Function at 0x18001d930
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x18007f080]
xor rax, rsp
mov qword [rbp + 0xc8], rax
xor r15d, r15d
mov dword [rbp + 0x9c], r15d
mov dword [rbp + 0x94], r15d
mov word [rbp + 0x98], 0x500
mov qword [rbp + 0xb0], r15
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r15 + 0x12]
mov dl, 1
lea rcx, [rbp + 0x94]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x18001d9df
lea r8, [rbp + 0x9c]
mov rdx, qword [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp dword [rbp + 0x9c], r15d
setne bl
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x18001d9fb
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test bl, bl
jne 0x18001de5c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov rcx, qword [rbp + 0xe8]
test eax, eax
js 0x18001de98
mov qword [rbp + 0xa8], r15
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [0x18006da30]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x180047c18]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rbp + 0xe8]
test eax, eax
js 0x18001dea0
mov rbx, qword [rbp + 0xa8]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x50]
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rbp - 8], xmm0
movsd xmm0, qword [rsp + 0x78]
movsd qword [rsp + 0x60], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 8], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp + 0x18], xmm0
movsd xmm0, qword [rbp - 0x28]
movsd qword [rbp - 0x78], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp - 8]
movaps xmmword [rbp + 0x30], xmm0
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp + 0x40], xmm0
movups xmm0, xmmword [rbp + 8]
movaps xmmword [rbp + 0x50], xmm0
movsd xmm0, qword [rbp - 0x80]
movsd qword [rbp + 0x60], xmm0
movups xmm0, xmmword [rbp + 0x18]
movaps xmmword [rbp + 0x70], xmm0
movsd xmm0, qword [rbp - 0x78]
movsd qword [rbp + 0x80], xmm0
movups xmm0, xmmword [rbp - 0x50]
movaps xmmword [rbp - 0x70], xmm0
movsd xmm1, qword [rbp - 0x40]
movsd qword [rbp - 0x60], xmm1
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
lea r8, [rbp + 0x70]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call rdi
mov ebx, eax
lea rcx, [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x18001db70
mov rcx, qword [rbp + 0xe8]
mov edx, ebx
call fcn.180011510
jmp 0x18001de3f
mov rbx, qword [rbp + 0xa8]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x38]
mov qword [rbp + 0xb8], r15
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [0x180085850]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov rcx, qword [rbp + 0xe8]
test rax, rax
je 0x18001dea8
mov qword [rax], r15
mov qword [rax + 0x10], 1
mov qword [rax + 8], r15
lea rcx, [0x180068e28]
call fcn.18003df60
mov qword [rdi], rax
lea r8, [rbp + 0xb8]
mov rdx, rax
mov rcx, rbx
call rsi
mov ebx, eax
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x18001dc2a
mov rcx, qword [rdi]
test rcx, rcx
je 0x18001dbfc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov r8, qword [rdi + 8]
test r8, r8
je 0x18001dc18
xor edx, edx
mov rcx, qword [0x180085850]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi + 8], r15
mov r8, rdi
xor edx, edx
mov rcx, qword [0x180085850]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x18001dc41
mov rcx, qword [rbp + 0xe8]
mov edx, ebx
call fcn.180011510
jmp 0x18001de2c
mov rbx, qword [rbp + 0xb8]
mov rax, qword [rbx]
mov r14, qword [rax + 0x68]
mov qword [rbp + 0xa0], r15
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [0x180085850]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov rcx, qword [rbp + 0xe8]
test rax, rax
je 0x18001deae
mov qword [rax], r15
mov qword [rax + 0x10], 1
mov qword [rax + 8], r15
lea rcx, str.OpenGlass_Host
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x18001de8d
lea r8, [rbp + 0xa0]
mov rdx, rax
mov rcx, rbx
call r14
mov ebx, eax
lock xadd dword [rdi + 0x10], esi
cmp esi, 1
jne 0x18001dcff
mov rcx, qword [rdi]
test rcx, rcx
je 0x18001dcd1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov r8, qword [rdi + 8]
test r8, r8
je 0x18001dced
xor edx, edx
mov rcx, qword [0x180085850]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi + 8], r15
mov r8, rdi
xor edx, edx
mov rcx, qword [0x180085850]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0x80070002
jne 0x18001dd1f
mov ebx, 0x80070424
mov rcx, qword [rbp + 0xe8]
mov edx, ebx
call fcn.180011510
jmp 0x18001de19
test ebx, ebx
jns 0x18001dd36
mov rcx, qword [rbp + 0xe8]
mov edx, ebx
call fcn.180011510
jmp 0x18001de19
mov word [rbp + 0x90], r15w
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rcx]
lea rdx, [rbp + 0x90]
call qword [rax + 0x50]
mov ebx, eax
test eax, eax
jns 0x18001dd6b
mov rcx, qword [rbp + 0xe8]
mov edx, eax
call fcn.180011510
jmp 0x18001de19
cmp word [rbp + 0x90], 0
jne 0x18001dd8d
mov rcx, qword [rbp + 0xe8]
mov ebx, 0x80041326
mov edx, ebx
call fcn.180011510
jmp 0x18001de19
mov rbx, qword [rbp + 0xa0]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x68]
mov qword [rbp + 0xc0], r15
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rsp + 0x68]
movaps xmmword [rbp - 0x70], xmm0
movsd xmm1, qword [rsp + 0x78]
movsd qword [rbp - 0x60], xmm1
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call rdi
mov ebx, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x18001de03
mov rcx, qword [rbp + 0xe8]
mov edx, ebx
call fcn.180011510
jmp 0x18001de06
mov ebx, r15d
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x18001de19
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x18001de2c
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x18001de3f
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x18001de52
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
jmp 0x18001de61
call fcn.18000f710
mov rcx, qword [rbp + 0xc8]
xor rcx, rsp
call fcn.18003efb0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x8007000e
call fcn.18003df50
int3
mov edx, eax
call fcn.18000baa0
int3
mov edx, eax
call fcn.18000baa0
int3
call fcn.18000b570
int3
call fcn.18000b570
int3