Function at 0x1400646e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400d5360], rax
test rax, rax
je 0x140064a5d
lea rdx, str.CreateWellKnownSid
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.GetFileSecurityA
mov qword [0x1400d5368], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b6610]
mov qword [0x1400d5370], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b6628]
mov qword [0x1400d5378], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.BuildTrusteeWithSidA
mov qword [0x1400d5380], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.BuildTrusteeWithSidW
mov qword [0x1400d5388], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.GetEffectiveRightsFromAclA
mov qword [0x1400d5390], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.GetEffectiveRightsFromAclW
mov qword [0x1400d5398], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b66b8]
mov qword [0x1400d53a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b66c8]
mov qword [0x1400d53a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b66dc]
mov qword [0x1400d53b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.LookupAccountSidA
mov qword [0x1400d53b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b6700]
mov qword [0x1400d53c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b6714]
mov qword [0x1400d53c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.DuplicateTokenEx
mov qword [0x1400d53d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.CryptAcquireContextA
mov qword [0x1400d53d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b6750]
mov qword [0x1400d53e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b6768]
mov qword [0x1400d53e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b6788]
mov qword [0x1400d53f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.AddAccessAllowedAceEx
mov qword [0x1400d53f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400b67a8]
mov qword [0x1400d5400], rax
mov rcx, qword [0x1400d5360]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.SetFileSecurityA
mov qword [0x1400d5408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, [0x1400b67e0]
mov qword [0x1400d5410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.StartServiceCtrlDispatcherA
mov qword [0x1400d5418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.StartServiceCtrlDispatcherW
mov qword [0x1400d5420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.RegisterServiceCtrlHandlerA
mov qword [0x1400d5428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.RegisterServiceCtrlHandlerW
mov qword [0x1400d5430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.SetServiceStatus
mov qword [0x1400d5438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.RegisterServiceCtrlHandlerExA
mov qword [0x1400d5440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.RegisterServiceCtrlHandlerExW
mov qword [0x1400d5448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.ConvertStringSidToSidA
mov qword [0x1400d5450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d5360]
lea rdx, str.ConvertStringSidToSidW
mov qword [0x1400d5458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400d5460], rax
add rsp, 0x28
ret