Function at 0x18009ae80
Capabilities:
Check os version
Extract resource via kernel32 functions
Link many functions at runtime

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x350
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov r13, r9
movzx r15d, r8b
mov rdi, rdx
mov qword [rsp + 0x78], rdx
xor r12d, r12d
mov qword [rsp + 0x98], r12
mov ebx, r12d
mov qword [rsp + 0x90], r12
mov r14d, r12d
mov dword [rsp + 0xd0], ebx
mov word [rsp + 0xd4], 0x100
mov rax, qword [rcx]
mov rsi, qword [rax + 0x50]
mov qword [rsp + 0x80], rsi
test rsi, rsi
jne 0x18009af17
xor eax, eax
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.1801ccd40
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.InitializeSecurityDescriptor
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18009b366
mov edx, 1
mov rcx, rdi
call rax
test eax, eax
je 0x18009b366
lea rdx, str.AllocateAndInitializeSid
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18009b366
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd0]
call rax
test eax, eax
je 0x18009b366
lea rdx, str.GetLengthSid
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18009b366
mov rcx, qword [rsp + 0x98]
call rax
lea edi, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x18009b366
lea rdx, str.InitializeAcl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18009b366
mov r8d, 2
mov edx, edi
mov rcx, rbx
call rax
test eax, eax
je 0x18009b366
lea rdx, str.AddAccessAllowedAce
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18009b366
mov r9, qword [rsp + 0x98]
mov edx, 2
mov r8d, 0x10000000
mov rcx, rbx
call rax
test eax, eax
je 0x18009b366
lea rdx, str.SetSecurityDescriptorDacl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x18009b363
test r15b, r15b
je 0x18009b2e5
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0xe0]
call fcn.1801cf330
mov dword [rsp + 0xe0], 0x11c
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18009b21b
cmp dword [rsp + 0xe4], 6
ja 0x18009b0d1
jne 0x18009b1a2
cmp dword [rsp + 0xe8], 2
jb 0x18009b1a2
xor r15d, r15d
mov dword [rsp + 0x64], r15d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x6c], r15d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x18009b1a5
lea edx, [r15 + 1]
lea r8d, [r15 + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x18009b1a5
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18009b1a5
movups xmm0, xmmword [0x1802255d0]
movups xmmword [rsp + 0x320], xmm0
movups xmm1, xmmword [0x1802255e0]
movups xmmword [rsp + 0x330], xmm1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x18009b1a5
lea rcx, [rax + 6]
lea rdx, [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18009b1a5
cmp word [rdi + 2], r15w
jbe 0x18009b1a5
movzx edx, word [rdi + 0x32]
mov dword [rsp + 0x64], edx
movzx ecx, word [rdi + 0x30]
mov dword [rsp + 0x68], ecx
movzx eax, word [rdi + 0x36]
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0xe4], edx
mov dword [rsp + 0xe8], ecx
mov dword [rsp + 0xec], eax
jmp 0x18009b1a5
xor r15d, r15d
mov dword [rsp + 0x70], r15d
mov byte [rsp + 0x60], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18009b21e
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0x200]
call fcn.1801cf330
mov dword [rsp + 0x200], 0x11c
lea rcx, [rsp + 0x200]
call rdi
test eax, eax
jne 0x18009b21e
mov eax, dword [rsp + 0x20c]
mov dword [rsp + 0x70], eax
mov byte [rsp + 0x60], 1
mov dword [rsp + 0xec], eax
jmp 0x18009b21e
xor r15d, r15d
cmp dword [rsp + 0xe4], 6
ja 0x18009b23c
jne 0x18009b2e8
cmp dword [rsp + 0xe8], 2
jb 0x18009b2e8
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xa0], 0x10000000
mov qword [rsp + 0xa4], 2
mov edi, 1
mov dword [rsp + 0xbc], edi
mov dword [rsp + 0xc0], 5
lea rax, str.ALL_APPLICATION_PACKAGES
mov qword [rsp + 0xc8], rax
lea rdx, str.SetEntriesInAclW
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18009b2ed
lea r9, [rsp + 0x90]
mov r8, rbx
lea rdx, [rsp + 0xa0]
mov ecx, edi
call rax
test eax, eax
je 0x18009b2ed
mov qword [rsp + 0x90], r15
jmp 0x18009b33e
xor r15d, r15d
mov edi, 1
mov r8, qword [rsp + 0x90]
test r8, r8
je 0x18009b33e
xor r9d, r9d
mov edx, edi
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call r12
test eax, eax
je 0x18009b326
mov r14d, 1
mov dword [rsp + 0x74], r14d
cmp qword [rsp + 0x90], 0
jne 0x18009b363
jmp 0x18009b343
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x90], r15
jmp 0x18009b343
mov rdi, qword [rsp + 0x78]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 1]
mov rcx, rdi
call r12
test eax, eax
mov eax, 1
cmovne r14d, eax
mov dword [rsp + 0x74], r14d
xor r12d, r12d
cmp qword [rsp + 0x98], 0
je 0x18009b398
lea rdx, str.FreeSid
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18009b398
mov rcx, qword [rsp + 0x98]
call rax
mov qword [rsp + 0x98], r12
test r14d, r14d
jne 0x18009b3d4
test rbx, rbx
je 0x18009b3b9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, r12
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x18009b3d4
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x90], r12
test r13, r13
je 0x18009b3e5
mov rax, qword [rsp + 0x90]
mov qword [r13], rax
mov rax, rbx
jmp 0x18009aef4