Function at 0x14009df28
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp - 8], rax
xor r12d, r12d
lea rax, [rbp - 0x20]
mov r14d, ecx
mov qword [r11 - 0x58], rax
mov dword [r11 - 0x60], r12d
mov dword [r11 - 0x68], r12d
mov dword [r11 - 0x70], r12d
mov dword [r11 - 0x78], r12d
mov dword [r11 - 0x80], r12d
lea r8d, [r12 + 0x20]
lea rcx, [rbp - 0x10]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x20], r12d
mov dword [rbp - 0x10], r12d
mov word [rbp - 0xc], 0x500
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
mov edi, r12d
call qword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
mov ebx, eax
test eax, eax
js 0x14009e145
lea rax, [rbp - 0x18]
lea r8d, [r12 + 0x12]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
xor r9d, r9d
mov dl, 1
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
mov ebx, eax
test eax, eax
js 0x14009e145
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [rbp - 0x20]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [rbp - 0x20]
add eax, 0x18
add ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
lea r15d, [rax + 0x28]
xor edx, edx
add r15d, ebx
mov r8d, r15d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14009e04b
mov ebx, 0xc000009a
jmp 0x14009e145
lea rsi, [rax + 0x28]
mov r8d, 2
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
mov ebx, eax
test eax, eax
js 0x14009e145
mov rax, qword [rbp - 0x20]
xor r8d, r8d
mov r9d, r14d
lea edx, [r8 + 2]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAceEx]
mov ebx, eax
test eax, eax
js 0x14009e145
mov rax, qword [rbp - 0x18]
xor r8d, r8d
mov r9d, 0xf003f
lea edx, [r8 + 2]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAceEx]
mov ebx, eax
test eax, eax
js 0x14009e145
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov ebx, eax
test eax, eax
js 0x14009e145
xor r9d, r9d
mov r8, rsi
mov dl, 1
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov ebx, eax
test eax, eax
js 0x14009e145
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [rbp - 0x20]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
add ebx, eax
cmp ebx, r15d
jae 0x14009e107
mov ebx, 0xc0000023
jmp 0x14009e145
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [rbp - 0x20]
mov ebx, eax
add rbx, rdi
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rdx, qword [rbp - 0x20]
mov r8d, eax
mov rcx, rbx
call sub.msvcrt.dll_memcpy
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov ebx, eax
test eax, eax
cmovns ebx, r12d
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14009e154
call qword [sym.imp.ntdll.dll_RtlFreeSid]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14009e163
call qword [sym.imp.ntdll.dll_RtlFreeSid]
test ebx, ebx
js 0x14009e16c
mov rax, rdi
jmp 0x14009e18b
test rdi, rdi
je 0x14009e189
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret