Function at 0x180012cd0
Capabilities:
Get token membership

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1800760a8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x68], rcx
mov eax, dword [0x18006d7c0]
mov dword [rsp + 0x98], eax
mov ax, word [0x18006d7c4]
mov word [rsp + 0x9c], ax
mov dword [rsp + 0x64], 0xcb8ca7d9
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x60], eax
sub eax, 0x82b54d83
je 0x180012f73
jmp 0x180012d2a
mov eax, dword [rsp + 0x60]
sub eax, 0x82ea928c
je 0x180012f66
jmp 0x180012d3e
mov eax, dword [rsp + 0x60]
sub eax, 0x96a2f3e6
je 0x180012fb6
jmp 0x180012d52
mov eax, dword [rsp + 0x60]
sub eax, 0xc4e9e283
je 0x180012ea9
jmp 0x180012d66
mov eax, dword [rsp + 0x60]
sub eax, 0xcb8ca7d9
je 0x180012e1f
jmp 0x180012d7a
mov eax, dword [rsp + 0x60]
sub eax, 0xdea454d4
je 0x180012ec6
jmp 0x180012d8e
mov eax, dword [rsp + 0x60]
sub eax, 0xef258adc
je 0x180012f4e
jmp 0x180012da2
mov eax, dword [rsp + 0x60]
sub eax, 0x56cebfa
je 0x180012e91
jmp 0x180012db6
mov eax, dword [rsp + 0x60]
sub eax, 0x1a3955fb
je 0x180012f0b
jmp 0x180012dca
mov eax, dword [rsp + 0x60]
sub eax, 0x39f50250
je 0x180012f9b
jmp 0x180012dde
mov eax, dword [rsp + 0x60]
sub eax, 0x459084b3
je 0x180012ee0
jmp 0x180012df2
mov eax, dword [rsp + 0x60]
sub eax, 0x4716957e
je 0x180012f8e
jmp 0x180012e06
mov eax, dword [rsp + 0x60]
sub eax, 0x4abffb81
je 0x180012f2e
jmp 0x180012e1a
jmp 0x180012fdd
lea rcx, [rsp + 0x98]
mov edx, 2
mov r8d, 0x20
mov r9d, 0x220
xor eax, eax
lea rax, [rsp + 0x88]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x64], 0x56cebfa
jmp 0x180012fdd
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x64], 0xc4e9e283
jmp 0x180012fdd
mov edx, dword [rsp + 0x74]
mov eax, 0x39f50250
mov ecx, 0xdea454d4
cmp edx, 0
cmovne eax, ecx
mov dword [rsp + 0x64], eax
jmp 0x180012fdd
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x64], 0x459084b3
jmp 0x180012fdd
mov rdx, qword [rsp + 0x78]
xor eax, eax
mov ecx, eax
lea r8, [rsp + 0x94]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x64], 0x1a3955fb
jmp 0x180012fdd
mov eax, dword [rsp + 0x80]
cmp eax, 0
setne al
and al, 1
mov byte [rsp + 0x86], al
mov dword [rsp + 0x64], 0x4abffb81
jmp 0x180012fdd
mov dl, byte [rsp + 0x86]
mov eax, 0xef258adc
mov ecx, 0x82b54d83
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x64], eax
jmp 0x180012fdd
mov dword [rsp + 0x94], 0
mov dword [rsp + 0x64], 0x82ea928c
jmp 0x180012fdd
mov dword [rsp + 0x64], 0x82b54d83
jmp 0x180012fdd
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [rsp + 0x64], 0x4716957e
jmp 0x180012fdd
mov dword [rsp + 0x64], 0x39f50250
jmp 0x180012fdd
mov eax, dword [rsp + 0x94]
mov byte [rsp + 0x87], al
mov dword [rsp + 0x64], 0x96a2f3e6
jmp 0x180012fdd
mov al, byte [rsp + 0x87]
mov byte [rsp + 0x5f], al
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18006c560
mov al, byte [rsp + 0x5f]
add rsp, 0xa8
ret
jmp 0x180012d12