Function at 0x14002bb00
Capabilities:
Link many functions at runtime

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x118
mov rax, qword [0x14017c820]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor ebx, ebx
mov qword [r11 + 8], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
lea rcx, str.Advapi32.dll
mov qword [r11 - 0x38], r15
mov r14, rbx
mov qword [rsp + 0xb8], r8
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov rbp, rbx
mov rsi, rbx
mov dword [rsp + 0x60], ebx
mov byte [r11 - 0x50], bl
mov byte [r11 - 0x4f], bl
mov byte [r11 - 0x4e], bl
mov byte [r11 - 0x4d], bl
mov byte [r11 - 0x4c], bl
mov byte [r11 - 0x4b], 5
mov r12, rbx
mov r13, rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa8], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x14002bc8e
lea rdx, [0x1401137d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r12, rax
je 0x14002bf29
lea rdx, [0x1401137c8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r13, rax
je 0x14002bf29
lea rdx, [0x1401137b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r14, rax
je 0x14002bf29
lea rdx, [0x1401137a8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsp + 0xa0], rax
je 0x14002bf29
lea rdx, [0x140113788]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsp + 0x90], rax
je 0x14002bf29
lea rdx, [0x140113768]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsp + 0x98], rax
je 0x14002bf29
lea rdx, str.AddAce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsp + 0xa8], rax
je 0x14002bf29
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0xd8]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call r12
test eax, eax
je 0x14002bf29
lea rax, [rsp + 0x78]
xor r9d, r9d
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r8d, [r9 + 0x12]
mov dl, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call r12
test eax, eax
je 0x14002bf29
mov rcx, qword [rsp + 0x68]
call r14
lea r15d, [rax + 0xc]
mov ecx, r15d
call fcn.1400d8d48
test rax, rax
mov r12, rax
mov qword [rsp + 0x80], rax
je 0x14002bf29
mov byte [rax], bl
mov word [rax + 2], r15w
mov byte [rax + 1], bl
mov dword [rax + 4], 0x1f0001
mov rcx, qword [rsp + 0x68]
call r14
mov rdx, qword [rsp + 0x68]
lea rcx, [r12 + 8]
mov r8d, eax
call fcn.1400f24b0
mov rcx, qword [rsp + 0x78]
call r14
add eax, 0xc
mov rcx, rax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0xb0], rax
call fcn.1400d8d48
test rax, rax
mov r12, rax
je 0x14002bef2
mov byte [rax], bl
mov eax, dword [rsp + 0x70]
mov byte [r12 + 1], bl
mov word [r12 + 2], ax
mov dword [r12 + 4], 0x1f0001
mov rcx, qword [rsp + 0x78]
call r14
mov rdx, qword [rsp + 0x78]
lea rcx, [r12 + 8]
mov r8d, eax
call fcn.1400f24b0
mov r10, qword [rsp + 0xb0]
lea rcx, [r10 + r15 + 8]
call fcn.1400d8d48
test rax, rax
mov rbp, rax
je 0x14002bee8
mov eax, dword [rsp + 0x70]
mov r8d, 2
mov rcx, rbp
lea edx, [rax + r15 + 8]
call qword [rsp + 0xa0]
test eax, eax
je 0x14002bede
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0xa8]
or r8d, 0xffffffff
movzx eax, word [r14 + 2]
mov edx, 2
mov rcx, rbp
mov r9, r14
mov dword [rsp + 0x20], eax
call r15
test eax, eax
je 0x14002befa
movzx eax, word [r12 + 2]
mov r9, r12
or r8d, 0xffffffff
mov edx, 2
mov rcx, rbp
mov dword [rsp + 0x20], eax
call r15
test eax, eax
je 0x14002befa
mov ecx, 0x200
call fcn.1400d8d48
test rax, rax
mov rsi, rax
je 0x14002befa
mov edx, 1
mov rcx, rax
call qword [rsp + DllRegisterServer]
test eax, eax
je 0x14002befa
xor r9d, r9d
mov r8, rbp
mov rcx, rsi
lea edx, [r9 + 1]
call qword [rsp + 0x98]
test eax, eax
je 0x14002befa
mov r8, qword [rsp + 0xb8]
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0xc0], SafeArrayPutElement
mov dword [rsp + 0xd0], ebx
mov qword [rsp + 0xc8], rsi
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
jmp 0x14002befa
mov r14, qword [rsp + 0x80]
jmp 0x14002befa
mov r14, qword [rsp + 0x80]
jmp 0x14002befa
mov r14, qword [rsp + 0x80]
mov rcx, r14
call fcn.1400d8d50
test r12, r12
je 0x14002bf0f
mov rcx, r12
call fcn.1400d8d50
test rsi, rsi
je 0x14002bf1c
mov rcx, rsi
call fcn.1400d8d50
test rbp, rbp
je 0x14002bf29
mov rcx, rbp
call fcn.1400d8d50
mov rcx, qword [rsp + 0x68]
mov r15, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xf8]
test rcx, rcx
mov r12, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x130]
je 0x14002bf5e
call r13
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14002bf6b
call r13
test rbx, rbx
mov r13, qword [rsp + 0x100]
je 0x14002bf82
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14002bf90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400efff0
add rsp, 0x118
pop rdi
pop rbx
ret