Function at 0x18002a130
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5d0]
sub rsp, 0x6d0
mov r12d, dword [rbp + 0x638]
xor r11d, r11d
mov rsi, qword [rsp + 0x78]
mov r10, r9
mov r15d, dword [rbp + 0x638]
mov r14, rcx
mov ebx, dword [rbp + 0x638]
mov edi, r12d
imul r13d, r12d, 0x27c
mov qword [rbp - 0x48], r11
mov dword [rbp - 0x40], 0xffffffff
mov qword [rbp - 0x3c], r11
mov qword [rbp - 0x34], r11
mov qword [rbp - 0x2c], r11
cmp r12d, r13d
ja 0x18002a4f4
movzx eax, word [rbp + 0x638]
lea r10, [0x1800137b0]
mov r12, qword [rsp + 0x78]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x68], rax
lea r9, [0x180000000]
cmp edi, 0x1440
ja 0x18002a342
je 0x18002a32f
lea eax, [rdi - 0x11]
cmp eax, 0x9c
ja case.0x18002a206.23
movzx eax, byte [r9 + rax + 0x2a824]
mov ecx, dword [r9 + rax*4 + 0x2a808]
add rcx, r9
jmp rcx
mov r12, r14
mov qword [rbp - 0x34], r10
jmp case.0x18002a206.23
mov ecx, r11d
mov dword [rbp - 0x80], 0
mov dword [rsp + 0x60], ecx
mov word [rbp - 0x7c], 0x500
mov qword [rbp - 0x50], r11
jmp 0x18002a45e
mov rsi, qword [r14]
mov r15d, r11d
jmp case.0x18002a206.23
mov eax, dword [r8]
lea r9, [rbp - 0x78]
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x78]
mov rax, qword [rbp + 0x640]
mov r8d, 0x98
mov eax, dword [rax]
mov dword [rbp - 0x68], eax
mov rax, qword [rbp + 0x630]
movzx eax, word [rax]
mov word [rbp - 0x78], ax
movzx eax, word [rdx]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x70], ax
mov rax, qword [r14]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.180044910
mov rdx, qword [rbp + 0x618]
lea r10, [0x1800137b0]
mov r8, qword [rbp + 0x620]
mov r9, rax
mov ecx, dword [rsp + 0x60]
xor r11d, r11d
mov qword [rsp + 0x68], rax
jmp 0x18002a463
xor r9d, r9d
mov word [rbp + 0x53a], r11w
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], 0x200
mov rdx, r14
mov dword [rsp + 0x20], 0x157
lea rcx, [rbp - 0x20]
call fcn.1800108e0
mov ecx, 0xfffffe04
lea rdx, [rbp - 0x20]
call qword [0x1800ce8f0]
jmp 0x18002a442
mov eax, dword [r14]
sub eax, 0x333334
cmp eax, 0x2ccccb
ja 0x18002a327
mov eax, dword [rdx]
sub eax, 0xccccd
cmp eax, 0x199999
ja 0x18002a327
mov ebx, 1
jmp case.0x18002a206.23
mov ebx, r11d
jmp case.0x18002a206.23
movzx eax, word [rbp + 0x53a]
mov word [0x1800ce8f8], ax
jmp case.0x18002a206.23
cmp edi, 0x1fda
je 0x18002a417
cmp edi, 0x247e
je 0x18002a408
cmp edi, 0x3f1d
je 0x18002a4ec
cmp edi, 0x484f
je 0x18002a3d0
cmp edi, 0x6c20
jne case.0x18002a206.23
cmp word [rsi], 0x7d
jb 0x18002a4db
mov r8d, dword [r14 + 0x10]
lea rcx, str._s:_Matched_rule___s__for_vm___s__and_key___s_.
mov edx, dword [rsi + 0x20]
mov r15d, 0x7d
mov r9d, dword [rsi + 0x24]
add r8d, edx
call fcn.18006ac90
lea rcx, [rsi + 0x28]
mov dword [rsp + 0x70], 0x14
lea r8, [rsp + 0x70]
mov edx, 0x11f
call fcn.18004f690
mov rdx, rax
lea rcx, str.passwordFilePath
call fcn.18006ac90
jmp 0x18002a442
lea rcx, str._RGN_HEADER__n
call fcn.18006ac90
cmp word [rsi], 0x1d
jb 0x18002a4db
mov r8d, dword [r14 + 0x10]
lea rcx, str.char16___OVERLOADABLE___min_char16_x__char_y__
mov edx, dword [rsi + 0x18]
mov r15d, 0x1d
mov r9d, dword [rsi + 0x1c]
add r8d, edx
call fcn.18006ac90
jmp 0x18002a442
mov rcx, qword [r14]
mov edx, 0x121
call fcn.180020d40
jmp 0x18002a442
mov rax, qword [r12]
lea r9, [rbp - 0x48]
mov qword [rbp - 0x48], rax
xor r8d, r8d
mov eax, dword [r12 + 8]
xor ecx, ecx
mov dword [rbp - 0x40], eax
lea rax, [r12 + 0xc]
mov qword [rbp - 0x3c], rax
lea edx, [r8 + 0x45]
call fcn.180025070
mov r8, qword [rbp + 0x620]
lea r10, [0x1800137b0]
mov rdx, qword [rbp + 0x618]
xor r11d, r11d
mov ecx, dword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
imul eax, dword [rbp + 0x638], 0x35
add edi, eax
cmp edi, r13d
jbe 0x18002a1cb
mov r12d, dword [rbp + 0x638]
mov r10, qword [rbp + 0x628]
mov edi, r12d
imul eax, r12d, 0x564
cmp edi, eax
ja 0x18002a756
cmp edi, 0xf57
ja 0x18002a722
je 0x18002a6f4
cmp edi, 0x9a
ja 0x18002a633
je 0x18002a756
cmp edi, 0x11
je 0x18002a54b
cmp edi, 0x17
je 0x18002a50e
cmp edi, 0x60
jne 0x18002a7e7
mov ebx, dword [rbp + 0x53c]
jmp 0x18002a7e7
mov r12d, dword [rbp + 0x638]
mov edi, 0x9c1b
jmp 0x18002a7e7
mov eax, r11d
jmp 0x18002a758
movzx ecx, word [rbp + 0x638]
mov r9, qword [rsp + 0x78]
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x68], r9
jmp 0x18002a483
test r9, r9
je 0x18002a7e7
movzx eax, byte [r10]
lea rdx, [rsp + 0x78]
mov byte [r9 + 8], al
xor r8d, r8d
mov rax, qword [r14]
mov r9d, 0xc7
mov qword [rsp + 0x28], r11
xor ecx, ecx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x20], r11
call fcn.180025990
jmp 0x18002a7e7
xor r13d, r13d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x48], r13d
xor r9d, r9d
mov dword [rsp + 0x40], r13d
mov dl, 1
mov dword [rsp + 0x38], r13d
lea r8d, [r13 + 6]
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov qword [rbp - 0x58], r13
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x18002a61b
mov rdx, qword [rbp - 0x50]
lea r8, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x18002a61b
cmp dword [rbp - 0x60], r13d
je 0x18002a5ba
mov eax, 1
mov word [rsp + 0x60], ax
jmp 0x18002a61b
lea rax, [rbp - 0x58]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x48], r13d
mov dl, 1
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
lea r8d, [r9 + 0x12]
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x18002a61b
mov rdx, qword [rbp - 0x58]
lea r8, [rbp - 0x5c]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x18002a61b
cmp dword [rbp - 0x5c], r13d
je 0x18002a61b
mov eax, 1
mov dword [rsp + 0x60], eax
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18002a7e7
call qword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x18002a7e7
cmp edi, 0xad
je 0x18002a65f
cmp edi, 0x7b4
jne 0x18002a7e7
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18002a7e7
call qword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x18002a7e7
mov r8d, dword [r14 + 0x10]
lea rcx, str.ConverterPropertyInfoPowerOffSourceNotSupported
mov edx, dword [rsi + 0x3c]
add r8d, edx
mov r9d, dword [rsi + 0x40]
call fcn.18006ac90
lea rcx, [rsi + 0x44]
mov dword [rbp + 0x638], 0x14
lea r8, [rbp + 0x638]
mov edx, 0x11f
call fcn.18004f690
mov rdx, rax
lea rcx, str.Filter_pattern:
call fcn.18006ac90
mov r8d, dword [r14 + 0x10]
lea rcx, str.___s_:__s_:__s_:cdma_spn_branch_entered
mov edx, dword [rsi + 0x58]
add r8d, edx
mov r9d, dword [rsi + 0x5c]
call fcn.18006ac90
lea rcx, [rsi + 0x60]
mov dword [rbp + 0x638], 0x14
lea r8, [rbp + 0x638]
mov edx, 0x11f
call fcn.18004f690
mov rdx, rax
lea rcx, str.icudt58l_naq.res
call fcn.18006ac90
jmp 0x18002a7e7
mov rax, qword [r14]
lea rdx, [rbp + 0x638]
mov word [rbp + 0x638], cx
mov r9d, 0xb9
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
xor r8d, r8d
call fcn.18000eb50
jmp 0x18002a7e7
cmp edi, 0x2b80
je 0x18002a756
cmp edi, 0x4e64
je 0x18002a7be
cmp edi, 0x9c1b
je 0x18002a4e2
cmp edi, 0xe9d2
je 0x18002a773
cmp edi, 0x13789
jne 0x18002a7e7
mov eax, ebx
mov rbx, qword [rsp + 0x710]
add rsp, 0x6d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, word [rsi]
cmp eax, r15d
jle 0x18002a7e7
sub eax, r15d
movsxd rcx, r15d
add rcx, rsi
mov dword [rbp + 0x638], eax
lea r8, [rbp + 0x638]
mov edx, 0x11f
call fcn.18004f690
movzx r8d, word [rsi]
lea rcx, str.PasswordWebDataService::AddIE7Login
mov r9d, r8d
mov qword [rsp + 0x20], rax
sub r9d, r15d
mov edx, r15d
dec r8d
call fcn.18006ac90
jmp 0x18002a7e7
mov r8d, dword [r14 + 0x10]
lea rcx, str.TokenHasAdminGroup:_Done_scanning__result_is__s
mov edx, dword [rsi + 0x74]
add r8d, edx
mov r9d, dword [rsi + 0x78]
call fcn.18006ac90
mov edx, dword [rsi + 0x7c]
lea rcx, str.HideMsgDlgOnCancel
call fcn.18006ac90
mov ecx, dword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
mov r10, qword [rbp + 0x628]
imul eax, r12d, 0x73
add edi, eax
xor r11d, r11d
jmp 0x18002a486