Function at 0x14000ad70
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
xor eax, eax
test eax, eax
je 0x14000af8e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jb 0x14000adfb
jo 0x14000ae08
outsd dx, dword [rsi]
jb 0x14000add5
cld
invalid
outsb dx, byte [esi]
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
or al, 0
add al, 0xc0
jne 0x14000ade8
xor eax, eax
pop rsi
pop rbx
ret
mov eax, dword [rbx + 0x1004c]
add dword [rbx + 0x4489da8b], esi
and al, 4
push rsp
mov eax, dword [rsp + 8]
push rax
call 0x140f49fec
or dl, byte [rdx + 0x65]
jae 0x14000ae6b
je 0x14000ae4d
jbe 0x14000ae6f
outsb dx, byte [rsi]
je 0x14000ae10
add byte [rax], al
add byte [rax - 0x80000000], al
invalid
add byte [rax], 0
add byte [rax + 0x4307ffff], al
jne 0x14000ae8d
jb 0x14000ae82
outsb dx, byte [rsi]
je 0x14000ae20
add al, 0x53
insb byte [rdi], dx
add al, byte [rax]
add al, byte [rax]
sub eax, 0x6c6c2800
add byte [0x1b2661ba9], cl
invalid
insb byte [rdi], dx
add bl, ch
jmp 0x14000ae96
int3
ret
mov dword [rax], edx
push 0x57d309
mov eax, dword [rbp - 8]
call 0x193e95fd4
mov r9b, 0xe8
push rbx
add byte [rbp], ah
je 0x14000ae96
jne 0x14000ae98
jo 0x14000ae9a
add byte [rax], al
mov al, 4
add al, byte [rax]
insb byte [rdi], dx
add al, byte [rax]
add byte [rax + riz + 0x55], bh
add byte [rcx], al
add byte [rsi], al
je 0x14000af11
adc byte [rcx - 0x1414001e], 0x8b
ret
pop rdx
pop rcx
pop rcx
mov dword fs:[rax], edx
push 0x4752c7
mov eax, dword [rbp - 4]
mov esi, dword [rbx + 0x420058]
hlt
xor eax, eax
test eax, eax
je 0x14000b1a5
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rbp], r14b
outsb dx, byte [rsi]
add byte [rbx], ah
je 0x14000afaa
imul eax, dword [rax], 0x6e006f
xor eax, eax
test eax, eax
je 0x14000b3bc
nop
add byte [rdx], al
add byte [rax], al
sub byte [rsp + rbp*2], ch
add edx, dword [rbx + 0x41]
push rdx
add eax, dword [rax]
add byte [rdi + rax*4 - 0x7863ffc0], ah
add byte [rdi + rax*4 - 0x783fffc0], dil
add bpl, bpl
inc dword [rbp + 0x7f840fc0]
add al, byte [rax]
add al, ch
insd dword [rdi], dx
pop rbx
add eax, dword [rax]
mov edx, dword [rax]
add byte [rax], al
add byte [rcx + rax*2 + 0x53], dl
push r11
push rax
invalid
xor eax, eax
test eax, eax
je 0x14000b5d3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
je 0x14000b3da
add esp, 0xfffffff0
call 0x13fecfbb0
mov ebx, edx
mov esi, eax
xor edx, edx
pop rsi
add byte [0x17501122a], dh
pop r14
add ch, bl
pop r14
add byte [0x14008b436], dh
add dword [rax], ecx
xor bh, ch
pop rax
add byte [rax], al
add byte [rbx + rdx*2], al
insb byte [rdi], dx
add byte [rcx], al
add byte [0x1b2621c4d], al
jae 0x14000b40e
add byte [rax], al
pushfq
adc byte [rbp + 3], bh
mov dword [rbp - 0x34], eax
call 0x14003ba4c
mov edx, 0xff00000f
call 0x1b500b463
invalid
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 5
xor eax, eax
test eax, eax
je 0x14000b819
nop
nop
nop
nop
outsb dx, byte [rsi]
js 0x14000b618
add byte [rdx], al
add byte [0x1ac6cde1e], ah
add byte [0x18341bf24], al
outsd dx, dword [rsi]
insd dword [rdi], dx
jo 0x14000b689
jb 0x14000b68f
jb 0x14000b62e
add byte [rdx], al
add byte [rax], ah
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add byte [rax - 0x3bffaa26], ah
in al, 0x53
push rsi
push rdi
xor eax, eax
mov dword [rbp - 0x14], eax
mov dword [rbp - 4], eax
xor eax, eax
push rbp
cmp byte [rbx + 0x300e9], bl
add byte [rbx + 0x178bf845], cl
mov dword [rax], edx
mov edx, dword [rdi + 0x75]
adc dword [rbx + 0x4503ec45], ecx
rol byte [rcx], 0x45
mov eax, 0x1d0458b
outsb dx, byte [rsi]
js 0x14000b677
add byte [rdx], cl
invalid
inc ebx
jmp 0x13fe059c4
inc ebx
call 0x13ffea718
test al, al
jne 0x14000b6cc
mov eax, ebx
call 0x1acfe8e2c
insb byte [rdi], dx
add byte [rcx], dl
je 0x14000b6ed
insb byte [rdi], dx
insd dword [rdi], dx
outsb dx, byte gs:[rsi]
je 0x14000b6f3
jmp 0x14000b6c5
mov eax, ebx
mov edx, dword [rax]
call qword [rdx + 0x140]
test byte [rdx], 0x79
add byte [rax], cl
invalid
add dword [rax], eax
add dh, dh
add byte [rcx], dil
add byte [rcx], spl
outsb dx, byte [rsi]
add byte [rax + rax + 0x6c], ah
add byte [rbp], ah
add byte [rcx], cl
invalid
add byte [rax], al
or byte [rbp - 0x6171f025], al
add byte [rax], al
add byte [rbp - 0x75], dl
invalid
mov ds, word [rsi + 0x55000000]
mov eax, esi
mov edx, 0xa
add al, byte [rax]
add byte [rax], al
jmp 0x14000b76f
add byte [rdi], cl
invalid
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000bccf
xor eax, eax
test eax, eax
je 0x14000ba8b
nop
nop
add byte [rbx + rdx*2], al
insb byte [rdi], dx
add al, byte [rax]
in al, 0x63
add byte [rcx], al
add byte [rcx], al
add byte [0x1a56526df], al
js 0x14000b89a
add byte [rdx], al
ror byte [rbx + 0x40], 0
add al, byte [rax]
add ah, dh
dec dword [rdx + 0x420048e9]
add ah, dh
call rdx
jmp 0x14042b8f9
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000bcc4
xor eax, eax
test eax, eax
je 0x14000bcbc
nop
invalid
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
test eax, eax
je 0x14000bee6
nop
nop
nop
nop
nop
nop
nop
add al, 0
mov eax, eax
push rbp
mov ebp, esp
add esp, 0xfffffff4
push rbx
push rsi
mov esi, dword [rbp + 8]
mov bl, 4
push rbx
insb byte [rdi], dx
add al, byte [rax]
add al, byte [rax]
add byte [r8 - 0x45], r9b
push rcx
add byte [rbx], cl
add byte [rax], al
add byte [rax], al
add byte [rax], 0
add byte [rax + 0x480fffff], al
loopne 0x14000bd49
invalid
jmp 0x14000bda2
invalid
mov eax, dword [rsp + 0x60]
add rsp, 0x88
ret