Function at 0x1801efdc0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r15, r9
movzx r12d, r8b
mov r13, rdx
xor r14d, r14d
mov qword [rsp + 0x80], r14
mov ebx, r14d
mov qword [rsp + 0x78], r14
mov esi, r14d
mov dword [rsp + 0xb8], ebx
mov word [rsp + 0xbc], 0x100
mov rax, qword [rcx]
mov rdi, qword [rax + 0x50]
mov qword [rsp + 0x68], rdi
test rdi, rdi
jne 0x1801efe4c
xor eax, eax
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.InitializeSecurityDescriptor
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801f00df
mov edx, 1
mov rcx, r13
call rax
test eax, eax
je 0x1801f00df
lea rdx, str.AllocateAndInitializeSid
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801f00df
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb8]
call rax
test eax, eax
je 0x1801f00df
lea rdx, str.GetLengthSid
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801f00df
mov rcx, qword [rsp + 0x80]
call rax
lea r14d, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r14d
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1801f00dc
lea rdx, str.InitializeAcl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801f00dc
mov r8d, 2
mov edx, r14d
mov rcx, rbx
call rax
test eax, eax
je 0x1801f00dc
lea rdx, str.AddAccessAllowedAce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801f00dc
mov r9, qword [rsp + 0x80]
mov edx, 2
mov r8d, 0x10000000
mov rcx, rbx
call rax
test eax, eax
je 0x1801f00dc
lea rdx, str.SetSecurityDescriptorDacl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1801f00dc
test r12b, r12b
je 0x1801f007d
lea rcx, [rsp + 0xc0]
call fcn.1801df7b0
cmp dword [rsp + 0xc4], 6
ja 0x1801effdc
jne 0x1801f007d
cmp dword [rsp + 0xc8], 2
jb 0x1801f007d
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x88], 0x10000000
mov qword [rsp + 0x8c], 2
mov r12d, 1
mov dword [rsp + 0xa4], r12d
mov dword [rsp + 0xa8], 5
lea rax, str.ALL_APPLICATION_PACKAGES
mov qword [rsp + 0xb0], rax
lea rdx, [0x180393590]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801f0083
lea r9, [rsp + 0x78]
mov r8, rbx
lea rdx, [rsp + 0x88]
mov ecx, r12d
call rax
test eax, eax
je 0x1801f0083
jmp 0x1801f00ba
mov r12d, 1
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x1801f00c3
xor r9d, r9d
mov edx, r12d
mov rcx, r13
call r14
test eax, eax
je 0x1801f00af
mov esi, r12d
mov dword [rsp + 0x60], r12d
cmp qword [rsp + 0x78], 0
jne 0x1801f00dc
jmp 0x1801f00c3
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x78], 0
xor r9d, r9d
mov r8, rbx
mov edx, r12d
mov rcx, r13
call r14
test eax, eax
cmovne esi, r12d
mov dword [rsp + 0x60], esi
xor r14d, r14d
cmp qword [rsp + 0x80], 0
je 0x1801f0111
lea rdx, str.FreeSid
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801f0111
mov rcx, qword [rsp + 0x80]
call rax
mov qword [rsp + 0x80], r14
test esi, esi
jne 0x1801f0146
test rbx, rbx
je 0x1801f0131
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, r14
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1801f0146
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x78], r14
test r15, r15
je 0x1801f0153
mov rax, qword [rsp + 0x78]
mov qword [r15], rax
mov rax, rbx
jmp 0x1801efe29