Function at 0x1000022f8
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa40
mov rax, qword [0x100005110]
xor rax, rsp
mov qword [rsp + 0xa30], rax
mov rbp, rdx
mov esi, ecx
xor r12d, r12d
xor edx, edx
mov ecx, 0x100
xor r8d, r8d
mov dword [rsp + 0x64], r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
lea r13d, [r12 + 1]
mov edx, r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rax, [0x1000012f0]
lea rbx, [0x100005be8]
mov qword [0x100005bf8], r12
mov qword [0x100005be8], r12
mov qword [0x100005c08], rax
mov byte [0x100005c00], r13b
mov byte [0x100005c01], r12b
mov qword [0x100005120], rbx
mov word [0x100005c02], r12w
mov dword [0x100005c04], r12d
lea rdi, [0x100005c08]
mov r8, qword [rdi]
lea rax, [rbx + 8]
lea rcx, [0x100001644]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], r12
mov r9d, r13d
mov rdx, rbx
mov qword [rsp + 0x28], r12
add rdi, 8
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rbx, qword [rbx]
cmp rbx, r12
jne 0x1000023a2
lea rcx, [0x1000013a0]
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea r14, [0x100005120]
mov edi, 0xa
mov qword [0x100005c10], rax
lea r15, [0x100001370]
cmp rax, r12
jne 0x100002447
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x1000024ad
test byte [rcx + 0x1c], r13b
je 0x1000024ad
mov rcx, qword [rcx + 0x10]
mov edx, edi
mov r9d, eax
mov r8, r15
call fcn.100001604
jmp 0x1000024ad
lea rdx, [0x1000013b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100005c10]
lea rdx, [0x1000013c8]
mov qword [0x100006360], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100006368], rax
cmp qword [0x100006360], r12
je 0x100002487
cmp rax, r12
jne 0x1000024ad
mov ebx, 0x7f
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x1000024ad
test byte [rcx + 0x1c], r13b
je 0x1000024ad
mov rcx, qword [rcx + 0x10]
lea edx, [rbx - 0x74]
mov r8, r15
call fcn.1000015d8
cmp ebx, r12d
jne 0x10000294f
call fcn.1000016f4
lea rax, [rsp + 0x68]
lea rcx, [0x100005618]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r12d
je 0x10000252b
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
cmp rcx, r12
je 0x10000253b
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], r12d
jne 0x10000255d
lea rdx, [0x100005c18]
mov r8d, edi
xor ecx, ecx
mov ebx, 5
call fcn.100001834
jmp 0x10000294f
lea r8, [rsp + 0x64]
mov rdx, rbp
mov ecx, esi
call fcn.1000019cc
mov ebx, eax
cmp eax, r12d
jne 0x10000294f
mov eax, dword [rsp + 0x64]
sub eax, r13d
je 0x1000028e1
sub eax, r13d
je 0x100002731
sub eax, r13d
je 0x100002715
sub eax, r13d
je 0x10000270c
sub eax, r13d
je 0x100002707
sub eax, r13d
je 0x100002687
sub eax, r13d
je 0x10000263d
sub eax, r13d
je 0x100002633
cmp eax, 6
je 0x1000025f7
mov ebx, 0x57
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x100002901
test byte [rcx + 0x1c], r13b
je 0x100002901
mov rcx, qword [rcx + 0x10]
lea edx, [rbx - 0x3d]
mov r8, r15
call fcn.1000015d8
jmp 0x100002901
xor edx, edx
lea ecx, [rdx + 4]
call sub.ReAgent.dll_WinReSetRecoveryAction
cmp eax, r12d
jne 0x100002934
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x1000028fc
test byte [rcx + 0x1c], r13b
je 0x1000028fc
mov edx, 0x19
jmp 0x100002673
call fcn.1000020c0
jmp 0x10000272a
call qword [0x100006368]
cmp eax, r12d
jne 0x100002934
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x1000028fc
test byte [rcx + 0x1c], r13b
je 0x1000028fc
mov edx, 0x18
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r15
call fcn.100001604
jmp 0x1000028fc
lea rcx, [0x100006100]
mov ebx, r12d
call qword [sym.imp.msvcrt.dll__wtoi]
lea ecx, [rax - 1]
cmp ecx, 5
ja 0x1000026da
xor edx, edx
mov ecx, eax
call sub.ReAgent.dll_WinReSetRecoveryAction
cmp eax, r12d
jne 0x1000028fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x1000028fc
test byte [rcx + 0x1c], r13b
je 0x1000028fc
mov edx, 0x14
jmp 0x100002673
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x1000026fd
test byte [rcx + 0x1c], r13b
je 0x1000026fd
mov rcx, qword [rcx + 0x10]
mov edx, 0x13
mov r8, r15
call fcn.1000015d8
mov ebx, 0x57
jmp 0x1000028fc
mov ecx, r13d
jmp 0x10000270e
xor ecx, ecx
call fcn.100002004
jmp 0x10000272a
mov r8d, dword [0x100005e9c]
lea rdx, [0x100005ea0]
xor ecx, ecx
call fcn.100001d40
mov ebx, eax
jmp 0x1000028fc
lea rcx, [rsp + 0x88]
xor edx, edx
mov r8d, 0x9a0
mov ebx, r12d
mov qword [rsp + 0x80], r12
call sub.msvcrt.dll_memset
cmp word [0x100005c40], r12w
lea rsi, [0x100005c40]
cmove rsi, r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, 0x4c8
mov rcx, rax
mov r8, rbp
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, r12
jne 0x1000027bb
mov ebx, 8
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x1000028fc
test byte [rcx + 0x1c], r13b
je 0x1000028fc
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 8]
mov r8, r15
call fcn.1000015d8
jmp 0x1000028fc
lea rcx, [rax + 8]
lea rdx, [0x100005ea0]
mov qword [rax], rbp
mov dword [rax + 0x4c0], r12d
mov r8d, 0x105
mov r9d, r12d
sub rdx, rcx
lea rax, [r8 + 0x7ffffef9]
cmp rax, r12
je 0x1000027fe
movzx eax, word [rdx + rcx]
cmp ax, r12w
je 0x1000027fe
mov word [rcx], ax
add rcx, 2
sub r8, r13
jne 0x1000027dc
cmp r8, r12
jne 0x10000280d
sub rcx, 2
mov r9d, 0x8007007a
cmp r9d, r12d
mov word [rcx], r12w
jge 0x100002820
mov ebx, 0x57
jmp 0x1000028cb
mov eax, dword [0x100005c38]
mov rdx, rsi
mov rcx, rdi
mov dword [rdi + 0x4c4], eax
call qword [0x100006360]
cmp eax, r12d
jne 0x10000285e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x1000028cb
test byte [rcx + 0x1c], r13b
je 0x1000028cb
mov edx, 0x11
jmp 0x10000289e
lea rdx, [rsp + 0x80]
mov rcx, rsi
mov qword [rsp + 0x80], 0x9a8
call sub.ReAgent.dll_WinReGetConfig
cmp eax, r12d
jne 0x1000028af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x100005120]
cmp rcx, r14
je 0x1000028cb
test byte [rcx + 0x1c], r13b
je 0x1000028cb
mov edx, 0x12
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r15
call fcn.100001604
jmp 0x1000028cb
lea r9, [rsp + 0x98]
lea rdx, [0x100005c18]
mov r8d, 7
xor ecx, ecx
call fcn.100001834
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000028fc
lea r9, [0x100001380]
lea rdx, [0x100005c18]
mov r8d, 3
xor ecx, ecx
call fcn.100001834
cmp ebx, r12d
je 0x100002934
lea r9, [0x100001380]
lea rdx, [0x100005c28]
mov r8d, 2
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.100001834
lea rdx, [0x100005c28]
mov r8d, ebx
mov ecx, r13d
call fcn.100001834
jmp 0x10000294f
lea r9, [0x100001380]
lea rdx, [0x100005c18]
mov r8d, 5
xor ecx, ecx
call fcn.100001834
mov rcx, qword [0x100005c10]
cmp rcx, r12
je 0x100002961
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0xa30]
xor rcx, rsp
call fcn.100003390
mov rbx, qword [rsp + 0xa90]
add rsp, 0xa40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret