Function at 0x140027ff4
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x140114ab8]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r14d, r14d
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400282d5
mov byte [rdx], r14b
lea r12, fcn.14000ebe0
mov r8d, dword [rcx + 0x220]
xor edx, edx
mov ecx, 0x1fffff
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r14
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
mov rbx, rax
cmp rax, rcx
je 0x140028097
test rcx, rcx
je 0x140028090
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
movabs r10, 0xefcdb65178560a70
lea rcx, [rbp - 0x31]
call qword [0x1400de008]
test al, al
je 0x14002831e
mov rcx, rbx
mov qword [rbp - 0x29], rbx
test rcx, rcx
jne 0x1400280c6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
mov esi, 0x80070000
or edi, esi
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x1400282ba
mov ebx, 0x104
lea r9, [rbp - 0x21]
lea r8, [rsi + 0x224]
mov dword [rbp - 0x21], ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_QueryFullProcessImageNameW]
nop dword [rax + rax]
or r15, 0xffffffffffffffff
test eax, eax
jne 0x14002811e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.QueryFullProcessImageName___failed__error___u_n
mov r8, r15
lea rcx, [rsi + 0x224]
mov dword [rsp + 0x20], eax
mov edx, ebx
call qword [sym.imp.msvcrt.dll__snwprintf_s]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
lea r8, [rbp - 1]
mov edx, 0xf01ff
mov qword [rbp - 9], r12
mov qword [rbp - 1], r14
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
jne 0x14002816d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
mov esi, 0x80070000
or edi, esi
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x14002829b
mov rcx, qword [rbp - 1]
lea r13, fcn.14000ebe0
lea r8, [rbp - 0x11]
mov qword [rbp - 0x19], r13
mov edx, 2
mov qword [rbp - 0x11], r15
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateToken]
nop dword [rax + rax]
test eax, eax
je 0x1400281f0
lea rax, [rbp + 7]
mov dword [rbp + 0xf], r14d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0xf]
mov dword [rsp + 0x48], r14d
mov r9d, 0x220
mov dword [rsp + 0x40], r14d
mov r8d, 0x20
mov dword [rsp + 0x38], r14d
mov dl, 2
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov word [rbp + 0x13], 0x500
mov qword [rbp + 7], r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
jne 0x140028217
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
mov esi, 0x80070000
or edi, esi
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x14002827c
mov rbx, qword [rbp + 7]
lea r8, [rbp - 0x39]
mov rcx, qword [rbp - 0x11]
mov rdx, rbx
mov dword [rbp - 0x39], r14d
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
nop dword [rax + rax]
mov esi, 0x80070000
test eax, eax
jne 0x140028261
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x14002826d
cmp dword [rbp - 0x39], r14d
setne al
mov byte [rdi], al
mov edi, r14d
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
nop dword [rax + rax]
mov qword [rbp - 0x19], r13
cmp qword [rbp - 0x11], r15
je 0x14002829b
lea rcx, [rbp - 0x19]
call fcn.14000ebe0
test al, al
je 0x14002833e
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r12
cmp qword [rbp - 1], r14
je 0x1400282ba
lea rcx, [rbp - 9]
call fcn.14000ebe0
test al, al
je 0x14002835a
mov qword [rbp - 1], r14
mov qword [rbp - 0x31], r12
cmp qword [rbp - 0x29], r14
je 0x1400282d1
lea rcx, [rbp - 0x31]
call fcn.14000ebe0
test al, al
je 0x140028302
mov eax, edi
jmp 0x1400282da
mov eax, 0x80004003
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400d2540
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
call fcn.14000ebc0
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000ebc0
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
call fcn.14000ebc0
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
call fcn.14000ebc0
int3