Function at 0x140016b0c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140036068]
xor rax, rsp
mov qword [rbp - 8], rax
xor r12d, r12d
mov word [rbp - 0xc], 0x500
lea rax, [rbp - 0x20]
mov dword [rbp - 0x10], r12d
mov qword [r11 - 0x58], rax
mov r14d, ecx
mov dword [r11 - 0x60], r12d
lea rcx, [rbp - 0x10]
mov dword [r11 - 0x68], r12d
lea r8d, [r12 + 0x20]
mov dword [r11 - 0x70], r12d
mov r9d, 0x220
mov dword [r11 - 0x78], r12d
mov dl, 2
mov dword [r11 - 0x80], r12d
mov edi, r12d
mov dword [rsp + 0x20], r12d
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
call qword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
mov ebx, eax
test eax, eax
js 0x140016d29
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea r8d, [r12 + 0x12]
mov dword [rsp + 0x48], r12d
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x40], r12d
mov dl, 1
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
mov ebx, eax
test eax, eax
js 0x140016d29
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [rbp - 0x20]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [rbp - 0x20]
add eax, 0x18
add ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword gs:[0x60]
xor edx, edx
lea r15d, [rax + 0x28]
mov rcx, qword [rcx + 0x30]
add r15d, ebx
mov r8d, r15d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x140016c2f
mov ebx, 0xc000009a
jmp 0x140016d29
lea rsi, [rax + 0x28]
mov r8d, 2
mov rcx, rsi
mov edx, ebx
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
mov ebx, eax
test eax, eax
js 0x140016d29
mov rax, qword [rbp - 0x20]
xor r8d, r8d
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea edx, [r8 + 2]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAceEx]
mov ebx, eax
test eax, eax
js 0x140016d29
mov rax, qword [rbp - 0x18]
xor r8d, r8d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea edx, [r8 + 2]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAceEx]
mov ebx, eax
test eax, eax
js 0x140016d29
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov ebx, eax
test eax, eax
js 0x140016d29
xor r9d, r9d
mov r8, rsi
mov dl, 1
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov ebx, eax
test eax, eax
js 0x140016d29
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [rbp - 0x20]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
add ebx, eax
cmp ebx, r15d
jae 0x140016ceb
mov ebx, 0xc0000023
jmp 0x140016d29
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [rbp - 0x20]
mov ebx, eax
add rbx, rdi
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
mov r8d, eax
call sub.msvcrt.dll_memcpy
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
test eax, eax
mov ebx, eax
cmovns ebx, r12d
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140016d38
call qword [sym.imp.ntdll.dll_RtlFreeSid]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140016d47
call qword [sym.imp.ntdll.dll_RtlFreeSid]
test ebx, ebx
js 0x140016d50
mov rax, rdi
jmp 0x140016d6f
test rdi, rdi
je 0x140016d6d
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001fbe0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret