Function at 0x402820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, rcx
mov rsi, r9
mov rcx, rdx
mov qword [rsp + 0x28], 0
mov rdx, r8
lea r9, [rsp + 0x28]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
mov ebx, eax
je 0x4026c9
lea rdi, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x38], 0
mov word [rsp + 0x40], dx
mov edx, 0x40
lea rax, [rdi + 0x10]
mov rcx, rdi
mov qword [rsp + 0x30], rax
call fcn.00487910
lea rcx, str.finishSecurityDescriptor:
call sub.msvcrt.dll_wcslen
movabs rdx, 0x3fffffffffffffff
sub rdx, qword [rsp + 0x38]
mov r8, rax
cmp rax, rdx
ja 0x4027c1
lea rdx, str.finishSecurityDescriptor:
mov rcx, rdi
call fcn.00487ab0
lea rcx, str.SetEntriesInAcl_failed:
call sub.msvcrt.dll_wcslen
movabs rdx, 0x3fffffffffffffff
sub rdx, qword [rsp + 0x38]
mov r8, rax
cmp rax, rdx
ja 0x402805
lea rdx, str.SetEntriesInAcl_failed:
mov rcx, rdi
call fcn.00487ab0
lea r8, [rsp + 0x50]
xor eax, eax
mov r9d, 0xcccccccd
mov word [rsp + 0x6a], ax
lea rcx, [r8 + 0x1a]
mov eax, ebx
sub rcx, 2
mul r9d
shr edx, 3
mov eax, edx
lea edx, [rdx + rdx*4]
add edx, edx
sub ebx, edx
mov edx, ebx
mov ebx, eax
add edx, 0x30
test eax, eax
mov word [rcx], dx
jne 0x402645
mov rax, rcx
sub rax, r8
add r8, 0x1c
sar rax, 1
push r11
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x3c8
mov eax, 0x60
xor r14d, r14d
mov rax, qword gs:[rax]
mov rcx, rax
cmp dword [rcx + 0xc0], 2
jae 0x4026a5
xor ebp, ebp
jmp 0x4026b5
mov rax, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov rdx, qword [rax + 0x10]
mov r14, qword [rdx + 0x60]
mov qword [rsp + 0x38], rbp
mov edx, dword [rbp + 0xa1af9]
mov r8d, dword [rbp + 0xa1afd]
test edx, edx
jbe 0x402733
mov eax, dword [rbp + 0xa1b01]
add eax, r8d
mov dword [rsp + 0x90], eax
cmp edx, 1
jbe 0x402733
mov eax, dword [rbp + 0xa1b05]
add eax, r8d
mov dword [rsp + 0x94], eax
cmp edx, 2
jbe 0x402733
mov eax, dword [rbp + 0xa1b09]
add eax, r8d
mov dword [rsp + 0x98], eax
cmp edx, 3
jbe 0x402733
mov r10, rsp
lea rcx, [rbp + 0xa1af9]
mov eax, dword [rcx + 0x14]
lea r9, [rsp + 0x90]
add eax, r8d
mov dword [r9 + 0xc], eax
mov dword [r10 + 0x20], 4
call fcn.00402ef6
mov eax, 0x60
mov r10d, dword [rsp + 0x110]
mov rax, qword gs:[rax]
mov r9, qword [rax + 0x18]
xor ecx, ecx
add r9, 0x10
mov r9, qword [r9]
mov edi, ecx
mov r8, qword [r9 + 0x60]
movzx eax, word [r8]
test eax, eax
je 0x4028ad
mov edx, ecx
mov eax, 0xfffffff8
add eax, 8
add edx, 8
movzx r15d, word [r8 + rax*2]
lea r12d, [r15 - 0x41]
cmp r12d, 0x19
lea r11d, [r15 + 0x20]
movzx r13d, r11w
lea r11d, [rdx - 7]
cmovbe r15d, r13d
add edi, r15d
movzx r15d, word [r8 + r11*2]
test r15d, r15d
je 0x4028ad
lea r12d, [r15 - 0x41]
cmp r12d, 0x19
lea r11d, [r15 + 0x20]
movzx r13d, r11w
cmovbe r15d, r13d
add edi, r15d
lea r15d, [rdx - 6]
movzx r15d, word [r8 + r15*2]
test r15d, r15d
je 0x4028ad
lea r12d, [r15 - 0x41]
cmp r12d, 0x19
lea r11d, [r15 + 0x20]
movzx r13d, r11w
cmovbe r15d, r13d
add edi, r15d
lea r15d, [rdx - 5]
movzx r15d, word [r8 + r15*2]
test r15d, r15d
je 0x4028ad
lea r12d, [r15 - 0x41]
cmp r12d, 0x19
lea r11d, [r15 + 0x20]
movzx r13d, r11w
cmovbe r15d, r13d
add edi, r15d
add edi, edi
lea r15d, [rdx - 4]
movzx r15d, word [r8 + r15*2]
test r15d, r15d
je 0x4028ad
lea r12d, [r15 - 0x41]
cmp r12d, 0x19
lea r11d, [r15 + 0x20]
movzx r13d, r11w
cmovbe r15d, r13d
add edi, r15d
lea r15d, [rdx - 3]
movzx r15d, word [r8 + r15*2]
test r15d, r15d
je 0x4028ad
lea r12d, [r15 - 0x41]
cmp r12d, 0x19
lea r11d, [r15 + 0x20]
movzx r13d, r11w
cmovbe r15d, r13d
add edi, r15d
lea r15d, [rdx - 2]
movzx r15d, word [r8 + r15*2]
test r15d, r15d
je 0x4028ad
lea r12d, [r15 - 0x41]
cmp r12d, 0x19
lea r11d, [r15 + 0x20]
movzx r13d, r11w
cmovbe r15d, r13d
add edi, r15d
lea r15d, [rdx - 1]
movzx r15d, word [r8 + r15*2]
test r15d, r15d
je 0x4028ad
lea r12d, [r15 - 0x41]
cmp r12d, 0x19
lea r11d, [r15 + 0x20]
movzx r13d, r11w
cmovbe r15d, r13d
add edi, r15d
movzx r15d, word [r8 + rdx*2]
test r15d, r15d
jne 0x40276a
nop dword [rax]
nop dword [rax]
cmp r10d, edi
jne 0x40274e
mov rdx, qword [r9 + 0x30]
xor r12d, r12d
mov ecx, dword [rsp + 0x114]
movsxd r8, dword [rdx + 0x3c]
mov eax, dword [r8 + rdx + 0x88]
mov r8d, dword [rax + rdx + 0x20]
mov r10d, dword [rax + rdx + 0x1c]
add r8, rdx
mov r9d, dword [rax + rdx + 0x24]
add r10, rdx
add r9, rdx
xor eax, eax
jmp 0x4028fa