Function at 0x11021330
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x110518bb
mov eax, dword fs:[0]
push eax
sub esp, 0x8ec
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x14
xor edi, edi
push 0x40
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8c4], edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x8c8], esi
cmp esi, edi
je 0x11021768
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x8f8], ebx
mov dword [ebp - 0x8f4], edi
mov dword [ebp - 0x8f0], edi
mov dword [ebp - 0x8ec], edi
mov dword [ebp - 0x8e8], edi
mov dword [ebp - 0x8e4], edi
mov dword [ebp - 0x8dc], edi
mov dword [ebp - 0x8d8], edi
mov dword [ebp - 0x8d4], edi
mov dword [ebp - 0x8d0], edi
push str.ConvertStringSidToSidW
xor ecx, ecx
xor edx, edx
xor eax, eax
push ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x8bc], edi
mov word [ebp - 0x428], cx
mov word [ebp - 0x21c], dx
mov word [ebp - 0x634], ax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x8e0], esi
cmp esi, edi
je 0x11021449
lea ecx, [ebp - 0x8bc]
push ecx
push str.S_1_5_32_544
call esi
cmp eax, edi
je 0x1102146d
mov edx, dword [ebp - 0x8bc]
push 0x105
push edx
lea ecx, [ebp - 0x428]
call fcn.110212d0
mov eax, dword [ebp - 0x8bc]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1102146d
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.ConvertStringSidToSidW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x8e0], esi
cmp esi, edi
je 0x11021541
lea ecx, [ebp - 0x8bc]
push ecx
push str.S_1_5_32_545
call esi
cmp eax, edi
je 0x110214a6
mov edx, dword [ebp - 0x8bc]
push 0x105
push edx
lea ecx, [ebp - 0x21c]
call fcn.110212d0
mov eax, dword [ebp - 0x8bc]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, edi
jne 0x110214c6
push str.ConvertStringSidToSidW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x8e0], esi
cmp esi, edi
je 0x1102154e
lea ecx, [ebp - 0x8bc]
push ecx
push str.S_1_5_18
call esi
cmp eax, edi
je 0x110214ff
mov edx, dword [ebp - 0x8bc]
push 0x105
push edx
lea ecx, [ebp - 0x634]
call fcn.110212d0
mov eax, dword [ebp - 0x8bc]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x8c8]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push str.BuildExplicitAccessWithNameW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x8f4], esi
cmp esi, edi
je 0x11021558
push 3
push 1
push 0xf00f003f
lea edx, [ebp - 0x634]
push edx
lea eax, [ebp - 0x8b4]
push eax
call esi
jmp 0x11021560
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x110214aa
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x110214ff
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x8b8], 1
cmp dword [ebp + 0xc], edi
je 0x110215b5
cmp esi, edi
jne 0x1102158b
push str.BuildExplicitAccessWithNameW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x8f4], esi
cmp esi, edi
je 0x110215a3
push 3
push 3
push 8
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x894]
push edx
call esi
jmp 0x110215ab
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x8b8], 2
mov eax, dword [ebp - 0x8b8]
shl eax, 5
lea ecx, [ebp + eax - 0x8b4]
mov dword [ebp - 0x8c0], ecx
cmp esi, edi
jne 0x110215e7
push str.BuildExplicitAccessWithNameW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x8f4], esi
cmp esi, edi
je 0x11021602
mov eax, dword [ebp - 0x8c0]
push 3
push 1
push 0x20003
lea edx, [ebp - 0x21c]
push edx
push eax
call esi
jmp 0x1102160a
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
inc dword [ebp - 0x8b8]
cmp dword [ebp + 0xc], edi
je 0x110216cd
mov ecx, dword [ebp - 0x8b8]
shl ecx, 5
lea edx, [ebp + ecx - 0x8b4]
mov dword [ebp - 0x8c0], edx
cmp esi, edi
jne 0x1102164b
push str.BuildExplicitAccessWithNameW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x8f4], esi
cmp esi, edi
je 0x11021663
mov ecx, dword [ebp - 0x8c0]
push 3
push 3
push 8
lea eax, [ebp - 0x428]
push eax
push ecx
call esi
jmp 0x1102166b
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x8b8]
inc eax
mov dword [ebp - 0x8b8], eax
shl eax, 5
lea edx, [ebp + eax - 0x8b4]
mov dword [ebp - 0x8c0], edx
cmp esi, edi
jne 0x110216a4
push str.BuildExplicitAccessWithNameW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x8f4], esi
cmp esi, edi
je 0x110216bf
mov ecx, dword [ebp - 0x8c0]
push 3
push 1
push 0xe0007
lea eax, [ebp - 0x428]
push eax
push ecx
call esi
jmp 0x110216c7
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
inc dword [ebp - 0x8b8]
push str.SetEntriesInAclW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8d4], eax
cmp eax, edi
je 0x11021745
lea edx, [ebp - 0x8c4]
push edx
mov edx, dword [ebp - 0x8b8]
push edi
lea ecx, [ebp - 0x8b4]
push ecx
push edx
call eax
cmp eax, edi
jne 0x11021716
mov eax, dword [ebp - 0x8c4]
mov ecx, dword [ebp - 0x8c8]
push edi
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov esi, dword [ebp - 0x8c4]
push str.SetSecurityInfo
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8d0], eax
cmp eax, edi
je 0x1102174f
mov edx, dword [ebp - 0x8cc]
push edi
push esi
push edi
push edi
push 4
push 4
push edx
call eax
jmp 0x11021757
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x11021716
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, edi
je 0x11021762
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x8c8]
mov eax, dword [ebp - 0x8c4]
cmp eax, edi
je 0x11021779
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, edi
je 0x11021784
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret