f6e40
jmp 0x18001c49b
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x5c], 0x6d2676ce
jmp 0x18001c49b
mov rax, qword [rbp - 0x38]
mov ecx, dword [0x18008c7f0]
mov dword [rax], ecx
mov cx, word [0x18008c7f4]
mov word [rax + 4], cx
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x40]
mov edx, 2
mov r8d, 0x20
mov r9d, 0x220
xor r10d, r10d
sub rsp, 0x60
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
add rsp, 0x60
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x5c], 0x1f6c8998
jmp 0x18001c49b
mov rax, qword [rbp - 0x50]
mov ecx, dword [rbp - 0x30]
mov dword [rax], ecx
mov dword [rbp - 0x5c], 0xe7cc6cc2
jmp 0x18001c49b
mov rax, qword [rbp - 0x50]
cmp dword [rax], 0
setne al
and al, 1
mov byte [rbp - 0x29], al
mov dword [rbp - 0x5c], 0xaaf28789
jmp 0x18001c49b
mov dl, byte [rbp - 0x29]
mov eax, 0x5bd30603
mov ecx, 0x7627cb68
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x5c], eax
jmp 0x18001c49b
mov rax, qword [rbp - 0x40]
mov rax, qword [rax]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x5c], 0x620fead9
jmp 0x18001c49b
mov r8, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x28]
xor eax, eax
mov ecx, eax
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
add rsp, 0x20
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x5c], 0x8027a6fb
jmp 0x18001c49b
mov eax, dword [rbp - 0x20]
cmp eax, 0
setne al
and al, 1
mov byte [rbp - 0x19], al
mov dword [rbp - 0x5c], 0x638a56cd
jmp 0x18001c49b
mov dl, byte [rbp - 0x19]
mov eax, 0x253b03bb
mov ecx, 0x291e02c5
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x5c], eax
jmp 0x18001c49b
mov rax, qword [rbp - 0x50]
mov dword [rax], 0
mov dword [rbp - 0x5c], 0xe46c39d2
jmp 0x18001c49b
mov dword [rbp - 0x5c], 0x291e02c5
jmp 0x18001c49b
mov rax, qword [rbp - 0x40]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x5c], 0x95253ad0
jmp 0x18001c49b
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_FreeSid]
add rsp, 0x20
mov dword [rbp - 0x5c], 0x5bd30603
jmp 0x18001c49b
mov rax, qword [rbp - 0x50]
mov eax, dword [rax]
mov byte [rbp - 9], al
mov dword [rbp - 0x5c], 0x81160bb6
jmp 0x18001c49b
mov al, byte [rbp - 9]
mov byte [rbp - 0x6d], al
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18008ac40
mov al, byte [rbp - 0x6d]
mov rsp, rbp
pop rbp
ret
jmp 0x18001c0d3