Function at 0x14000c930
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
xor eax, eax
test eax, eax
je 0x14000cb4e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push rsp
and al, 4
mov ecx, dword [rdx]
mov dword [rax], ecx
mov ecx, dword [rdx + 4]
mov dword [rax + 4], ecx
mov cx, word [rdx - 0x78]
popfq
xchg ebp, eax
add byte [rax], al
add byte [rbx - 0xef743b], cl
push rdx
pop rbp
pop rdi
pop rsi
add byte [rax], al
mov eax, dword [rdx + 8]
test esi, esi
jge 0x14000c97b
xor esi, esi
cmp eax, esi
jg 0x14000c982
mov ebx, dword [rbp + rbx*2 + 0x5e]
pop rsi
pop rdi
invalid
or dword [rsi + 0x69], eax
js 0x14000cb8c
je 0x14000cbad
imul ebp, dword [rsi + 0x67], 0x90900000
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
test eax, eax
je 0x14000cd65
nop
nop
nop
nop
nop
nop
nop
nop
pop rsp
test eax, eax
je 0x14000cb70
mov edx, dword [rbx + 0x50]
push rdx
push rsi
push rax
call 0x13ff6c6f0
call 0x14000c90c
pop rcx
dec dword [rbp - 0x50]
jne 0x14000cb34
cmp bl, 4
je 0x14000cbf5
jb 0x14000cbaf
cmp ah, byte [rax]
push rsp
push rdi
imul edi, dword [rdx + 0x61], 0x506472
add dword [rax], eax
invalid
invalid
add byte [rbx], dl
add al, bh
call 0x13fe0a7d8
push rax
call fcn.14000cab8
test eax, eax
jne 0x14000cbcb
add al, byte [rax]
invalid
add byte [rax], al
add byte [rax], dl
invalid
mov eax, dword [rbp - 4]
mov byte [rax + 0x24], 0
mov eax, dword [rbp - 4]
call 0xcdef4104
invalid
xor eax, eax
test eax, eax
je 0x14000cf7c
nop
add byte [rax], al
invalid
outsd dx, dword [rsi]
insb byte [rdi], dx
outsd dx, dword [rsi]
jb 0x14000cf72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
test eax, eax
je 0x14000d193
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsb byte [rdi], byte [rsi]
js 0x14000cf6b
call qword [rax + 0x6a]
add eax, 0xfee8026a
fsubp st(3)
jmp [rdx]
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 5
xor eax, eax
test eax, eax
je 0x14000d3d9
nop
nop
nop
nop
add byte [rbx], cl
jb 0x14000d23b
jns 0x14000d22c
je 0x14000d23c
je 0x14000d242
add al, byte [rax]
add dword [rdx + rsi*2 + 0x69], esi
outsb dx, byte [rsi]
sub dword [ebx], edi
add ah, ah
add al, 1
add bh, bh
invalid
sbb bh, ah
invalid
add byte [rbx + riz*4], bl
sbb al, 0xa3
pop rsp
add byte [rbx], dh
fld xword [rdx + 0x18]
push 0x18
lea eax, [rbp - 0x350]
mov edi, esi
mov edx, dword [rdi + 4]
mov ecx, 0x8b0689f0
hlt
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000d88f
xor eax, eax
test eax, eax
je 0x14000d64b
nop
nop
jb 0x14000d4a7
invalid
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add eax, 0x74723808
push rdx
invalid
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000d884
xor eax, eax
test eax, eax
je 0x14000d87c
nop
mov edx, 0xa
mov eax, ebx
mov ecx, dword [rax]
call qword [rcx + 0x24]
push rax
lea edx, [rsp - 0x15]
push rsi
lea ecx, [rbp - 0x10]
mov edx, dword [rbp + 0xc]
mov eax, edi
call fcn.140014988
test byte [rax], ah
xchg dword [rax + rax + 0x68], ebp
out dx, al
insb byte [rdi], dx
add byte [rax], al
add byte [rax], al
add byte [rax - 0x49ff937a], bl
or byte [rsi - 0x3cff9326], 0x90
and edx, 0x7f
movzx edx, byte [rdx + 0x2da8c]
add byte [rax + rdx + 0x10040], bl
invalid
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
test eax, eax
je 0x14000daa6
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [rsp + 0x60]
add rsp, 0x88
ret