Function at 0x1400e47a0
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xa20]
sub rsp, 0xb20
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0xa10], rax
xor esi, esi
mov rdi, rcx
cmp dword [rcx + 0xed70], esi
je 0x1400e4818
mov rcx, qword [rcx + 0xa50]
mov rax, qword [rcx]
call qword [rax + 0x120]
test eax, eax
jne 0x1400e4818
lea rcx, [rdi + 0x1338]
test rcx, rcx
je 0x1400e4856
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rsi
call fcn.140094590
test eax, eax
js 0x1400e484b
mov r8d, 0x8000
jmp 0x1400e483a
lea rcx, [rdi + 0x1338]
test rcx, rcx
je 0x1400e4856
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rsi
call fcn.140094590
test eax, eax
js 0x1400e484b
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x400]
call fcn.140092ff0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ebx, 0x200
lea r9, [rbp + 0x400]
lea r8, str._s___Explorer
lea rcx, [rbp]
mov edx, ebx
call section..text
mov r10d, dword [rdi + 0xeda0]
test r10d, r10d
jne 0x1400e4888
cmp dword [rdi + 0xeda4], esi
je 0x1400e48fc
mov rcx, rbx
lea rax, [rbp]
nop
cmp word [rax], si
je 0x1400e48a0
add rax, 2
dec rcx
jne 0x1400e4890
jmp 0x1400e48fc
test rcx, rcx
je 0x1400e48fc
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rbp + rdx*2]
je 0x1400e48f5
lea r9, [0x14010c728]
lea r8, [rcx + rdx + 0x7ffffdff]
sub r9, rax
nop word [rax + rax]
test r8, r8
je 0x1400e48f0
movzx edx, word [rax + r9]
test dx, dx
je 0x1400e48f0
mov word [rax], dx
add rax, 2
dec r8
dec rcx
jne 0x1400e48d0
jmp 0x1400e48f5
test rcx, rcx
jne 0x1400e48f9
sub rax, 2
mov word [rax], si
test r10d, r10d
je 0x1400e497e
lea rcx, [rbp + 0x610]
call fcn.140096a10
mov r11, rbx
lea rax, [rbp]
cmp word [rax], si
je 0x1400e4924
add rax, 2
dec r11
jne 0x1400e4914
jmp 0x1400e497e
test r11, r11
je 0x1400e497e
mov rdx, rbx
mov rcx, rbx
sub rdx, r11
sub rcx, rdx
lea rax, [rbp + rdx*2]
je 0x1400e4977
lea r9, [rbp + 0x610]
lea rdx, [rcx + rdx + 0x7ffffdff]
sub r9, rax
nop
test rdx, rdx
je 0x1400e4972
movzx r8d, word [rax + r9]
test r8w, r8w
je 0x1400e4972
mov word [rax], r8w
add rax, 2
dec rdx
dec rcx
jne 0x1400e4950
jmp 0x1400e4977
test rcx, rcx
jne 0x1400e497b
sub rax, 2
mov word [rax], si
cmp dword [rdi + 0xeda4], esi
je 0x1400e4c1c
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x20], esi
mov word [rsp + 0x74], 0x500
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400e49f5
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], esi
je 0x1400e4a07
lea r8, str.Administrators
jmp 0x1400e4b76
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, 0x223
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x20], esi
mov word [rsp + 0x74], 0x500
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400e4a72
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], esi
je 0x1400e4a84
lea r8, str.Power_Users
jmp 0x1400e4b76
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, 0x221
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x20], esi
mov word [rsp + 0x74], 0x500
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400e4aef
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], esi
je 0x1400e4afe
lea r8, str.Users
jmp 0x1400e4b76
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, 0x222
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x20], esi
mov word [rsp + 0x74], 0x500
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400e4b69
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], esi
je 0x1400e4b84
lea r8, str.Users_Restricted
lea rcx, [rbp - 0x80]
mov edx, 0x20
call section..text
lea r9, [rbp - 0x80]
mov edx, 0x20
lea rcx, [rbp - 0x40]
lea r8, str.____s
cmp dword [rdi + 0xeda0], esi
jne 0x1400e4ba7
lea r8, [0x14010c7ac]
call section..text
mov rcx, rbx
lea rax, [rbp]
cmp word [rax], si
je 0x1400e4bc3
add rax, 2
dec rcx
jne 0x1400e4bb3
jmp 0x1400e4c1c
test rcx, rcx
je 0x1400e4c1c
mov rdx, rbx
sub rdx, rcx
mov rcx, rbx
sub rcx, rdx
lea rax, [rbp + rdx*2]
je 0x1400e4c15
lea r9, [rbp - 0x40]
lea r8, [rcx + rdx + 0x7ffffdff]
sub r9, rax
nop word [rax + rax]
test r8, r8
je 0x1400e4c10
movzx edx, word [rax + r9]
test dx, dx
je 0x1400e4c10
mov word [rax], dx
add rax, 2
dec r8
dec rcx
jne 0x1400e4bf0
jmp 0x1400e4c15
test rcx, rcx
jne 0x1400e4c19
sub rax, 2
mov word [rax], si
cmp dword [rdi + 0xeda0], esi
jne 0x1400e4c2c
cmp dword [rdi + 0xeda4], esi
je 0x1400e4c9c
mov rcx, rbx
lea rax, [rbp]
cmp word [rax], si
je 0x1400e4c43
add rax, 2
dec rcx
jne 0x1400e4c33
jmp 0x1400e4c9c
test rcx, rcx
je 0x1400e4c9c
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [rbp + rdx*2]
je 0x1400e4c95
lea r8, [0x140104b14]
lea rcx, [rbx + rdx + 0x7ffffdff]
sub r8, rax
nop word [rax + rax]
test rcx, rcx
je 0x1400e4c90
movzx edx, word [rax + r8]
test dx, dx
je 0x1400e4c90
mov word [rax], dx
add rax, 2
dec rcx
dec rbx
jne 0x1400e4c70
jmp 0x1400e4c95
test rbx, rbx
jne 0x1400e4c99
sub rax, 2
mov word [rax], si
mov rcx, qword [rdi + 0x68]
lea rdx, [rbp]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbp + 0xa10]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0xb20]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret