Function at 0x140024b78
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x140132008]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r14d, r14d
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140024dd9
mov byte [rdx], r14b
xor edx, edx
mov r8d, dword [rcx + 0x220]
mov ecx, 0x1fffff
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140024bf8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov eax, ebx
jmp 0x140024dde
mov r12d, 0x104
lea r9, [rbp - 0x31]
lea r8, [rdi + 0x224]
mov dword [rbp - 0x31], r12d
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_QueryFullProcessImageNameW]
or r15, 0xffffffffffffffff
test eax, eax
jne 0x140024c44
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
lea r9, str.QueryFullProcessImageName___failed__error___u_n
mov r8, r15
lea rcx, [rdi + 0x224]
mov dword [rsp + 0x20], eax
mov edx, r12d
call qword [sym.imp.msvcrt.dll__snwprintf_s]
lea r13, [0x1400db940]
mov qword [rbp - 0x21], r14
lea r8, [rbp - 0x21]
mov qword [rbp - 0x29], r13
mov edx, 0xf01ff
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_OpenProcessToken]
test eax, eax
jne 0x140024c8d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ebx, ax
mov edi, 0x80070000
or ebx, edi
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x140024dab
mov rcx, qword [rbp - 0x21]
lea r12, [0x1400db940]
lea r8, [rbp - 0x11]
mov qword [rbp - 0x19], r12
mov edx, 2
mov qword [rbp - 0x11], r15
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_DuplicateToken]
test eax, eax
je 0x140024d04
lea rax, [rbp - 9]
mov dword [rbp + 0xf], r14d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0xf]
mov dword [rsp + 0x48], r14d
mov r9d, 0x220
mov dword [rsp + 0x40], r14d
mov r8d, 0x20
mov dword [rsp + 0x38], r14d
mov dl, 2
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov word [rbp + 0x13], 0x500
mov qword [rbp - 9], r14
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140024d25
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ebx, ax
mov edi, 0x80070000
or ebx, edi
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x140024d90
mov r9, qword [rbp - 9]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 1]
mov qword [rbp - 0x39], r9
call fcn.14001e4e0
mov rcx, qword [rbp - 0x11]
lea r8, [rbp - 0x39]
mov rdx, r9
mov dword [rbp - 0x39], r14d
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_CheckTokenMembership]
mov edi, 0x80070000
test eax, eax
jne 0x140024d74
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x140024d80
cmp dword [rbp - 0x39], r14d
setne al
mov byte [rbx], al
mov ebx, r14d
cmp byte [rbp + 7], r14b
je 0x140024d90
mov rcx, qword [rbp - 1]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_FreeSid]
mov rcx, qword [rbp - 0x11]
mov qword [rbp - 0x19], r12
cmp rcx, r15
je 0x140024dab
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140024e05
mov qword [rbp - 0x11], r15
mov rcx, qword [rbp - 0x21]
mov qword [rbp - 0x29], r13
test rcx, rcx
je 0x140024dc6
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140024e1b
mov qword [rbp - 0x21], r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
jne 0x140024bf1
jmp 0x140024e31
mov eax, 0x80004003
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400cb2a0
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
call fcn.14000c574
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
call fcn.14000c574
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
call fcn.14000c574
int3