Function at 0x180096820
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r13, r9
mov qword [rbp - 9], r8
mov qword [rbp - 0x39], rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x18023b300]
movdqu xmmword [rbp - 0x19], xmm1
xor r14d, r14d
mov word [rbp - 0x29], r14w
lea r8d, [r14 + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x29]
call fcn.1800089e0
nop
call fcn.180098a90
mov rcx, rax
lea rdx, [rbp - 0x29]
call fcn.180098b30
mov rbx, rax
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x1800968e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800968e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180096bf5
call fcn.1801ccd54
movdqa xmm0, xmmword [0x18023b300]
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp - 0x29], r14w
test rbx, rbx
je 0x180096ae9
lea rdx, str.AddAce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x31], rax
lea rdx, str.InitializeSecurityDescriptor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.AllocateAndInitializeSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rdx, str.InitializeAcl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.FreeSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.GetLengthSid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.SetSecurityDescriptorDacl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 1], rax
cmp qword [rbp - 0x31], 0
je 0x180096ae9
test r12, r12
je 0x180096ae9
test rdi, rdi
je 0x180096ae9
test r15, r15
je 0x180096ae9
test rsi, rsi
je 0x180096ae9
test r14, r14
je 0x180096ae9
test rax, rax
je 0x180096ae9
xor ecx, ecx
mov qword [rbp + 0xf], rcx
mov dword [rbp + 0x17], ecx
mov word [rbp + 0x1b], 0x500
lea rax, [rbp + 0xf]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
xor r9d, r9d
lea r8d, [rcx + 0x12]
mov dl, 1
lea rcx, [rbp + 0x17]
call rdi
test eax, eax
je 0x180096ae9
mov rcx, qword [rbp - 0x39]
call r14
mov ebx, eax
mov rcx, qword [rbp + 0xf]
call r14
lea edi, [rax + 0x18]
add edi, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [r13], rax
test rax, rax
je 0x180096ade
mov r8d, 2
mov edx, edi
mov rcx, rax
call r15
test eax, eax
je 0x180096ade
mov r15, qword [rbp - 0x39]
mov rcx, r15
call r14
lea edi, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov dword [rax + 4], 0xf003f
mov word [rax], 0x300
mov word [rax + 2], di
mov rcx, r15
call r14
mov r8d, eax
lea rcx, [rbx + 8]
mov rdx, r15
call fcn.1801ceec0
mov dword [rsp + 0x20], edi
mov r9, rbx
mov edx, 2
mov r8d, 0xffffffff
mov rcx, qword [r13]
mov r15, qword [rbp - 0x31]
call r15
test eax, eax
jne 0x180096b12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x180096ae9
call rsi
xor al, al
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1801ccd30
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0xf]
call r14
lea edi, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov dword [rax + 4], 0xf003f
mov word [rax], 0x300
mov word [rax + 2], di
mov rcx, qword [rbp + 0xf]
call r14
mov r8d, eax
lea rcx, [rbx + 8]
mov rdx, qword [rbp + 0xf]
call fcn.1801ceec0
mov dword [rsp + 0x20], edi
mov r9, rbx
mov edx, 2
mov r8d, 0xffffffff
mov rcx, qword [r13]
call r15
test eax, eax
je 0x180096aca
mov edx, 1
mov rdi, qword [rbp - 9]
mov rcx, rdi
call r12
test eax, eax
je 0x180096aca
mov r14b, 1
xor r9d, r9d
mov r8, qword [r13]
lea edx, [r9 + 1]
mov rcx, rdi
call qword [rbp - 1]
movzx edi, r14b
test eax, eax
mov r14d, 0
cmove edi, r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x180096bec
call rsi
movzx eax, dil
jmp 0x180096aeb
call fcn.1801d1a6c
int3