Function at 0x140097470
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
push rsi
push rdi
push r15
sub rsp, 0x80
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, rcx
xor eax, eax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
xor r8d, r8d
lea edx, [rax + 0x16]
lea rcx, [r11 - 0x48]
call fcn.1400dd180
nop
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x1400975a4
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x1400974ff
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400974ff
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], ebx
sub ebx, 1
jne 0x1400974ff
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov rdx, qword [rbp + 0x10]
call fcn.140096420
mov rdi, rax
lea r15, vtable.mb::common::system::ScopedAny_void____ptr64__int____cdecl___void____ptr64___int___cdecl_CloseHandle_void____ptr64___2__0__0_.0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x68], rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x140097646
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x14009759d
lea rsi, [rbp + 0x18]
cmp qword [rsi + 0x18], 8
jb 0x140097559
mov rsi, qword [rsi]
mov rbx, qword [rbx]
add rbx, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
lea rax, str.Failed_to_duplicate_required_token._Error:__u.
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 2
mov r9d, 0x17b
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_tokenutilities.cpp
lea rdx, str.mb::common::system::Impersonator::ImpersonateSystemIfNeeded
mov rcx, qword [rbp + 0x10]
call qword [rbx]
xor bl, bl
jmp 0x140097654
mov dword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1400975f9
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x1400975f4
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400975f4
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], ebx
sub ebx, 1
jne 0x1400975f4
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1400974ff
cmp dword [rsp + 0x48], 1
sete sil
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x140097639
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdi + 8], eax
sub eax, 1
jne 0x140097639
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], ebx
sub ebx, 1
jne 0x140097639
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
test sil, sil
je 0x1400974ff
mov al, 1
jmp 0x140097678
mov rdx, rdi
mov rcx, rbp
call fcn.140097260
movzx ebx, al
mov qword [rsp + 0x60], r15
lea rcx, [rdi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14009766c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], 0
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140282c10
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret