Function at 0x140006677
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140129340
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1c0
mov rdi, rsp
mov ecx, 0x70
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d0]
mov rax, qword [0x1402840e8]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xe4], 0
mov qword [rsp + 0xf8], 0
mov byte [rsp + 0x104], 0
mov byte [rsp + 0x105], 0
mov byte [rsp + 0x106], 0
mov byte [rsp + 0x107], 0
mov byte [rsp + 0x108], 0
mov byte [rsp + 0x109], 1
mov dword [rsp + 0x114], 4
mov rax, qword [rsp + 0x1d0]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x118], rax
cmp qword [rsp + 0x118], 0
jne 0x14012942c
xor eax, eax
jmp 0x1401299fe
mov qword [rsp + 0x120], 0
lea rdx, str.InitializeSecurityDescriptor
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x120], rax
cmp qword [rsp + 0x120], 0
jne 0x14012947b
mov r8d, 0x6d
lea rdx, [0x1402253a0]
lea rcx, str.pfnInitializeSecurityDescriptor___0
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x120], 0
jne 0x14012948b
jmp 0x1401298f9
mov edx, 1
mov rcx, qword [rsp + 0x1d8]
call qword [rsp + 0x120]
test eax, eax
jne 0x1401294a8
jmp 0x1401298f9
mov qword [rsp + 0x128], 0
lea rdx, str.AllocateAndInitializeSid
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x128], rax
cmp qword [rsp + 0x128], 0
jne 0x1401294f7
mov r8d, 0x7a
lea rdx, [0x1402254b0]
lea rcx, str.pfnAllocateAndInitializeSid___0
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x128], 0
jne 0x140129507
jmp 0x1401298f9
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x104]
call qword [rsp + pe_nt_image_headers64]
test eax, eax
jne 0x140129564
jmp 0x1401298f9
mov qword [rsp + 0x130], 0
lea rdx, str.GetLengthSid
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x130], rax
cmp qword [rsp + 0x130], 0
jne 0x1401295b3
mov r8d, 0x90
lea rdx, [0x1402255d0]
lea rcx, str.pfnGetLengthSid___0
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x130], 0
jne 0x1401295c3
jmp 0x1401298f9
mov rcx, qword [rsp + 0x88]
call qword [rsp + 0x130]
mov eax, eax
add rax, 0x10
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x1b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x1b0]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x14012961f
jmp 0x1401298f9
mov qword [rsp + 0x138], 0
lea rdx, str.InitializeAcl
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x138], 0
jne 0x14012966e
mov r8d, 0xa5
lea rdx, [0x1402256a0]
lea rcx, str.pfnInitializeAcl___0
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x138], 0
jne 0x14012967e
jmp 0x1401298f9
mov r8d, 2
mov edx, dword [rsp + 0x64]
mov rcx, qword [rsp + 0xa8]
call qword [rsp + 0x138]
test eax, eax
jne 0x1401296a0
jmp 0x1401298f9
mov qword [rsp + 0x140], 0
lea rdx, str.AddAccessAllowedAce
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x140], rax
cmp qword [rsp + 0x140], 0
jne 0x1401296ef
mov r8d, 0xb3
lea rdx, [0x140225770]
lea rcx, str.pfnAddAccessAllowedAce___0
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x140], 0
jne 0x1401296ff
jmp 0x1401298f9
mov r9, qword [rsp + 0x88]
mov r8d, 0x10000000
mov edx, 2
mov rcx, qword [rsp + 0xa8]
call qword [rsp + 0x140]
test eax, eax
jne 0x14012972a
jmp 0x1401298f9
mov qword [rsp + 0x148], 0
lea rdx, str.SetSecurityDescriptorDacl
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0x148], 0
jne 0x140129779
mov r8d, 0xc5
lea rdx, [0x1402258a0]
lea rcx, str.pfnSetSecurityDescriptorDacl___0
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x148], 0
jne 0x140129789
jmp 0x1401298f9
movzx eax, byte [rsp + 0x1e0]
test eax, eax
je 0x14012985f
call fcn.1400019b0
movzx eax, al
test eax, eax
je 0x14012985f
lea rax, [rsp + 0x158]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x158], 0x10000000
mov dword [rsp + 0x15c], 2
mov dword [rsp + 0x160], 0
mov dword [rsp + 0x174], 1
mov dword [rsp + 0x178], 5
lea rax, str.ALL_APPLICATION_PACKAGES
mov qword [rsp + 0x180], rax
lea rdx, str.SetEntriesInAclW
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x198], rax
cmp qword [rsp + 0x198], 0
je 0x14012985f
lea r9, [rsp + 0xc8]
mov r8, qword [rsp + 0xa8]
lea rdx, [rsp + 0x158]
mov ecx, 1
call qword [rsp + 0x198]
test eax, eax
je 0x14012985f
mov qword [rsp + 0xc8], 0
cmp qword [rsp + 0xc8], 0
je 0x1401298b4
xor r9d, r9d
mov r8, qword [rsp + 0xc8]
mov edx, 1
mov rcx, qword [rsp + 0x1d8]
call qword [rsp + 0x148]
test eax, eax
je 0x14012989a
mov dword [rsp + 0xe4], 1
jmp 0x1401298b4
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xc8], 0
cmp dword [rsp + 0xe4], 0
je 0x1401298c9
cmp qword [rsp + 0xc8], 0
jne 0x1401298f9
xor r9d, r9d
mov r8, qword [rsp + 0xa8]
mov edx, 1
mov rcx, qword [rsp + 0x1d8]
call qword [rsp + 0x148]
test eax, eax
jne 0x1401298ee
jmp 0x1401298f9
mov dword [rsp + 0xe4], 1
cmp qword [rsp + 0x88], 0
je 0x140129979
mov qword [rsp + 0x1a0], 0
lea rdx, str.FreeSid
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1a0], rax
cmp qword [rsp + 0x1a0], 0
jne 0x140129953
mov r8d, 0x102
lea rdx, [0x1402259d0]
lea rcx, str.pfnFreeSid___0
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x1a0], 0
je 0x140129979
mov rcx, qword [rsp + 0x88]
call qword [rsp + 0x1a0]
mov qword [rsp + 0x88], 0
cmp dword [rsp + 0xe4], 0
jne 0x1401299d8
cmp qword [rsp + 0xa8], 0
je 0x1401299b3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0xa8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0xa8], 0
cmp qword [rsp + 0xc8], 0
je 0x1401299d8
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xc8], 0
cmp qword [rsp + 0x1e8], 0
je 0x1401299f6
mov rax, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov rax, qword [rsp + 0xa8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140225dc0]
call fcn.14000849f
mov rax, rdi
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1400030d0
add rsp, 0x1c0
pop rdi
ret