Function at 0x1400111e0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x1e8
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0xa1]
mov rsi, r9
call fcn.140019870
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0x100
test rdi, rdi
je 0x140011494
xor eax, eax
lea rcx, [rsp + 0xa0]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov eax, dword [0x140188f40]
movsd xmm0, qword [str.advapi32.dll]
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x140188f44]
mov byte [rsp + 0xac], al
movsd qword [rsp + 0xa0], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1401fcdd0], rax
test rax, rax
je 0x140011494
mov qword [rsp + 0x1e0], rbp
lea rdx, str.AllocateAndInitializeSid
mov qword [rsp + 0x1d8], r12
mov rcx, rax
mov qword [rsp + 0x1d0], r13
mov qword [rsp + 0x1c8], r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401fcdd0]
lea rdx, str.SetEntriesInAclW
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401fcdd0]
lea rdx, str.InitializeSecurityDescriptor
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401fcdd0]
lea rdx, str.SetSecurityDescriptorDacl
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401fcdd0]
lea rdx, str.FreeSid
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401fcdd8], rax
test r13, r13
je 0x140011485
test r15, r15
je 0x140011485
test rbp, rbp
je 0x140011485
test r12, r12
je 0x140011485
test rax, rax
je 0x140011485
xor eax, eax
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x38], eax
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov dl, 1
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call r13
test eax, eax
je 0x140011485
mov rax, qword [rbx]
lea rdx, [rsp + 0x68]
xor r13d, r13d
mov qword [rsp + 0x88], 5
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0x1f0001
mov r9, r14
mov dword [rsp + 0x6c], 1
xor r8d, r8d
mov dword [rsp + 0x70], 3
lea ecx, [r13 + 1]
mov dword [rsp + 0x84], r13d
movdqu xmmword [rsp + 0x74], xmm0
mov qword [rsp + 0x90], rax
call r15
test eax, eax
jne 0x140011425
lea edx, [rax + 0x28]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14001141c
lea edx, [r13 + 1]
mov rcx, rax
call rbp
mov rcx, qword [rsi]
test eax, eax
je 0x140011416
mov r8, qword [r14]
lea edx, [r13 + 1]
xor r9d, r9d
call r12
test eax, eax
jne 0x14001146d
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbx]
call qword [0x1401fcdd8]
xor eax, eax
mov r13, qword [rsp + 0x1d0]
mov r12, qword [rsp + 0x1d8]
mov rbp, qword [rsp + 0x1e0]
mov r15, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140016d70
add rsp, 0x1e8
pop r14
pop rdi
pop rsi
pop rbx
ret
mov dword [rdi], 0x18
mov eax, 1
mov rcx, qword [rsi]
mov qword [rdi + 8], rcx
mov dword [rdi + 0x10], r13d
jmp 0x140011430
mov rcx, qword [0x1401fcdd0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14001142e
xor eax, eax
jmp 0x140011450