Function at 0x140020230
Capabilities:
Get token membership

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x4b0
mov rax, qword [0x1400c7070]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rsi, rcx
xor ebx, ebx
add rcx, 0x48
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov edx, dword [rsi + 8]
lea r8, str.AdministratorCheck
test eax, eax
je 0x1400204a7
lea rcx, str._i:__s_Begin_execute._n
call fcn.14005cb30
lea rax, [rsp + 0x60]
mov dword [rsp + 0x6c], ebx
mov qword [rsp + 0x50], rax
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x48], ebx
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x40], ebx
mov r9d, 0x220
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x70], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x68], eax
test eax, eax
je 0x1400202fa
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x68]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x68], ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x68], ebx
jne 0x14002046c
mov qword [rsp + 0x4d8], rdi
lea rcx, str.MessageBox
mov qword [rsp + 0x4e0], r14
call sym.Installer.exe_Get
lea rcx, str.SelfFree_ResourceManager
mov r14, rax
call sym.Installer.exe_Get
lea rcx, str.int_Silent
mov rdi, rax
call sym.Installer.exe_Get
test r14, r14
je 0x140020448
test rdi, rdi
je 0x140020448
test eax, eax
jne 0x140020448
xor edx, edx
lea rcx, [rsp + 0x290]
mov r8d, 0x208
call fcn.1400659a0
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
call fcn.1400659a0
mov rax, qword [rdi]
lea r8, [rsp + 0x290]
mov r9d, 0x104
mov edx, 0x271c
mov rcx, rdi
mov rax, qword [rax + 0x28]
call qword [0x1400926f0]
test eax, eax
jg 0x1400203c4
mov rax, qword [rdi]
lea r8, [rsp + 0x290]
mov r9d, 0x104
lea rdx, str.IDS_UserNotAdmin
mov rcx, rdi
mov rax, qword [rax + 0x20]
call qword [0x1400926f0]
mov rax, qword [rdi]
lea r8, [rsp + 0x80]
mov r9d, 0x104
mov edx, 0x271d
mov rcx, rdi
mov rax, qword [rax + 0x28]
call qword [0x1400926f0]
test eax, eax
jg 0x140020410
mov rax, qword [rdi]
lea r8, [rsp + 0x80]
mov r9d, 0x104
lea rdx, str.IDS_UserNotAdminTitle
mov rcx, rdi
mov rax, qword [rax + 0x20]
call qword [0x1400926f0]
mov rax, qword [r14]
lea r8, [rsp + 0x80]
mov dword [rsp + 0x38], ebx
lea rdx, [rsp + 0x290]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov rcx, r14
mov rax, qword [rax + 0x10]
mov dword [rsp + 0x20], 2
call qword [0x1400926f0]
mov ebx, 0x54f
lea rcx, str.int_ReturnCode
lea edx, [rbx - 0x2d]
call sym.Installer.exe_Put
mov r14, qword [rsp + 0x4e0]
mov rdi, qword [rsp + 0x4d8]
mov r9, qword [rsi]
mov rcx, rsi
mov byte [rsi + 0x10], 1
mov rax, qword [r9 + 0x18]
call qword [0x1400926f0]
mov edx, dword [rsi + 8]
lea r8, str.AdministratorCheck
mov r9d, eax
lea rcx, str._i:__s_End_execute._Next_command__i._n
call fcn.14005cb30
lea rcx, [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x1400204b8
lea rcx, str._i:__s_Error:_Multiple_threads_attempting_execution._n
call fcn.14005cb30
mov eax, 0x54f
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400625f0
add rsp, 0x4b0
pop rsi
pop rbp
pop rbx
ret