BOOL __stdcall EtwpUserInAdminOrLogUsersGroup(){
UINT8 v0;
NTSTATUS v1;
BOOL result;
UINT8 IsMember;
_SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
PSID Sid;
unsigned int SubAuthorities;
int v7;
*(_DWORD *)IdentifierAuthority.Value = 0;
Sid = 0i64;
IsMember = 0;
*(_WORD *)&IdentifierAuthority.Value[4] = 1280;
result = 1;
if( RtlCheckTokenMembership(0i64, SeAliasAdminsSid, &IsMember) < 0 || !IsMember )
{
SubAuthorities = 32;
v7 = 558;
if( RtlAllocateAndInitializeSidEx(&IdentifierAuthority, v0, &SubAuthorities, &Sid) < 0 )
return 0;
v1 = RtlCheckTokenMembership(0i64, Sid, &IsMember);
ExFreePoolWithTag(Sid, 0);
if( v1 < 0 || !IsMember )
return 0;
}
return result;
}