Function at 0x18006bec0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword gs:[0x60]
xor ebx, ebx
and qword [rsp + 0x30], rbx
xor r12d, r12d
and qword [rsp + 0x38], rbx
xor r14d, r14d
xor r9d, r9d
mov r10d, edx
mov r13, qword [rax + 0x30]
lea r11d, [rbx + 8]
mov esi, r11d
mov r15d, r11d
test edx, edx
je 0x18006bf5c
mov r8, rcx
mov rax, qword [r8 + 8]
movzx edx, byte [r8]
mov rcx, qword [rax]
movzx eax, byte [rcx + 1]
lea ecx, [rax*4 + 8]
test edx, edx
jne 0x18006c176
add ecx, 0xc
lea eax, [rcx + rsi]
cmp eax, esi
jb 0x1800bd83b
mov esi, eax
cmp r12d, ecx
cmova ecx, r12d
inc r9d
add r8, 0x10
mov r12d, ecx
cmp r9d, r10d
jb 0x18006bf18
mov ecx, 0x28
cmp esi, r11d
je 0x18006bf73
lea eax, [rsi + 0x28]
cmp eax, ecx
jb 0x1800bd83b
mov ecx, eax
cmp r15d, r11d
jne 0x1800bd84f
mov edx, dword [0x18015c294]
mov r8d, ecx
add edx, 0x140000
mov rcx, r13
call sym.ntdll.dll_RtlAllocateHeap
mov rdi, rax
test rax, rax
je 0x1800bd83b
lea rbp, [rax + 0x28]
cmp esi, 8
je 0x18006bfcc
mov rcx, rbp
mov eax, esi
mov r8d, 2
mov qword [rsp + 0x30], rcx
mov edx, esi
add rbp, rax
call sym.ntdll.dll_RtlCreateAcl
mov ebx, eax
test eax, eax
js 0x1800bd87e
cmp r15d, 8
jne 0x1800bd85e
mov edx, dword [0x18015c294]
mov rcx, r13
add edx, 0x140000
mov r8d, r12d
call sym.ntdll.dll_RtlAllocateHeap
mov r14, rax
test rax, rax
je 0x1800bd891
xor r15d, r15d
cmp dword [rsp + 0x98], r15d
jbe 0x18006c0b4
mov rsi, qword [rsp + 0x90]
add rsi, 4
mov rax, qword [rsi + 4]
xor r12d, r12d
movzx ecx, byte [rsi - 4]
mov r8, qword [rax]
movzx eax, byte [r8 + 1]
lea ebp, [rax*4 + 8]
test ecx, ecx
jne 0x18006c184
mov edx, dword [rsi]
lea ebp, [rax*4 + 0x14]
mov al, byte [rsi - 2]
mov cl, byte [rsi - 3]
mov byte [r14], r12b
mov r12, qword [rsp + 0x30]
or cl, al
mov dword [r14 + 4], edx
mov byte [r14 + 1], cl
lea rdx, [r14 + 8]
mov word [r14 + 2], bp
movzx eax, byte [r8 + 1]
lea ecx, [rax*4 + 8]
call sym.ntdll.dll_RtlCopySid
mov ebx, eax
test ebx, ebx
js 0x1800bd87e
mov r9, r14
mov dword [rsp + 0x20], ebp
or r8d, 0xffffffff
mov edx, 2
mov rcx, r12
call sym.ntdll.dll_RtlAddAce
mov ebx, eax
test eax, eax
js 0x1800bd87e
inc r15d
add rsi, 0x10
cmp r15d, dword [rsp + 0x98]
jb 0x18006c016
mov edx, 1
mov rcx, rdi
call sym.ntdll.dll_RtlCreateSecurityDescriptor
mov ebx, eax
test eax, eax
js 0x1800bd87e
mov rdx, qword [rsp + 0xa0]
xor r8d, r8d
mov rcx, rdi
call sym.ntdll.dll_RtlSetOwnerSecurityDescriptor
mov ebx, eax
test eax, eax
js 0x1800bd87e
mov rdx, qword [rsp + 0xa8]
xor r8d, r8d
mov rcx, rdi
call sym.ntdll.dll_RtlSetGroupSecurityDescriptor
mov ebx, eax
test eax, eax
js 0x1800bd87e
mov r8, qword [rsp + 0x30]
xor r9d, r9d
mov dl, 1
mov rcx, rdi
call sym.ntdll.dll_RtlSetDaclSecurityDescriptor
mov ebx, eax
test eax, eax
js 0x1800bd87e
mov rax, qword [rsp + 0x38]
mov rcx, rdi
test rax, rax
mov r8, rax
setne dl
xor r9d, r9d
call sym.ntdll.dll_RtlSetSaclSecurityDescriptor
mov ebx, eax
test eax, eax
js 0x1800bd87e
xor ebx, ebx
mov rax, qword [rsp + 0xb0]
mov qword [rax], rdi
test r14, r14
je 0x18006c163
mov r8, r14
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
mov eax, ebx
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
sub edx, 1
je 0x18006bf36
jmp 0x1800bd822
sub ecx, 1
jne 0x1800bd898
mov edx, dword [rsi]
add ebp, 0xc
mov al, byte [rsi - 2]
mov cl, byte [rsi - 3]
mov byte [r14], 1
jmp 0x18006c04a
cmp edx, 1
jne 0x1800bd845
add ecx, 0xc
lea eax, [rcx + r15]
cmp eax, r15d
jb 0x1800bd83b
mov r15d, eax
jmp 0x18006bf46
mov ebx, 0xc0000017
jmp 0x18006c163
mov eax, 0xc000000d
jmp 0x18006c165
lea eax, [rcx + r15]
cmp eax, ecx
jb 0x1800bd83b
mov ecx, eax
jmp 0x18006bf7c
mov r8d, 2
mov qword [rsp + 0x38], rbp
mov edx, r15d
mov rcx, rbp
call sym.ntdll.dll_RtlCreateAcl
mov ebx, eax
test eax, eax
jns 0x18006bfd6
mov r8, rdi
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
nop
jmp 0x18006c151
mov ebx, 0xc0000017
jmp 0x1800bd87e
cmp ecx, 1
jne 0x18006c075
mov edx, dword [rsi]
add ebp, 0xc
mov al, byte [rsi - 2]
mov cl, byte [rsi - 3]
mov r12, qword [rsp + 0x38]
mov byte [r14], 2
jmp 0x18006c04f