Function at 0x411a80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431378
mov eax, dword fs:[0]
push eax
sub esp, 0x184
mov eax, dword [0x44700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 4], 0
lea ebx, [esi + 0x34]
mov dword [esi], vtable.CDefaultSecurity.0
lea eax, [ebp - 0x190]
mov dword [esi + 4], 0
xorps xmm0, xmm0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebx], 0
mov dword [esi + 0x38], 0
movq qword [esi + 0x14], xmm0
push 0x11c
mov dword [esi + 0x1c], 0
push 0
movq qword [esi + 0x28], xmm0
push eax
mov dword [esi + 0x30], 0
call fcn.0041c000
add esp, 0xc
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x411b62
push str.RtlGetVersion
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411b62
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x190], 0x11c
push ecx
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x18c], 6
jb 0x411e52
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
mov word [ebp - 0x14], 0x100
mov dword [ebp - 0x20], 0
mov word [ebp - 0x1c], 0x500
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
call edi
test eax, eax
jne 0x411bd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AllocateAndInitializeSid_Error__u_n
jmp 0x411e4a
lea eax, [esi + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
je 0x411bc4
push 0x442280
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x411e3e
push str.ConvertStringSecurityDescriptorToSecurityDescriptorW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411e30
push 0
push ebx
push 1
push str.S:_ML__NW___LW_
call eax
test eax, eax
jne 0x411c40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConvertStringSecurityDescriptorToSecurityDescriptor_Error__u_n
jmp 0x411e4a
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
jne 0x411c69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSecurityDescriptorSacl_Error__u_n
jmp 0x411e4a
push 0x40
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0041c000
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0xc]
push eax
push 0
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0xe0010000
push eax
push 2
mov dword [ebp - 0x64], 2
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x48], 0x10000000
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 2
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
je 0x411cf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetEntriesInAcl_Error__u_n
jmp 0x411e4a
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x14
push 0x40
call edi
mov dword [esi + 0x10], eax
test eax, eax
jne 0x411d16
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LocalAlloc_Error__u_n
jmp 0x411e4a
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 1
push eax
call ebx
test eax, eax
jne 0x411d36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InitializeSecurityDescriptor_Error__u_n
jmp 0x411e4a
push 0
push dword [esi + 0xc]
push 1
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x411d5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetSecurityDescriptorDacl_Error__u_n
jmp 0x411e4a
mov eax, dword [esi + 0x10]
push 0x40
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x68]
push 0
push eax
mov dword [esi + 0x14], 0xc
mov dword [esi + 0x1c], 0
call fcn.0041c000
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [ebp - 0x4c], eax
lea eax, [esi + 0x20]
mov dword [ebp - 0x68], 0x10000000
mov dword [ebp - 0x64], 2
push eax
push 0
lea eax, [ebp - 0x68]
mov dword [ebp - 0x60], 0
push eax
push 1
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 5
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x411ce1
push 0x14
push 0x40
call edi
mov dword [esi + 0x24], eax
test eax, eax
je 0x411d05
push 1
push eax
call ebx
test eax, eax
je 0x411d25
push 0
push dword [esi + 0x20]
push 1
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x411d4a
push 0
push dword [esi + 0x38]
push 1
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
test eax, eax
jne 0x411e1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetSecurityDescriptorSacl_Error__u_n
jmp 0x411e4a
mov eax, dword [esi + 0x24]
mov dword [esi + 0x28], 0xc
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0
jmp 0x411e52
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcAddress___Error__u_n
jmp 0x411e4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadLibrary__Advapi32.dll___Error__u_n
call fcn.00411f80
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419174
mov esp, ebp
pop ebp
ret