Function at 0x1400a4400
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x14013e688]
xor edi, edi
mov qword [rsp + 0x58], rdi
mov r14d, edi
mov esi, edi
test rax, rax
jne 0x1400a472b
cmp byte [0x14013e690], sil
jne 0x1400a45e7
lea rcx, str.advapi32.dll
mov byte [0x14013e690], 1
call fcn.1400a4240
mov qword [0x14013e698], rax
test rax, rax
je 0x1400a45dd
lea rdx, str.GetSecurityInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed68], rax
test rax, rax
je 0x1400a45dd
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a45d6
lea rdx, str.SetSecurityInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed60], rax
test rax, rax
je 0x1400a45dd
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a45c5
lea rdx, str.OpenProcessToken
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed88], rax
test rax, rax
je 0x1400a45dd
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a45b4
lea rdx, str.GetTokenInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed80], rax
test rax, rax
je 0x1400a45dd
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a45a3
lea rdx, [0x1400df240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed78], rax
test rax, rax
je 0x1400a45dd
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a4592
lea rdx, [0x1400df260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed70], rax
test rax, rax
je 0x1400a45dd
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a4581
lea rdx, str.SetEntriesInAclA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed58], rax
test rax, rax
je 0x1400a45dd
mov al, 1
mov byte [0x14013e691], al
jmp 0x1400a45ee
xor al, al
mov qword [0x14013ed58], rdi
mov byte [0x14013e691], al
jmp 0x1400a45ee
xor al, al
mov qword [0x14013ed70], rdi
mov byte [0x14013e691], al
jmp 0x1400a45ee
xor al, al
mov qword [0x14013ed78], rdi
mov byte [0x14013e691], al
jmp 0x1400a45ee
xor al, al
mov qword [0x14013ed80], rdi
mov byte [0x14013e691], al
jmp 0x1400a45ee
xor al, al
mov qword [0x14013ed88], rdi
mov byte [0x14013e691], al
jmp 0x1400a45ee
mov qword [0x14013ed60], rdi
xor al, al
mov byte [0x14013e691], al
jmp 0x1400a45ee
movzx eax, byte [0x14013e691]
test al, al
je 0x1400a46fd
mov qword [rsp + 0x68], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x2000000
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x1400a46f8
lea r8, [rsp + 0x58]
mov edx, 8
mov rcx, rax
call qword [0x14013ed88]
test eax, eax
je 0x1400a46ef
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 1]
call qword [0x14013ed80]
test eax, eax
jne 0x1400a466a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400a46ef
mov edx, dword [rsp + 0x50]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x1400a46ef
mov r9d, dword [rsp + 0x50]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [0x14013ed80]
test eax, eax
je 0x1400a46ef
mov rcx, qword [r14]
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
xor r8d, r8d
mov ecx, eax
mov ebx, eax
lea edx, [r8 + 1]
call fcn.1400a64d0
mov r8, qword [r14]
mov rdx, rax
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x1400a46ef
mov rax, rsi
mov qword [0x14013e688], rsi
mov rsi, rdi
mov rdi, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400a470d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1400a471b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x1400a4728
mov rcx, rsi
call fcn.1400a62e0
mov rax, rdi
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret