Function at 0x170055730
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov r15, rdx
mov rdi, rcx
cmp word [rcx + 2], 0
js 0x1700559be
mov ebx, 0xc0000058
cmp byte [rdi], 1
jne 0x170055b81
mov rax, qword [rdi + 0x20]
mov qword [r15 + 0x20], rax
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r15 + 0x10], xmm1
movups xmmword [r15], xmm0
mov rsi, qword [rdi + 8]
test rsi, rsi
je 0x170055836
test byte [0x17008d960], 8
je 0x1700557af
mov qword [rsp + 0x20], rsi
lea r8, [0x170078c30]
lea r9, str.sid_p_n
mov ecx, 3
call fcn.1700552c0
movzx esi, byte [rsi + 1]
lea r8, [rsi*4 + 8]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r15 + 8], rax
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x170055836
mov r14, rax
mov rcx, rbx
call sym.ntdll.dll_RtlValidSid
test al, al
je 0x170055836
shl rsi, 2
test byte [0x17008d960], 8
je 0x170055819
mov qword [rsp + 0x20], rbx
lea r8, [0x170078c30]
lea r9, str.sid_p_n
mov ecx, 3
call fcn.1700552c0
movzx r8d, byte [rbx + 1]
shl r8, 2
cmp r8d, esi
ja 0x170055836
add r8, 8
mov rcx, r14
mov rdx, rbx
call sym.ntdll.dll_memmove
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x1700558f0
test byte [0x17008d960], 8
je 0x170055869
mov qword [rsp + 0x20], rsi
lea r8, [0x170078c30]
lea r9, str.sid_p_n
mov ecx, 3
call fcn.1700552c0
movzx esi, byte [rsi + 1]
lea r8, [rsi*4 + 8]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r15 + 0x10], rax
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1700558f0
mov r14, rax
mov rcx, rbx
call sym.ntdll.dll_RtlValidSid
test al, al
je 0x1700558f0
shl rsi, 2
test byte [0x17008d960], 8
je 0x1700558d3
mov qword [rsp + 0x20], rbx
lea r8, [0x170078c30]
lea r9, str.sid_p_n
mov ecx, 3
call fcn.1700552c0
movzx r8d, byte [rbx + 1]
shl r8, 2
cmp r8d, esi
ja 0x1700558f0
add r8, 8
mov rcx, r14
mov rdx, rbx
call sym.ntdll.dll_memmove
test byte [rdi + 2], 0x10
je 0x17005594d
mov rax, qword [rdi + 0x18]
movzx r14d, word [rax + 2]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
movzx r8d, r14w
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r15 + 0x18], rax
mov rsi, qword [rdi + 0x18]
test rsi, rsi
je 0x17005594d
mov rbx, rax
mov rcx, rsi
call sym.ntdll.dll_RtlValidAcl
test al, al
je 0x17005594d
movzx r8d, word [rsi + 2]
cmp r8w, r14w
ja 0x17005594d
mov rcx, rbx
mov rdx, rsi
call sym.ntdll.dll_memmove
xor ebx, ebx
test byte [rdi + 2], 4
je 0x170055b81
mov rax, qword [rdi + 0x20]
movzx r14d, word [rax + 2]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
movzx r8d, r14w
xor ebx, ebx
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r15 + 0x20], rax
mov rdi, qword [rdi + 0x20]
test rdi, rdi
je 0x170055b81
mov rsi, rax
mov rcx, rdi
call sym.ntdll.dll_RtlValidAcl
test al, al
je 0x170055b81
movzx r8d, word [rdi + 2]
cmp r8w, r14w
ja 0x170055b81
mov rcx, rsi
mov rdx, rdi
jmp 0x170055b7c
mov ebx, 0xc0000058
cmp byte [rdi], 1
jne 0x170055b81
mov eax, dword [rdi + 0x10]
mov dword [r15 + 0x10], eax
movups xmm0, xmmword [rdi]
movups xmmword [r15], xmm0
mov ebx, dword [rdi + 4]
test rbx, rbx
je 0x170055a6c
add rbx, rdi
test byte [0x17008d960], 8
je 0x170055a0f
mov qword [rsp + 0x20], rbx
lea r8, [0x170078c30]
lea r9, str.sid_p_n
mov ecx, 3
call fcn.1700552c0
movzx esi, byte [rbx + 1]
mov r14d, dword [r15 + 4]
mov rcx, rbx
call sym.ntdll.dll_RtlValidSid
test al, al
je 0x170055a6c
shl esi, 2
test byte [0x17008d960], 8
je 0x170055a4c
mov qword [rsp + 0x20], rbx
lea r8, [0x170078c30]
lea r9, str.sid_p_n
mov ecx, 3
call fcn.1700552c0
movzx r8d, byte [rbx + 1]
shl r8, 2
cmp r8d, esi
ja 0x170055a6c
add r14, r15
add r8, 8
mov rcx, r14
mov rdx, rbx
call sym.ntdll.dll_memmove
mov ebx, dword [rdi + 8]
test rbx, rbx
je 0x170055afe
add rbx, rdi
test byte [0x17008d960], 8
je 0x170055aa1
mov qword [rsp + 0x20], rbx
lea r8, [0x170078c30]
lea r9, str.sid_p_n
mov ecx, 3
call fcn.1700552c0
movzx esi, byte [rbx + 1]
mov r14d, dword [r15 + 8]
mov rcx, rbx
call sym.ntdll.dll_RtlValidSid
test al, al
je 0x170055afe
shl esi, 2
test byte [0x17008d960], 8
je 0x170055ade
mov qword [rsp + 0x20], rbx
lea r8, [0x170078c30]
lea r9, str.sid_p_n
mov ecx, 3
call fcn.1700552c0
movzx r8d, byte [rbx + 1]
shl r8, 2
cmp r8d, esi
ja 0x170055afe
add r14, r15
add r8, 8
mov rcx, r14
mov rdx, rbx
call sym.ntdll.dll_memmove
test byte [rdi + 2], 0x10
je 0x170055b3f
mov eax, dword [rdi + 0xc]
test rax, rax
je 0x170055b3f
lea rbx, [rdi + rax]
movzx r14d, word [rdi + rax + 2]
mov esi, dword [r15 + 0xc]
mov rcx, rbx
call sym.ntdll.dll_RtlValidAcl
test al, al
je 0x170055b3f
movzx r8d, word [rbx + 2]
cmp r8w, r14w
ja 0x170055b3f
add rsi, r15
mov rcx, rsi
mov rdx, rbx
call sym.ntdll.dll_memmove
xor ebx, ebx
test byte [rdi + 2], 4
je 0x170055b81
mov eax, dword [rdi + 0x10]
test rax, rax
je 0x170055b81
lea rsi, [rdi + rax]
movzx edi, word [rdi + rax + 2]
mov r14d, dword [r15 + 0x10]
mov rcx, rsi
call sym.ntdll.dll_RtlValidAcl
test al, al
je 0x170055b81
movzx r8d, word [rsi + 2]
cmp r8w, di
ja 0x170055b81
add r15, r14
mov rcx, r15
mov rdx, rsi
call sym.ntdll.dll_memmove
mov eax, ebx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret