Function at 0x180099d70
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r13, r9
mov qword [rbp - 9], r8
mov qword [rbp - 0x39], rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x19], xmm1
xor r14d, r14d
mov word [rbp - 0x29], r14w
lea r8d, [r14 + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x29]
call fcn.180003950
nop
call fcn.18009c2f0
mov rcx, rax
lea rdx, [rbp - 0x29]
call fcn.18009c390
mov rbx, rax
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x180099e37
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180099e32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a145
call fcn.18011e774
movdqa xmm0, xmmword [0x1801b2840]
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp - 0x29], r14w
test rbx, rbx
je 0x18009a039
lea rdx, str.AddAce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x31], rax
lea rdx, str.InitializeSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.AllocateAndInitializeSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rdx, str.InitializeAcl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.FreeSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.GetLengthSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.SetSecurityDescriptorDacl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 1], rax
cmp qword [rbp - 0x31], 0
je 0x18009a039
test r12, r12
je 0x18009a039
test rdi, rdi
je 0x18009a039
test r15, r15
je 0x18009a039
test rsi, rsi
je 0x18009a039
test r14, r14
je 0x18009a039
test rax, rax
je 0x18009a039
xor ecx, ecx
mov qword [rbp + 0xf], rcx
mov dword [rbp + 0x17], ecx
mov word [rbp + 0x1b], 0x500
lea rax, [rbp + 0xf]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
xor r9d, r9d
lea r8d, [rcx + 0x12]
mov dl, 1
lea rcx, [rbp + 0x17]
call rdi
test eax, eax
je 0x18009a039
mov rcx, qword [rbp - 0x39]
call r14
mov ebx, eax
mov rcx, qword [rbp + 0xf]
call r14
lea edi, [rax + 0x18]
add edi, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [r13], rax
test rax, rax
je 0x18009a02e
mov r8d, 2
mov edx, edi
mov rcx, rax
call r15
test eax, eax
je 0x18009a02e
mov r15, qword [rbp - 0x39]
mov rcx, r15
call r14
lea edi, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov dword [rax + 4], 0xf003f
mov word [rax], 0x300
mov word [rax + 2], di
mov rcx, r15
call r14
mov r8d, eax
lea rcx, [rbx + 8]
mov rdx, r15
call fcn.18013cde0
mov dword [rsp + 0x20], edi
mov r9, rbx
mov edx, 2
mov r8d, 0xffffffff
mov rcx, qword [r13]
mov r15, qword [rbp - 0x31]
call r15
test eax, eax
jne 0x18009a062
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x18009a039
call rsi
xor al, al
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.18011e330
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0xf]
call r14
lea edi, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov dword [rax + 4], 0xf003f
mov word [rax], 0x300
mov word [rax + 2], di
mov rcx, qword [rbp + 0xf]
call r14
mov r8d, eax
lea rcx, [rbx + 8]
mov rdx, qword [rbp + 0xf]
call fcn.18013cde0
mov dword [rsp + 0x20], edi
mov r9, rbx
mov edx, 2
mov r8d, 0xffffffff
mov rcx, qword [r13]
call r15
test eax, eax
je 0x18009a01a
mov edx, 1
mov rdi, qword [rbp - 9]
mov rcx, rdi
call r12
test eax, eax
je 0x18009a01a
mov r14b, 1
xor r9d, r9d
mov r8, qword [r13]
lea edx, [r9 + 1]
mov rcx, rdi
call qword [rbp - 1]
movzx edi, r14b
test eax, eax
mov r14d, 0
cmove edi, r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x18009a13c
call rsi
movzx eax, dil
jmp 0x18009a03b
call fcn.180146944
int3