Function at 0x18007f450
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x180146e24], 0
je 0x18007f464
xor eax, eax
add rsp, 0x28
ret
lea rcx, str.NTDLL.DLL
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x18007f48b
lea eax, [rbx + 0x7e]
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.NtSetSecurityObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e28], rax
test rax, rax
je 0x18007f777
lea rdx, str.NtQuerySecurityObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e30], rax
test rax, rax
je 0x18007f777
lea rdx, str.NtOpenProcessToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e38], rax
test rax, rax
je 0x18007f777
lea rdx, str.NtQueryInformationToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e40], rax
test rax, rax
je 0x18007f777
lea rdx, str.NtAdjustPrivilegesToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e48], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlGetAce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e50], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlAddAce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e58], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlCopySid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e60], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlEqualSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e68], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlValidSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e70], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlLengthSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e78], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlCreateAcl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e80], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlInitializeSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e88], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlSubAuthoritySid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e90], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlLengthRequiredSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146e98], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlAddAccessDeniedAce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146ea0], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlAddAccessDeniedAceEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146ea8], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlAddAccessAllowedAce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146eb0], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlAddAccessAllowedAceEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146eb8], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlQueryInformationAcl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146ec0], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlValidSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146ec8], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlCreateSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146ed0], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlGetDaclSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146ed8], rax
test rax, rax
je 0x18007f777
lea rdx, str.RtlSetDaclSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180146ee0], rax
test rax, rax
jne 0x18007f786
mov eax, 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, qword [rsp + 0x20]
mov dword [0x180146e24], 1
xor eax, eax
add rsp, 0x28
ret