Function at 0x140051558
Capabilities:
Get token membership

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x28
lea rax, str.S_1_5_80_123231216_2592883651_3715271367_3753151631_4175906628
xor ecx, ecx
mov qword [rbp + 0x50], rax
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
lea rdx, [0x14045569c]
mov ebx, eax
lea rcx, [0x140444050]
call fcn.1400f3d14
cmp ebx, 0x6bd
jne 0x1400515a0
xor ebx, ebx
jmp 0x1400517eb
lea rdx, [0x140453784]
lea rcx, [0x14043d960]
call fcn.1400f4a64
test ebx, ebx
jne 0x1400517af
and dword [rbp + 0x38], ebx
lea rdx, [0x1404555e8]
lea rcx, [0x140443f7c]
call fcn.1400f3670
lea rdx, [rbp + 0x38]
call fcn.14006b0e0
lea rdx, [0x140457b54]
mov ebx, eax
lea rcx, [0x140433db0]
call fcn.1400f406c
lea rdx, [0x14045af10]
lea rcx, [0x140436ac4]
call fcn.1400f3670
test ebx, ebx
js 0x140051787
cmp dword [rbp + 0x38], 0
je 0x14005162a
xor ebx, ebx
lea rdx, [0x140455dc8]
lea rcx, [0x1404326e8]
call fcn.1400f39c8
jmp 0x14005178e
cmp dword [0x14045ca44], 0
je 0x14005176f
xor r14d, r14d
lea r15, [rbp + 0x50]
mov r12d, 0x80004005
mov rcx, qword [r15]
lea rdx, [rbp + 0x48]
xor esi, esi
xor ebx, ebx
and qword [rbp + 0x48], rsi
and dword [rbp + 0x40], ebx
mov dword [rbp + 0x38], esi
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x140051689
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140051672
mov ebx, r12d
jmp 0x140051680
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.14007ac40
jmp 0x1400516a3
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140051663
mov esi, dword [rbp + 0x40]
mov dword [rbp + 0x38], esi
mov ecx, ebx
call fcn.14007ace8
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1400516b9
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test ebx, ebx
js 0x140051787
test esi, esi
jne 0x140051798
inc r14d
add r15, 8
cmp r14d, 1
jb 0x140051644
lea r8, [rbp + 0x38]
lea edx, [rsi + 0x12]
call fcn.140070dd0
mov ebx, eax
test eax, eax
jns 0x1400516f3
mov ecx, eax
jmp 0x140051789
cmp dword [rbp + 0x38], 0
je 0x140051700
xor ebx, ebx
jmp 0x14005178e
lea r8, [rbp + 0x38]
mov edx, SafeArrayUnaccessData
call fcn.140070dd0
lea rdx, [0x1404556d4]
mov ebx, eax
lea rcx, [0x140432098]
call fcn.1400f50f4
test ebx, ebx
js 0x140051787
cmp dword [rbp + 0x38], 0
jne 0x1400516f9
lea r8, [rbp + 0x38]
mov edx, SafeArrayGetElement
call fcn.140070dd0
mov ebx, eax
test eax, eax
js 0x1400516ec
cmp dword [rbp + 0x38], 0
jne 0x1400516f9
lea rcx, [rbp + 0x38]
call fcn.1400512e4
lea rdx, [0x14045a0dc]
mov ebx, eax
lea rcx, [0x14043f4d8]
call fcn.1400f470c
test ebx, ebx
js 0x14005176f
cmp dword [rbp + 0x38], 0
jne 0x1400516f9
lea rdx, [0x140456350]
mov ebx, 0xc004f025
lea rcx, [0x1404329b0]
call fcn.1400f3318
mov ecx, ebx
call fcn.14007ac40
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
jmp 0x1400517eb
xor ebx, ebx
lea rdx, [0x1404541e8]
lea rcx, [0x14043a02c]
call fcn.1400f4dac
jmp 0x14005178e
mov ecx, ebx
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx ebx, ax
mov r12d, 0x80004005
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
mov ecx, ebx
call fcn.14007ac40
lea rdx, [0x140458da4]
lea rcx, [0x14043e4c4]
call fcn.1400f43c0
mov ecx, ebx
call fcn.14007ace8
mov eax, ebx
add rsp, 0x28
pop r15
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret