Function at 0x1400220e0
Capabilities:
Get token membership
Get user security identifier

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rbp + 0x760], rax
xor esi, esi
xor r15d, r15d
xor dil, dil
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov rbx, r9
mov dword [r9], esi
mov r12, r8
mov r14, rcx
test edx, edx
jne 0x140022186
lea rax, [rsp + 0x44]
mov qword [rsp + 0x58], rsi
lea r9d, [r15 + 4]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
lea edx, [rsi + 0x12]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400221b1
cmp dword [rsp + 0x40], 3
jne 0x14002217c
lea rax, [rsp + 0x44]
mov rcx, r14
lea r9d, [r15 + 8]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
lea edx, [rsi + 0x13]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400221b1
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x14002218e
mov rcx, r14
mov qword [rsp + 0x58], rcx
lea r8, [rsp + 0x50]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x1400221ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Cant_get_impersonation_token:__d_n
jmp 0x1400221be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Cant_check_for_linked_token:__d_n
mov r8d, eax
xor ecx, ecx
call fcn.140030510
xor r8d, r8d
mov rcx, rax
mov rbx, rax
lea rdx, [r8 - 1]
call fcn.140042490
mov rcx, rbx
mov qword [r12], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14002236e
lea rcx, [rsp + 0x48]
call fcn.140022510
test al, al
jne 0x14002223a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Cant_look_up_Admin_group:__d_n
xor ecx, ecx
mov r8d, eax
call fcn.140030510
xor r8d, r8d
mov rcx, rax
mov rbx, rax
lea rdx, [r8 - 1]
call fcn.140042490
mov rcx, rbx
mov qword [r12], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x48]
jmp 0x14002236e
mov rsi, qword [rsp + 0x48]
mov r8, rbx
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140022266
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_check_Admin_group_membership:__d_n
jmp 0x1400221be
cmp dword [rbx], r15d
jne 0x14002236b
mov ecx, 0x80
mov dword [rsp + 0x40], 0x80
mov dword [rsp + 0x44], 0x400
call fcn.140020af0
mov r15, rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x48]
mov r8, r15
mov qword [rsp + 0x30], rax
lea rdx, str.__vmware__
lea rax, [rsp + 0x44]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1400222e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.W32Util_GetVMwareGroupSid
lea rcx, str._s:_LookupAccountNameW:__d_n
call fcn.14001bf60
jmp 0x140022304
cmp dword [rsp + 0x48], 4
je 0x140022333
lea r8, str.VMware_User_Group
lea rdx, str.W32Util_GetVMwareGroupSid
lea rcx, str._s:_Bad_account_type_for__S_group_n
call fcn.14001bf60
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.VMware_User_Group
xor ecx, ecx
mov r9d, eax
lea rdx, str.Cant_look_up__S_group:__d_n
call fcn.140030510
jmp 0x1400221c8
mov rcx, qword [rsp + 0x50]
mov r8, rbx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14002236b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.VMware_User_Group
xor ecx, ecx
mov r9d, eax
lea rdx, str.Unable_to_check__S_group_membership:__d_n
call fcn.140030510
jmp 0x1400221c8
mov dil, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140022390
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.14006a480
add rsp, 0x870
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret