Function at 0x1400281f0
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x140115ab8]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r14d, r14d
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400284d1
mov byte [rdx], r14b
lea r12, fcn.14000ec20
mov r8d, dword [rcx + 0x220]
xor edx, edx
mov ecx, 0x1fffff
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r14
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
mov rbx, rax
cmp rax, rcx
je 0x140028293
test rcx, rcx
je 0x14002828c
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
movabs r10, 0xefcdb65178560a70
lea rcx, [rbp - 0x31]
call qword [0x1400de010]
test al, al
je 0x14002851a
mov rcx, rbx
mov qword [rbp - 0x29], rbx
test rcx, rcx
jne 0x1400282c2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
mov esi, 0x80070000
or edi, esi
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x1400284b6
mov ebx, 0x104
lea r9, [rbp - 0x21]
lea r8, [rsi + 0x224]
mov dword [rbp - 0x21], ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_QueryFullProcessImageNameW]
nop dword [rax + rax]
or r15, 0xffffffffffffffff
test eax, eax
jne 0x14002831a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.QueryFullProcessImageName___failed__error___u_n
mov r8, r15
lea rcx, [rsi + 0x224]
mov dword [rsp + 0x20], eax
mov edx, ebx
call qword [sym.imp.msvcrt.dll__snwprintf_s]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
lea r8, [rbp - 1]
mov edx, 0xf01ff
mov qword [rbp - 9], r12
mov qword [rbp - 1], r14
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
jne 0x140028369
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
mov esi, 0x80070000
or edi, esi
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x140028497
mov rcx, qword [rbp - 1]
lea r13, fcn.14000ec20
lea r8, [rbp - 0x11]
mov qword [rbp - 0x19], r13
mov edx, 2
mov qword [rbp - 0x11], r15
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateToken]
nop dword [rax + rax]
test eax, eax
je 0x1400283ec
lea rax, [rbp + 7]
mov dword [rbp + 0xf], r14d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0xf]
mov dword [rsp + 0x48], r14d
mov r9d, 0x220
mov dword [rsp + 0x40], r14d
mov r8d, 0x20
mov dword [rsp + 0x38], r14d
mov dl, 2
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov word [rbp + 0x13], 0x500
mov qword [rbp + 7], r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
jne 0x140028413
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
mov esi, 0x80070000
or edi, esi
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x140028478
mov rbx, qword [rbp + 7]
lea r8, [rbp - 0x39]
mov rcx, qword [rbp - 0x11]
mov rdx, rbx
mov dword [rbp - 0x39], r14d
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
nop dword [rax + rax]
mov esi, 0x80070000
test eax, eax
jne 0x14002845d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x140028469
cmp dword [rbp - 0x39], r14d
setne al
mov byte [rdi], al
mov edi, r14d
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
nop dword [rax + rax]
mov qword [rbp - 0x19], r13
cmp qword [rbp - 0x11], r15
je 0x140028497
lea rcx, [rbp - 0x19]
call fcn.14000ec20
test al, al
je 0x14002853a
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r12
cmp qword [rbp - 1], r14
je 0x1400284b6
lea rcx, [rbp - 9]
call fcn.14000ec20
test al, al
je 0x140028556
mov qword [rbp - 1], r14
mov qword [rbp - 0x31], r12
cmp qword [rbp - 0x29], r14
je 0x1400284cd
lea rcx, [rbp - 0x31]
call fcn.14000ec20
test al, al
je 0x1400284fe
mov eax, edi
jmp 0x1400284d6
mov eax, 0x80004003
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400d22a0
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
call fcn.14000ec00
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000ec00
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
call fcn.14000ec00
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
call fcn.14000ec00
int3