Function at 0x1800276f0
Capabilities:
Get token membership

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x60], rcx
mov rax, qword [0x1800eb0a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x54], 0x1d875be8
mov eax, dword [rbp - 0x54]
mov dword [rbp - 0x64], eax
sub eax, 0x84671d05
je 0x180027ba5
jmp 0x18002772f
mov eax, dword [rbp - 0x64]
sub eax, 0xb6fb626a
je 0x180027acb
jmp 0x180027742
mov eax, dword [rbp - 0x64]
sub eax, 0xbb224c36
je 0x180027c07
jmp 0x180027755
mov eax, dword [rbp - 0x64]
sub eax, 0xc8c8b8e1
je 0x180027b1a
jmp 0x180027768
mov eax, dword [rbp - 0x64]
sub eax, 0xd7192d90
je 0x1800279bc
jmp 0x18002777b
mov eax, dword [rbp - 0x64]
sub eax, 0xebf12bb9
je 0x180027ab0
jmp 0x18002778e
mov eax, dword [rbp - 0x64]
sub eax, 0x63be72
je 0x180027bb1
jmp 0x1800277a1
mov eax, dword [rbp - 0x64]
sub eax, 0x31f3189
je 0x180027bd4
jmp 0x1800277b4
mov eax, dword [rbp - 0x64]
sub eax, 0x8b32044
je 0x180027980
jmp 0x1800277c7
mov eax, dword [rbp - 0x64]
sub eax, 0x8d38304
je 0x180027c35
jmp 0x1800277da
mov eax, dword [rbp - 0x64]
sub eax, 0xadde93e
je 0x180027a96
jmp 0x1800277ed
mov eax, dword [rbp - 0x64]
sub eax, 0xed9dabd
je 0x180027bf2
jmp 0x180027800
mov eax, dword [rbp - 0x64]
sub eax, 0x1d875be8
je 0x18002788a
jmp 0x180027813
mov eax, dword [rbp - 0x64]
sub eax, 0x32f6f275
je 0x180027a56
jmp 0x180027826
mov eax, dword [rbp - 0x64]
sub eax, 0x49d59dab
je 0x180027bbd
jmp 0x180027839
mov eax, dword [rbp - 0x64]
sub eax, 0x59ef10b6
je 0x180027a6d
jmp 0x18002784c
mov eax, dword [rbp - 0x64]
sub eax, 0x5c9280d2
je 0x180027c29
jmp 0x18002785f
mov eax, dword [rbp - 0x64]
sub eax, 0x730c9fe5
je 0x180027906
jmp 0x180027872
mov eax, dword [rbp - 0x64]
sub eax, 0x7350d968
je 0x18002798c
jmp 0x180027885
jmp 0x180027c46
mov ecx, dword [0x18184c8bc]
mov eax, dword [0x18184c8b8]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5c9280d2
mov ecx, 0x730c9fe5
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x54], eax
jmp 0x180027c46
mov eax, 0x10
mov qword [rbp - 0x70], rax
call fcn.1800e0a50
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov rcx, rsp
mov qword [rbp - 0x48], rcx
call fcn.1800e0a50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov eax, dword [0x18184c8bc]
mov ecx, dword [0x18184c8b8]
mov edx, eax
add edx, 0xe7c0531
sub edx, 1
sub edx, 0xe7c0531
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5c9280d2
mov ecx, 0x8b32044
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x54], eax
jmp 0x180027c46
mov dword [rbp - 0x54], 0x7350d968
jmp 0x180027c46
mov eax, 0x10
call fcn.1800e0a50
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x54], 0xd7192d90
jmp 0x180027c46
mov rax, qword [rbp - 0x30]
mov ecx, dword [0x1800e2710]
mov dword [rax], ecx
mov cx, word [0x1800e2714]
mov word [rax + 4], cx
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x38]
mov edx, 2
mov r8d, 0x20
mov r9d, 0x220
xor r10d, r10d
sub rsp, 0x60
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
add rsp, 0x60
mov ecx, eax
mov rax, qword [rbp - 0x48]
mov dword [rax], ecx
mov rdx, qword [rbp - 0x48]
mov eax, 0xed9dabd
mov ecx, 0x32f6f275
cmp dword [rdx], 0
cmovne eax, ecx
mov dword [rbp - 0x54], eax
jmp 0x180027c46
mov rax, qword [rbp - 0x38]
mov rax, qword [rax]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x54], 0x59ef10b6
jmp 0x180027c46
mov r8, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x28]
xor eax, eax
mov ecx, eax
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
add rsp, 0x20
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x54], 0xadde93e
jmp 0x180027c46
mov eax, dword [rbp - 0x20]
cmp eax, 0
setne al
and al, 1
mov byte [rbp - 0x19], al
mov dword [rbp - 0x54], 0xebf12bb9
jmp 0x180027c46
mov dl, byte [rbp - 0x19]
mov eax, 0xb6fb626a
mov ecx, 0x49d59dab
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x54], eax
jmp 0x180027c46
mov eax, dword [0x18184c8bc]
mov ecx, dword [0x18184c8b8]
mov edx, eax
add edx, 0x4d32b77f
sub edx, 1
sub edx, 0x4d32b77f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d38304
mov ecx, 0xc8c8b8e1
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x54], eax
jmp 0x180027c46
mov rax, qword [rbp - 0x48]
mov dword [rax], 0
mov ecx, dword [0x18184c8bc]
mov eax, dword [0x18184c8b8]
mov edx, ecx
sub edx, 0xe8aaed32
sub edx, 1
add edx, 0xe8aaed32
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8d38304
mov ecx, 0x84671d05
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x54], eax
jmp 0x180027c46
mov dword [rbp - 0x54], 0x63be72
jmp 0x180027c46
mov dword [rbp - 0x54], 0x49d59dab
jmp 0x180027c46
mov rax, qword [rbp - 0x38]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x54], 0x31f3189
jmp 0x180027c46
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_FreeSid]
add rsp, 0x20
mov dword [rbp - 0x54], 0xed9dabd
jmp 0x180027c46
mov rax, qword [rbp - 0x48]
mov eax, dword [rax]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x54], 0xbb224c36
jmp 0x180027c46
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x74], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.1800e09d0
mov eax, dword [rbp - 0x74]
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
mov dword [rbp - 0x54], 0x730c9fe5
jmp 0x180027c46
mov rax, qword [rbp - 0x48]
mov dword [rax], 0
mov dword [rbp - 0x54], 0xc8c8b8e1
jmp 0x180027719