Function at 0x1400016a0
Capabilities:
Get system information on windows
Get token membership

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14005b0e8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [0x1417bba30], rcx
mov ecx, 1
call fcn.14002dea0
mov rcx, qword [0x1417bba30]
xor r14d, r14d
mov qword [rcx + 0x230], rax
lea rbx, [rcx + 0x78]
mov dword [rcx + 0x44], r14d
mov byte [rcx + 0x50], 0x7f
mov qword [rcx + 0x60], r14
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
xor edx, edx
mov r8d, 0x11c
mov rcx, rbx
mov rdi, rax
call sub.msvcrt.dll_memset
test rdi, rdi
je 0x140001732
lea rdx, str.RtlGetVersion
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x140001732
mov rcx, rbx
mov dword [rbx], 0x11c
call rax
mov rcx, qword [0x1417bba30]
add rcx, 0x198
call qword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
mov rax, qword [0x1417bba30]
cmp dword [rax + 0x3c], r14d
je 0x140001766
lea rdx, str.NWinfo
lea rcx, str._DBG__ALLOC___s__n
call fcn.140001010
mov edx, 0x2f
lea ecx, [rdx - 0x2e]
call qword [sym.imp.msvcrt.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140001c43
mov edx, 8
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], rsi
lea ecx, [rdx - 7]
call qword [sym.imp.msvcrt.dll_calloc]
mov edx, 8
mov qword [rbx + 0x18], rax
lea ecx, [rdx - 7]
call qword [sym.imp.msvcrt.dll_calloc]
lea rcx, [rbx + 0x28]
mov edx, 7
lea r8, str.NWinfo
mov qword [rbx + 8], rax
mov qword [rbx], rcx
call fcn.140031cc0
mov rax, qword [0x1417bba30]
mov dword [rbx + 0x20], r14d
mov qword [rax + 0x220], rbx
call fcn.14001e610
mov rcx, qword [0x1417bba30]
mov rbp, r14
mov qword [rcx + 0x210], rax
mov ecx, 0x20000
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400018e9
mov edx, 0x80000
mov r8d, 0x10000
mov rcx, rax
call fcn.140003e80
test eax, eax
je 0x1400018e0
lea rsi, [rdi + 0x10000]
mov qword [rsp + 0xb8], r15
mov rbx, rdi
movabs r15, 0x2052545020445352
cmp rdi, rsi
jae 0x140001866
cmp qword [rbx], r15
jne 0x14000185d
mov edx, 0x14
mov rcx, rbx
call fcn.140004520
test al, al
je 0x1400018b1
add rbx, 0x10
cmp rbx, rsi
jb 0x140001847
mov edx, 0xe0000
mov r8d, 0x20000
mov rcx, rdi
call fcn.140003e80
test eax, eax
je 0x1400018d8
lea rsi, [rdi + 0x20000]
mov rbx, rdi
cmp rdi, rsi
jae 0x1400018d8
nop dword [rax]
cmp qword [rbx], r15
jne 0x1400018a6
mov edx, 0x14
mov rcx, rbx
call fcn.140004520
test al, al
je 0x1400018c0
add rbx, 0x10
cmp rbx, rsi
jb 0x140001890
jmp 0x1400018d8
mov rdx, rbx
sub rdx, rdi
add rdx, 0x80000
jmp 0x1400018cd
mov rdx, rbx
sub rdx, rdi
add rdx, 0xe0000
mov rcx, rbx
call fcn.140004210
mov rbp, rax
mov r15, qword [rsp + 0xb8]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rax, qword [0x1417bba30]
mov qword [rax + 0x1d8], rbp
call fcn.140004350
mov rcx, qword [0x1417bba30]
mov qword [rcx + 0x1e0], rax
call fcn.140004430
mov rcx, qword [0x1417bba30]
mov qword [rcx + 0x1e8], rax
call fcn.1400040d0
mov rcx, qword [0x1417bba30]
mov qword [rcx + 0x1f0], rax
call fcn.14000f8c0
mov rcx, qword [0x1417bba30]
mov edx, 0x10
mov qword [rcx + 0x200], rax
mov qword [rcx + 0x208], 0x1fbff81
lea ecx, [rdx - 0xf]
call qword [sym.imp.msvcrt.dll_calloc]
mov rcx, qword [0x1417bba30]
mov edx, 0x28
mov qword [rcx + 0x1c8], rax
lea ecx, [rdx - 0x27]
call qword [sym.imp.msvcrt.dll_calloc]
mov rcx, qword [0x1417bba30]
mov qword [rcx + 0x1d0], rax
cmp qword [rcx + 0x1c8], r14
je 0x140001c31
test rax, rax
je 0x140001c31
lea rax, [0x14005b110]
mov dword [rcx + 0x1f8], r14d
mov qword [rcx + 0x238], rax
mov r9d, 0x220
lea rax, [rsp + 0x60]
mov qword [rcx + 0x240], r14
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x48], r14d
mov r8d, 0x20
mov dword [rsp + 0x40], r14d
mov dl, 2
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x68], r14d
mov word [rsp + 0x6c], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x70], eax
test eax, eax
je 0x140001a37
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140001a28
mov dword [rsp + 0x70], r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x70]
mov r14, 0xffffffffffffffff
cmp eax, 1
je 0x140001b15
mov rbp, qword [0x1417bba30]
mov rbx, qword [rbp + 0x240]
test rbx, rbx
jne 0x140001a9b
mov ecx, 0x16
lea edx, [rbx + 1]
add ecx, 2
call qword [sym.imp.msvcrt.dll_calloc]
mov qword [rbp + 0x240], rax
test rax, rax
je 0x140001c55
movups xmm0, xmmword [str.Administrator_required]
movups xmmword [rax], xmm0
mov ecx, dword [0x14003a4a0]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14003a4a4]
mov word [rax + 0x14], cx
jmp 0x140001b15
mov edx, 1
lea eax, [rdx - 1]
cmp byte [rax + rbx], 0
jne 0x140001ab1
mov edi, edx
cmp byte [rdi + rbx], 0
je 0x140001ab5
inc edx
jmp 0x140001aa0
lea ecx, [rdx + 0x16]
mov edx, 1
add ecx, 2
cmovb rcx, r14
call qword [sym.imp.msvcrt.dll_calloc]
mov rsi, rax
test rax, rax
je 0x140001c55
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
movups xmm0, xmmword [str.Administrator_required]
mov rcx, rbx
movups xmmword [rdi + rsi], xmm0
mov edx, dword [0x14003a4a0]
mov dword [rdi + rsi + 0x10], edx
movzx eax, word [0x14003a4a4]
mov word [rdi + rsi + 0x14], ax
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbp + 0x240], rsi
call fcn.140003d00
test eax, eax
je 0x140001b7d
mov rbp, qword [0x1417bba30]
mov rbx, qword [rbp + 0x240]
test rbx, rbx
jne 0x140001ba6
mov ecx, 0x25
lea edx, [rbx + 1]
add ecx, 2
call qword [sym.imp.msvcrt.dll_calloc]
mov qword [rbp + 0x240], rax
mov rdx, rax
test rax, rax
je 0x140001c55
movups xmm0, xmmword [str.SeSystemEnvironmentPrivilege_required]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14003a4f8]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x14003a508]
mov dword [rax + 0x20], ecx
movzx eax, byte [0x14003a50c]
mov byte [rdx + 0x24], al
mov rbp, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140029990
add rsp, 0x80
pop r14
pop rdi
pop rbx
ret
mov edx, 1
nop dword [rax + rax]
lea eax, [rdx - 1]
cmp byte [rax + rbx], 0
jne 0x140001bc1
mov edi, edx
cmp byte [rdi + rbx], 0
je 0x140001bc5
inc edx
jmp 0x140001bb0
lea ecx, [rdx + 0x25]
mov edx, 1
add ecx, 2
cmovb rcx, r14
call qword [sym.imp.msvcrt.dll_calloc]
mov rsi, rax
test rax, rax
je 0x140001c55
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
movups xmm0, xmmword [str.SeSystemEnvironmentPrivilege_required]
mov rcx, rbx
movups xmmword [rdi + rsi], xmm0
movups xmm1, xmmword [0x14003a4f8]
movups xmmword [rdi + rsi + 0x10], xmm1
mov eax, dword [0x14003a508]
mov dword [rdi + rsi + 0x20], eax
movzx eax, byte [0x14003a50c]
mov byte [rdi + rsi + 0x24], al
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbp + 0x240], rsi
jmp 0x140001b7d
lea rdx, str.Cannot_allocate_memory
mov ecx, 0xe
call fcn.140001650
int3
lea rdx, str.Failed_to_allocate_memory_in_NWL_NodeAlloc
mov ecx, 0xe
call fcn.140001650
int3
lea rdx, str.Failed_to_allocate_memory_in_NWL_NodeAppendMultiSz
mov ecx, 0xe
call fcn.140001650
int3