Function at 0x14000b0f0
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14005b080]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
mov word [rsp + 0x78], 0x500
mov dword [rsp + 0x70], ebp
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x74], ebp
call fcn.14000b0a0
movsx ebx, al
call fcn.14000b090
movsx ecx, al
imul ebx, ecx
call fcn.14000b0d0
movsx edi, al
xor edx, edx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
lea esi, [rdi + rbx*2]
add eax, esi
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b2e8
lea rax, [rsp + 0x68]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea r8d, [rbp + 0x20]
mov dword [rsp + 0x48], ebp
lea rcx, [rsp + 0x74]
mov dword [rsp + 0x40], ebp
mov dl, 2
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea edx, [rbx + rbx*4]
movd xmm2, eax
movsx eax, byte [0x14005bcd2]
cvtdq2pd xmm2, xmm2
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x60], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, edi
lea eax, [rax + rdx*2]
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b244
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14000b244
lea r9d, [rbp + 0xa]
jmp 0x14000b2a0
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, esi
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b29b
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea edx, [rbx + rbx*2]
movsx ecx, byte [0x14005bcd0]
add eax, edi
xorps xmm0, xmm0
lea eax, [rax + rdx*2]
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si r9d, xmm0
jmp 0x14000b2a0
mov r9d, dword [rsp + 0x70]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea ecx, [rbx + rdi]
lea ecx, [rcx + rbx*2]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, r9d
test eax, eax
je 0x14000b2e8
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, edi
xorps xmm2, xmm2
lea eax, [rax + rbx*4]
div ecx
movsx ecx, byte [0x14005bcd3]
lea edx, [rbx + rbx*4]
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x60], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, edi
lea eax, [rax + rdx*2]
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b3a1
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14000b438
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b430
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si eax, xmm0
jmp 0x14000b434
mov eax, dword [rsp + 0x70]
cmp ebp, eax
jge 0x14000b43c
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140025340
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret