Function at 0x140001200
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
xor ebx, ebx
mov word [rsp + 0x68], 0x500
lea rax, [rsp + 0x70]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x64]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
mov r8d, 0x20
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x64], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001283
mov rdx, qword [rsp + 0x70]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140001278
mov dword [rsp + 0x60], ebx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], ebx
je 0x14000155d
mov qword [rsp + 0x90], rdi
lea r10, str.ghiihojtxmhgnuhm
mov r8d, ebx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r10 + rax], bl
jne 0x1400012a6
lea rdi, [0x140003280]
test rax, rax
je 0x140001302
mov r9, r10
nop
mov eax, 0x2aaaaaab
lea r9, [r9 + 1]
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*2]
mov rdx, 0xffffffffffffffff
add ecx, ecx
sub eax, ecx
cdqe
movzx eax, byte [rdi + rax*4]
sub byte [r9 - 1], al
inc r8d
inc rdx
cmp byte [r10 + rdx], bl
jne 0x1400012f1
movsxd rax, r8d
cmp rax, rdx
jb 0x1400012c0
mov rcx, r10
call fcn.140001070
mov r8d, ebx
lea r10, str.ghiihojtxmhhshom
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r10 + rax], bl
jne 0x140001320
test rax, rax
je 0x140001373
mov r9, r10
mov eax, 0x2aaaaaab
lea r9, [r9 + 1]
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*2]
mov rdx, 0xffffffffffffffff
add ecx, ecx
sub eax, ecx
cdqe
movzx eax, byte [rdi + rax*4]
sub byte [r9 - 1], al
inc r8d
inc rdx
cmp byte [r10 + rdx], bl
jne 0x140001362
movsxd rax, r8d
cmp rax, rdx
jb 0x140001331
mov rcx, r10
call fcn.140001070
mov r8d, ebx
lea r10, str.hgl_km_kg___rpj
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r10 + rax], bl
jne 0x140001390
test rax, rax
je 0x1400013e3
mov r9, r10
mov eax, 0x2aaaaaab
lea r9, [r9 + 1]
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*2]
mov rdx, 0xffffffffffffffff
add ecx, ecx
sub eax, ecx
cdqe
movzx eax, byte [rdi + rax*4]
sub byte [r9 - 1], al
inc r8d
inc rdx
cmp byte [r10 + rdx], bl
jne 0x1400013d2
movsxd rax, r8d
cmp rax, rdx
jb 0x1400013a1
mov rcx, r10
call fcn.140001070
mov r8d, ebx
lea r10, str.hgl_km_kg___tro
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r10 + rax], bl
jne 0x140001400
test rax, rax
je 0x140001453
mov r9, r10
mov eax, 0x2aaaaaab
lea r9, [r9 + 1]
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*2]
mov rdx, 0xffffffffffffffff
add ecx, ecx
sub eax, ecx
cdqe
movzx eax, byte [rdi + rax*4]
sub byte [r9 - 1], al
inc r8d
inc rdx
cmp byte [r10 + rdx], bl
jne 0x140001442
movsxd rax, r8d
cmp rax, rdx
jb 0x140001411
mov rcx, r10
call fcn.140001070
mov r8d, ebx
lea r10, str.wgtxoykiqvotnutnojijtnojmn
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r10 + rax], bl
jne 0x140001470
test rax, rax
je 0x1400014c3
mov r9, r10
mov eax, 0x2aaaaaab
lea r9, [r9 + 1]
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*2]
mov rdx, 0xffffffffffffffff
add ecx, ecx
sub eax, ecx
cdqe
movzx eax, byte [rdi + rax*4]
sub byte [r9 - 1], al
inc r8d
inc rdx
cmp byte [r10 + rdx], bl
jne 0x1400014b2
movsxd rax, r8d
cmp rax, rdx
jb 0x140001481
mov rcx, r10
call fcn.140001070
lea r9, str.pxszfsnsoipzqpsqrm
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r9 + rax], bl
jne 0x1400014e0
test rax, rax
je 0x140001542
mov r8, r9
nop dword [rax]
nop word [rax + rax]
mov eax, 0x2aaaaaab
lea r8, [r8 + 1]
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
lea ecx, [rdx + rdx*2]
mov rdx, 0xffffffffffffffff
add ecx, ecx
sub eax, ecx
cdqe
movzx eax, byte [rdi + rax*4]
sub byte [r8 - 1], al
inc ebx
nop
inc rdx
cmp byte [r9 + rdx], 0
jne 0x140001530
movsxd rax, ebx
cmp rax, rdx
jb 0x140001500
mov rcx, r9
call fcn.140001070
mov rdi, qword [rsp + 0x90]
xor eax, eax
add rsp, 0x80
pop rbx
ret
call fcn.140001170
int3