Function at 0x140017008
Capabilities:
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x14028b7c8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor ebp, ebp
lea rcx, str.Advapi32.dll
mov qword [rsp + 0xb8], r8
mov dword [rsp + 0x88], edx
mov byte [r11 - 0x4b], 5
mov r13, rbp
mov qword [rsp + 0x68], rbp
mov qword [r11 - 0xa8], rbp
mov qword [rsp + 0x70], rbp
mov rsi, rbp
mov rbx, rbp
mov r15d, ebp
mov byte [r11 - 0x50], bpl
mov byte [r11 - 0x4f], bpl
mov byte [r11 - 0x4e], bpl
mov byte [r11 - 0x4d], bpl
mov byte [r11 - 0x4c], bpl
mov r14, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
cmp rax, rbp
je 0x1400173fb
lea rdx, [0x1401ce3f8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401ce3f0]
mov rcx, r12
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401ce3e0]
mov rcx, r12
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401ce3d0]
mov rcx, r12
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401ce3b0]
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401ce390]
mov rcx, r12
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AddAce
mov rcx, r12
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa8], rax
test rdi, rdi
je 0x1400173f6
test r14, r14
je 0x1400173f6
test r15, r15
je 0x1400173f6
test rbp, rbp
je 0x1400173f6
xor ebp, ebp
cmp qword [rsp + 0x98], rbp
je 0x1400173f8
cmp qword [rsp + 0x90], rbp
je 0x1400173f8
cmp rax, rbp
je 0x1400173f8
lea rax, [rsp + 0x80]
lea r8d, [rbx + 0x20]
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call rdi
cmp eax, ebp
je 0x1400173f8
lea rax, [rsp + 0x70]
lea r8d, [rbx + 0x12]
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
xor r9d, r9d
mov dl, 1
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call rdi
cmp eax, ebp
je 0x1400173f8
mov rcx, qword [rsp + 0x80]
call r15
lea r13d, [rax + 0xc]
mov ecx, r13d
call fcn.14013f170
mov rbp, rax
test rax, rax
je 0x1400173f3
mov byte [rax], bl
mov word [rax + 2], r13w
mov byte [rax + 1], bl
mov dword [rax + 4], 0x1f0001
mov rcx, qword [rsp + 0x80]
call r15
mov rdx, qword [rsp + 0x80]
lea rcx, [rbp + 8]
mov r8d, eax
call fcn.140159620
mov rcx, qword [rsp + 0x70]
call r15
add eax, 0xc
mov rcx, rax
mov dword [rsp + 0x78], eax
mov qword [rsp + 0xb0], rax
call fcn.14013f170
mov rdi, rax
test rax, rax
je 0x1400173ba
mov byte [rax], bl
mov eax, dword [rsp + 0x78]
mov byte [rdi + 1], bl
mov word [rdi + 2], ax
mov dword [rdi + 4], 0x1f0001
mov rcx, qword [rsp + 0x70]
call r15
mov rdx, qword [rsp + 0x70]
lea rcx, [rdi + 8]
mov r8d, eax
call fcn.140159620
mov r10, qword [rsp + 0xb0]
lea rcx, [r10 + r13 + 8]
call fcn.14013f170
mov rsi, rax
test rax, rax
je 0x1400173ba
mov eax, dword [rsp + 0x78]
lea r15d, [rbx + 2]
mov rcx, rsi
lea edx, [rax + r13 + 8]
mov r8d, r15d
call qword [rsp + 0xa0]
test eax, eax
je 0x1400173ba
movzx eax, word [rbp + 2]
mov r13, qword [rsp + 0xa8]
mov r9, rbp
or r8d, 0xffffffff
mov edx, r15d
mov rcx, rsi
mov dword [rsp + 0x20], eax
call r13
test eax, eax
je 0x1400173ba
movzx eax, word [rdi + 2]
mov r9, rdi
or r8d, 0xffffffff
mov edx, r15d
mov rcx, rsi
mov dword [rsp + 0x20], eax
call r13
test eax, eax
je 0x1400173ba
mov ecx, 0x200
call fcn.14013f170
mov rbx, rax
test rax, rax
je 0x1400173b0
lea r13d, [r15 - 1]
mov rcx, rax
mov edx, r13d
call qword [rsp + 0x98]
test eax, eax
je 0x1400173b0
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, rbx
call qword [rsp + DllRegisterServer]
mov r8, qword [rsp + 0xb8]
mov edx, dword [rsp + 0x88]
and dword [rsp + 0xd0], 0
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0xc0], 0x18
mov qword [rsp + 0xc8], rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
jmp 0x1400173c0
mov r13, qword [rsp + 0x68]
mov r15d, r13d
jmp 0x1400173c0
mov r13, rbx
mov r15d, ebx
mov rcx, rbp
call fcn.14013f178
xor ebp, ebp
cmp rdi, rbp
je 0x1400173d7
mov rcx, rdi
call fcn.14013f178
cmp rbx, rbp
je 0x1400173e4
mov rcx, rbx
call fcn.14013f178
cmp rsi, rbp
je 0x1400173fb
mov rcx, rsi
call fcn.14013f178
jmp 0x1400173fb
mov r13, rbx
xor ebp, ebp
mov r15d, ebx
mov rcx, qword [rsp + 0x80]
cmp rcx, rbp
je 0x14001740b
call r14
mov rcx, qword [rsp + 0x70]
cmp rcx, rbp
je 0x140017418
call r14
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp r12, rbp
je 0x14001742f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, r13
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140156fd0
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret