Function at 0x14000aeb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a8]
sub rsp, 0x4a8
mov qword [rbp + 0x240], 0xfffffffffffffffe
mov r14, rcx
lea r13, str.base_stor_vssmodules_sec_security.cxx
mov qword [rbp + 0x10], r13
lea rax, str.CVssSidCollection::Initialize
mov qword [rbp + 0x18], rax
lea rsi, str.SECSECRC
mov qword [rbp + 0x20], rsi
mov dword [rbp + 0x28], 0x61f
mov dword [rbp + 0x2c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp + 0x30], 0xff
xor r12d, r12d
mov dword [rbp + 0xb0], 0x1000000
xor edx, edx
lea r8d, [r12 + 0x78]
lea rcx, [rbp + 0x38]
call sub.msvcrt.dll_memset
mov dword [rbp + 0x198], r12d
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x1a8], rax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x1b0], eax
mov eax, dword [rbp + 0x2c]
mov dword [rbp + 0x1b4], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov dword [rbp + 0x1c4], eax
mov dword [rbp + 0x194], 0xffffffff
mov eax, dword [rbp + 0x30]
mov dword [rbp + 0x1c8], eax
mov dword [rbp + 0x190], r12d
mov qword [rbp + 0x1f0], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1e0], xmm1
mov qword [rbp + 0x3f0], r12
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.VssTrace.DLL_Ordinal_10]
nop dword [rax + rax]
test eax, eax
js 0x1400207f4
lea rcx, [rbp + 0x190]
call qword [sym.imp.VssTrace.DLL_Ordinal_9]
nop dword [rax + rax]
test eax, eax
js 0x1400207f4
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x1f0], rax
test rax, rax
je 0x140020800
mov eax, dword [rax + 0x30]
inc eax
mov dword [rbp + 0x1c0], eax
mov ebx, RegisterTypeLib
cmp dword [rbp + 0x1c8], 0xff
cmovne ebx, dword [rbp + 0x1c8]
mov edi, dword [rbp + 0x1b4]
call qword [sym.imp.VssTrace.DLL_Ordinal_5]
nop dword [rax + rax]
lea r15, str.ENTER
test eax, eax
jne 0x14002080c
mov r15d, 0xf
cmp byte [rbp + 0xb3], r12b
je 0x14000b076
lea rbx, [rbp + 0x38]
mov edi, r15d
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14002088d
add rbx, 8
sub rdi, 1
jne 0x14000b060
cmp byte [r14], 0
jne 0x1400208a1
mov rcx, qword [r14 + 8]
test rcx, rcx
jne 0x1400208b3
mov rcx, qword [r14 + 0x10]
test rcx, rcx
jne 0x1400208c1
mov rcx, qword [r14 + 0x18]
test rcx, rcx
jne 0x1400208cf
mov rcx, qword [r14 + 0x20]
test rcx, rcx
jne 0x1400208dd
lea rdx, [0x1400fb65a]
mov ecx, 0x28
call fcn.140016988
mov qword [r14 + 8], rax
test rax, rax
je 0x1400208eb
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
je 0x140020955
mov ebx, r12d
mov dword [rbp + 0x198], ebx
test ebx, ebx
js 0x1400208f6
mov rcx, qword [r14 + 0x28]
test rcx, rcx
jne 0x140020982
mov rcx, qword [r14 + 0x30]
test rcx, rcx
jne 0x140020990
mov rcx, qword [r14 + 0x38]
test rcx, rcx
jne 0x14002099e
mov rcx, qword [r14 + 0x40]
test rcx, rcx
jne 0x1400209ac
lea rdx, [0x1400fb65a]
mov ecx, 0x28
call fcn.140016988
mov qword [r14 + 0x28], rax
test rax, rax
je 0x1400209ba
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
je 0x140020a24
mov ebx, r12d
mov dword [rbp + 0x198], ebx
test ebx, ebx
js 0x1400209c5
mov rcx, qword [r14 + 0x48]
test rcx, rcx
jne 0x140020a51
mov rcx, qword [r14 + 0x50]
test rcx, rcx
jne 0x140020a5f
mov rcx, qword [r14 + 0x58]
test rcx, rcx
jne 0x140020a6d
mov rcx, qword [r14 + 0x60]
test rcx, rcx
jne 0x140020a7b
lea rdx, [0x1400fb65a]
mov ecx, 0x28
call fcn.140016988
mov qword [r14 + 0x48], rax
test rax, rax
je 0x140020a89
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
je 0x140020af3
mov ebx, r12d
mov dword [rbp + 0x198], ebx
test ebx, ebx
js 0x140020a94
mov qword [rbp + 0x218], r12
lea rax, [0x1400f6248]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0xc0], r13
lea rsi, str.CAutoSid::CreateBasicSid
mov qword [rbp + 0xc8], rsi
lea rax, str.SECSECRC
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x36d
mov dword [rbp + 0xdc], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp + 0xe0], 0xff
mov dword [rbp + 0x160], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0xe8]
call sub.msvcrt.dll_memset
mov dword [rbp + 0x18], r12d
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0xd8]
mov dword [rbp + 0x30], eax
mov eax, dword [rbp + 0xdc]
mov dword [rbp + 0x34], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x14], 0xffffffff
mov eax, dword [rbp + 0xe0]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x10], r12d
mov qword [rbp + 0x70], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
mov qword [rbp + 0x3f8], r12
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.VssTrace.DLL_Ordinal_10]
nop dword [rax + rax]
test eax, eax
js 0x140020b20
lea rcx, [rbp + 0x10]
call qword [sym.imp.VssTrace.DLL_Ordinal_9]
nop dword [rax + rax]
test eax, eax
js 0x140020b20
mov rax, qword [rbp + 0x3f8]
mov qword [rbp + 0x70], rax
test rax, rax
je 0x140020b29
mov eax, dword [rax + 0x30]
inc eax
mov dword [rbp + 0x40], eax
mov ebx, dword [rbp + 0x48]
cmp ebx, 0xff
jne 0x14000b343
mov ebx, RegisterTypeLib
mov edi, dword [rbp + 0x34]
call qword [sym.imp.VssTrace.DLL_Ordinal_5]
nop dword [rax + rax]
test eax, eax
jne 0x140020b32
cmp byte [rbp + 0x163], 0
je 0x14000b386
lea rbx, [rbp + 0xe8]
mov rdi, r15
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140020ba2
add rbx, 8
sub rdi, 1
jne 0x14000b370
mov dword [rbp + 0x3f0], r12d
lea r9, [rbp + 0x3f0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x16]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x140020bb6
lea rbx, str.SECSECRC
lea r13, [0x1400f6248]
mov qword [rbp + 0x200], r13
mov edx, dword [rbp + 0x3f0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
mov qword [rbp + 0x208], rax
test rax, rax
je 0x140020c23
lea r9, [rbp + 0x3f0]
mov r8, rax
xor edx, edx
lea ecx, [rdx + 0x16]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
nop dword [rax + rax]
test eax, eax
je 0x140020c42
lea rdi, str.CAutoSid::CreateBasicSid
mov qword [rbp + 0x218], rsi
lea rcx, [rbp + 0x10]
call fcn.140009990
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorOwner]
nop dword [rax + rax]
test eax, eax
je 0x140020cc2
mov rcx, qword [r14 + 0x10]
test rcx, rcx
jne 0x140020ce6
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov ebx, eax
mov ecx, eax
lea rdx, [0x1400fb65a]
call fcn.1400169cc
mov qword [r14 + 0x10], rax
test rax, rax
je 0x140020cf4
mov r8, rsi
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x140020d6c
xor r8d, r8d
mov rdx, qword [r14 + 0x10]
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorOwner]
nop dword [rax + rax]
test eax, eax
je 0x140020d99
mov ebx, r12d
mov dword [rbp + 0x198], ebx
test ebx, ebx
js 0x140020cff
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorOwner]
nop dword [rax + rax]
test eax, eax
je 0x140020dad
mov rcx, qword [r14 + 0x30]
test rcx, rcx
jne 0x140020dd1
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov ebx, eax
mov ecx, eax
lea rdx, [0x1400fb65a]
call fcn.1400169cc
mov qword [r14 + 0x30], rax
test rax, rax
je 0x140020ddf
mov r8, rsi
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x140020e57
xor r8d, r8d
mov rdx, qword [r14 + 0x30]
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorOwner]
nop dword [rax + rax]
test eax, eax
je 0x140020e84
mov ebx, r12d
mov dword [rbp + 0x198], ebx
test ebx, ebx
js 0x140020dea
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14 + 0x48]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorOwner]
nop dword [rax + rax]
test eax, eax
je 0x140020e98
mov rcx, qword [r14 + 0x50]
test rcx, rcx
jne 0x140020ebc
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov ebx, eax
mov ecx, eax
lea rdx, [0x1400fb65a]
call fcn.1400169cc
mov qword [r14 + 0x50], rax
test rax, rax
je 0x140020eca
mov r8, rsi
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x140020f42
xor r8d, r8d
mov rdx, qword [r14 + 0x50]
mov rcx, qword [r14 + 0x48]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorOwner]
nop dword [rax + rax]
test eax, eax
je 0x140020f6f
mov ebx, r12d
mov dword [rbp + 0x198], ebx
test ebx, ebx
js 0x140020ed5
mov qword [rbp + 0x228], r12
lea rax, [0x1400f6248]
mov qword [rbp + 0x220], rax
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdi
lea rax, str.SECSECRC
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0x36d
mov dword [rbp + 0x2c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp + 0x30], 0xff
mov dword [rbp + 0xb0], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0x38]
call sub.msvcrt.dll_memset
mov dword [rbp + 0xc8], r12d
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0xd8], rax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0xe0], eax
mov eax, dword [rbp + 0x2c]
mov dword [rbp + 0xe4], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov dword [rbp + 0xf4], eax
mov dword [rbp + 0xc4], 0xffffffff
mov eax, dword [rbp + 0x30]
mov dword [rbp + 0xf8], eax
mov dword [rbp + 0xc0], r12d
mov qword [rbp + 0x120], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x110], xmm1
mov qword [rbp + 0x3f8], r12
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.VssTrace.DLL_Ordinal_10]
nop dword [rax + rax]
test eax, eax
js 0x140020f83
lea rcx, [rbp + 0xc0]
call qword [sym.imp.VssTrace.DLL_Ordinal_9]
nop dword [rax + rax]
test eax, eax
js 0x140020f83
mov rax, qword [rbp + 0x3f8]
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140020f8f
mov eax, dword [rax + 0x30]
inc eax
mov dword [rbp + 0xf0], eax
mov ebx, dword [rbp + 0xf8]
cmp ebx, 0xff
jne 0x14000b76b
mov ebx, RegisterTypeLib
mov edi, dword [rbp + 0xe4]
call qword [sym.imp.VssTrace.DLL_Ordinal_5]
nop dword [rax + rax]
test eax, eax
jne 0x140020f9b
cmp byte [rbp + 0xb3], 0
je 0x14000b7b6
lea rbx, [rbp + 0x38]
mov rdi, r15
nop word [rax + rax]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140021023
add rbx, 8
sub rdi, 1
jne 0x14000b7a0
mov dword [rbp + 0x3f0], r12d
lea r9, [rbp + 0x3f0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x1a]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x140021037
lea rbx, str.CAutoSid::CreateBasicSid
lea rdi, str.base_stor_vssmodules_sec_security.cxx
mov qword [rbp + 0x230], r13
mov edx, dword [rbp + 0x3f0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r13, rax
mov qword [rbp + 0x238], rax
test rax, rax
je 0x1400210b8
lea r9, [rbp + 0x3f0]
mov r8, rax
xor edx, edx
lea ecx, [rdx + 0x1a]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
nop dword [rax + rax]
test eax, eax
je 0x1400210d7
mov qword [rbp + 0x228], r13
mov rbx, r12
mov rcx, qword [rbp + rbx*8 + 0x100]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp + rbx*8 + 0x100], r12
inc rbx
cmp rbx, 4
jl 0x14000b856
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov r8d, eax
sub r8d, dword [rbp + 0xf4]
mov eax, 0x10624dd3
mul r8d
mov r9d, edx
shr r9d, 6
imul ecx, r9d, 0x3e8
mov r11d, r8d
sub r11d, ecx
mov eax, 0x88888889
mul r9d
shr edx, 5
imul eax, edx, 0x3c
sub r9d, eax
mov eax, 0x45e7b273
mul r8d
mov ecx, edx
shr ecx, 0xe
mov eax, 0x88888889
mul ecx
shr edx, 5
imul eax, edx, 0x3c
sub ecx, eax
mov eax, 0x95217cb1
mul r8d
mov r10d, edx
shr r10d, 0x15
mov eax, 0x88888889
mul r10d
shr edx, 5
imul eax, edx, 0x3c
sub r10d, eax
mov edx, dword [rbp + 0xf8]
cmp edx, 0xff
jne 0x14000b90d
mov edx, RegisterTypeLib
mov eax, dword [rbp + 0xc8]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r10d
lea r9, str.Time_spent:__02ld:_02ld:_02ld__04ld__total:__x__HRESULT:__x
mov r8d, edx
lea rdx, str.EXIT
lea rcx, [rbp + 0xc0]
call fcn.14000a350
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.VssTrace.DLL_Ordinal_9]
nop dword [rax + rax]
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorGroup]
nop dword [rax + rax]
test eax, eax
je 0x140021156
mov rcx, qword [r14 + 0x18]
test rcx, rcx
jne 0x14002117a
mov rcx, r13
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov ebx, eax
mov ecx, eax
lea rdx, [0x1400fb65a]
call fcn.1400169cc
mov qword [r14 + 0x18], rax
test rax, rax
je 0x140021188
mov r8, r13
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x1400211f9
xor r8d, r8d
mov rdx, qword [r14 + 0x18]
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorGroup]
nop dword [rax + rax]
test eax, eax
je 0x140021226
mov ebx, r12d
mov dword [rbp + 0x198], ebx
test ebx, ebx
js 0x140021193
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorGroup]
nop dword [rax + rax]
test eax, eax
je 0x14002123a
mov rcx, qword [r14 + 0x38]
test rcx, rcx
jne 0x14002125e
mov rcx, r13
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov ebx, eax
mov ecx, eax
lea rdx, [0x1400fb65a]
call fcn.1400169cc
mov qword [r14 + 0x38], rax
test rax, rax
je 0x14002126c
mov r8, r13
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x1400212dd
xor r8d, r8d
mov rdx, qword [r14 + 0x38]
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorGroup]
nop dword [rax + rax]
test eax, eax
je 0x14002130a
mov ebx, r12d
mov dword [rbp + 0x198], ebx
test ebx, ebx
js 0x140021277
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14 + 0x48]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorGroup]
nop dword [rax + rax]
test eax, eax
je 0x14002131e
mov rcx, qword [r14 + 0x58]
test rcx, rcx
jne 0x140021342
mov rcx, r13
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov ebx, eax
mov ecx, eax
lea rdx, [0x1400fb65a]
call fcn.1400169cc
mov qword [r14 + 0x58], rax
test rax, rax
je 0x140021350
mov r8, r13
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
nop dword [rax + rax]
test eax, eax
je 0x1400213c1
xor r8d, r8d
mov rdx, qword [r14 + 0x58]
mov rcx, qword [r14 + 0x48]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorGroup]
nop dword [rax + rax]
test eax, eax
je 0x1400213ee
mov ebx, r12d
mov dword [rbp + 0x198], ebx
test ebx, ebx
js 0x14002135b
mov qword [rbp + 0x10], rdi
lea rax, str.CVssSidCollection::AddWellKnownSid
mov qword [rbp + 0x18], rax
lea rax, str.SECSECRC
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0x542
mov dword [rbp + 0x2c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp + 0x30], 0xff
mov dword [rbp + 0xb0], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0x38]
call sub.msvcrt.dll_memset
mov dword [rbp + 0xc8], r12d
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0xd8], rax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0xe0], eax
mov eax, dword [rbp + 0x2c]
mov dword [rbp + 0xe4], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov dword [rbp + 0xf4], eax
mov dword [rbp + 0xc4], 0xffffffff
mov eax, dword [rbp + 0x30]
mov dword [rbp + 0xf8], eax
mov dword [rbp + 0xc0], r12d
mov qword [rbp + 0x120], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x110], xmm1
mov qword [rbp + 0x3f8], r12
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.VssTrace.DLL_Ordinal_10]
nop dword [rax + rax]
test eax, eax
js 0x140021402
lea rcx, [rbp + 0xc0]
call qword [sym.imp.VssTrace.DLL_Ordinal_9]
nop dword [rax + rax]
test eax, eax
js 0x140021402
mov rax, qword [rbp + 0x3f8]
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14002140e
mov eax, dword [rax + 0x30]
inc eax
mov dword [rbp + 0xf0], eax
mov ebx, dword [rbp + 0xf8]
cmp ebx, 0xff
jne 0x14000bc82
mov ebx, RegisterTypeLib
mov edi, dword [rbp + 0xe4]
call qword [sym.imp.VssTrace.DLL_Ordinal_5]
nop dword [rax + rax]
test eax, eax
jne 0x14002141a
cmp byte [rbp + 0xb3], 0
je 0x14000bcc6
lea rbx, [rbp + 0x38]
mov rdi, r15
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400214a2
add rbx, 8
sub rdi, 1
jne 0x14000bcb0
mov qword [rbp + 0x178], r12
lea rax, [0x1400f6248]
mov qword [rbp + 0x170], rax
mov dword [rbp + 0x3f0], r12d
lea r9, [rbp + 0x3f0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x1a]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
nop dword [rax + rax]
test eax, eax
jne 0x1400214b6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x140021520
mov edx, dword [rbp + 0x3f0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp + 0x178], rax
test rax, rax
je 0x14002158a
lea r9, [rbp + 0x3f0]
mov r8, rax
xor edx, edx
lea ecx, [rdx + 0x1a]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
nop dword [rax + rax]
test eax, eax
je 0x1400215a9
mov r8d, 3
mov rdx, rbx
mov rcx, r14
call fcn.14000f090
mov rax, rbx
lea rdi, str.CVssSidCollection::AddWellKnownSid
cmp qword [r14 + 0x68], 0
jne 0x14000bdf5
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x55e
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.Set_m_pSidAdmin
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.140009fb0
mov rax, rbx
mov rbx, r12
mov qword [r14 + 0x68], rax
mov rax, r12
test rax, rax
jne 0x14002161a
mov rbx, r12
mov rcx, qword [rbp + rbx*8 + 0x100]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp + rbx*8 + 0x100], r12
inc rbx
cmp rbx, 4
jl 0x14000be01
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov r8d, eax
sub r8d, dword [rbp + 0xf4]
mov eax, 0x10624dd3
mul r8d
mov r9d, edx
shr r9d, 6
imul ecx, r9d, 0x3e8
mov r11d, r8d
sub r11d, ecx
mov eax, 0x88888889
mul r9d
shr edx, 5
imul eax, edx, 0x3c
sub r9d, eax
mov eax, 0x45e7b273
mul r8d
mov ecx, edx
shr ecx, 0xe
mov eax, 0x88888889
mul ecx
shr edx, 5
imul eax, edx, 0x3c
sub ecx, eax
mov eax, 0x95217cb1
mul r8d
mov r10d, edx
shr r10d, 0x15
mov eax, 0x88888889
mul r10d
shr edx, 5
imul eax, edx, 0x3c
sub r10d, eax
mov edx, dword [rbp + 0xf8]
cmp edx, 0xff
jne 0x14000beb8
mov edx, RegisterTypeLib
mov eax, dword [rbp + 0xc8]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r10d
lea r9, str.Time_spent:__02ld:_02ld:_02ld__04ld__total:__x__HRESULT:__x
mov r8d, edx
lea rdx, str.EXIT
lea rcx, [rbp + 0xc0]
call fcn.14000a350
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.VssTrace.DLL_Ordinal_9]
nop dword [rax + rax]
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdi
lea rax, str.SECSECRC
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0x542
mov dword [rbp + 0x2c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp + 0x30], 0xff
mov dword [rbp + 0xb0], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp + 0x38]
call sub.msvcrt.dll_memset
mov dword [rbp + 0xc8], r12d
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0xd8], rax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0xe0], eax
mov eax, dword [rbp + 0x2c]
mov dword [rbp + 0xe4], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov dword [rbp + 0xf4], eax
mov dword [rbp + 0xc4], 0xffffffff
mov eax, dword [rbp + 0x30]
mov dword [rbp + 0xf8], eax
mov dword [rbp + 0xc0], r12d
mov qword [rbp + 0x120], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x110], xmm1
mov qword [rbp + 0x3f8], r12
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.VssTrace.DLL_Ordinal_10]
nop dword [rax + rax]
test eax, eax
js 0x14002162f
lea rcx, [rbp + 0xc0]
call qword [sym.imp.VssTrace.DLL_Ordinal_9]
nop dword [rax + rax]
test eax, eax
js 0x14002162f
mov rax, qword [rbp + 0x3f8]
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14002163b
mov eax, dword [rax + 0x30]
inc eax
mov dword [rbp + 0xf0], eax
mov ebx, dword [rbp + 0xf8]
cmp ebx, 0xff
jne 0x14000c047
mov ebx, RegisterTypeLib
mov edi, dword [rbp + 0xe4]
call qword [sym.imp.VssTrace.DLL_Ordinal_5]
nop dword [rax + rax]
test eax, eax
jne 0x140021647
cmp byte [rbp + 0xb3], 0
je 0x14000c087
lea rbx, [rbp + 0x38]
mov rdi, r15
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400216cf
add rbx, 8
sub rdi, 1
jne 0x14000c071
mov qword [rbp + 0x178], r12
lea rax, [0x1400f6248]
mov qword [rbp + 0x170], rax
mov dword [rbp + 0x3f0], r12d
lea r9, [rbp + 0x3f0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x16]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
nop dword [rax + rax]
test eax, eax
jne 0x1400216e3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x14002174d
mov edx, dword [rbp + 0x3f0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp + 0x178], rax
test rax, rax
je 0x1400217b7
lea r9, [rbp + 0x3f0]
mov r8, rax
xor edx, edx
lea ecx, [rdx + 0x16]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
nop dword [rax + rax]
test eax, eax
je 0x1400217d6
mov r8d, 3
mov rdx, rbx
mov rcx, r14
call fcn.14000f090
mov rax, rbx
lea rdi, str.CVssSidCollection::AddWellKnownSid
cmp qword [r14 + 0x68], 0
je 0x140021847
test rax, rax
je 0x14000c160
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
nop
mov rbx, r12
mov rcx, qword [rbp + rbx*8 + 0x100]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp + rbx*8 + 0x100], r12
inc rbx
cmp rbx, 4
jl 0x14000c163
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov r8d, eax
sub r8d, dword [rbp + 0xf4]
mov eax, 0x10624dd3
mul r8d
mov r9d, edx
shr r9d, 6
imul ecx, r9d, 0x3e8
mov r11d, r8d
sub r11d, ecx
mov eax, 0x88888889
mul r9d
shr edx, 5
imul eax, edx, 0x3c
sub r9d, eax
mov eax, 0x45e7b273
mul r8d
mov ecx, edx
shr ecx, 0xe
mov eax, 0x88888889
mul ecx
shr edx, 5
imul eax, edx, 0x3c
sub ecx, eax
mov eax, 0x95217cb1
mul r8d
mov r10d, edx
shr r10d, 0x15
mov eax, 0x88888889
mul r10d
shr edx, 5
imul eax, edx, 0x3c
sub r10d, eax
mov edx, dword [rbp + 0xf8]
cmp edx, 0xff
jne 0x14000c21a
add rsp, 0x4a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rbp + 0x1f0]
jmp 0x14000affb
mov dword [rbp + 0x1c0], r12d
jmp 0x14000b00f
mov ecx, edi
call qword [sym.imp.VssTrace.DLL_Ordinal_7]
nop dword [rax + rax]
test eax, eax
je 0x14000b046
lea rcx, [rbp + 0x190]
call fcn.1400c3fe4
cmp dword [rbp + 0x190], r12d
je 0x14000b046
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], r15
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x1b4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x1c0]
mov r8d, dword [rbp + 0x1b0]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.VssTrace.DLL_Ordinal_3]
nop dword [rax + rax]
nop
jmp 0x14000b046
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbx], r12
jmp 0x14000b06c
lea rcx, [rbp + 0x190]
call fcn.140009990
nop
jmp 0x14000d623
call fcn.140015ff8
mov qword [r14 + 8], r12
jmp 0x14000b08d
call fcn.140015ff8
mov qword [r14 + 0x10], r12
jmp 0x14000b09a
call fcn.140015ff8
mov qword [r14 + 0x18], r12
jmp 0x14000b0a7
call fcn.140015ff8
mov qword [r14 + 0x20], r12
jmp 0x14000b0b4
mov ebx, 0x8007000e
mov dword [rbp + 0x198], ebx
mov qword [rsp + 0x60], r13
lea rax, str.CVssSidCollection::Initialize
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], 0x62d
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r9, str.m_SDWriters.Initialize___failed
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x190]
call fcn.1400c2090
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140020970
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [r14 + 8]
call fcn.140015ff8
mov qword [r14 + 8], r12
jmp 0x14000b0f1
call fcn.140015ff8
mov qword [r14 + 0x28], r12
jmp 0x14000b10c
call fcn.140015ff8
mov qword [r14 + 0x30], r12
jmp 0x14000b119
call fcn.140015ff8
mov qword [r14 + 0x38], r12
jmp 0x14000b126
call fcn.140015ff8
mov qword [r14 + 0x40], r12
jmp 0x14000b133
mov ebx, 0x8007000e
mov dword [rbp + 0x198], ebx
mov qword [rsp + 0x60], r13
lea rax, str.CVssSidCollection::Initialize
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], 0x635
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r9, str.m_SDRequestors.Initialize___failed
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x190]
call fcn.1400c2090
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140020a3f
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [r14 + 0x28]
call fcn.140015ff8
mov qword [r14 + 0x28], r12
jmp 0x14000b170
call fcn.140015ff8
mov qword [r14 + 0x48], r12
jmp 0x14000b18b
call fcn.140015ff8
mov qword [r14 + 0x50], r12
jmp 0x14000b198
call fcn.140015ff8
mov qword [r14 + 0x58], r12
jmp 0x14000b1a5
call fcn.140015ff8
mov qword [r14 + 0x60], r12
jmp 0x14000b1b2
mov ebx, 0x8007000e
mov dword [rbp + 0x198], ebx
mov qword [rsp + 0x60], r13
lea rax, str.CVssSidCollection::Initialize
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], 0x63d
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r9, str.m_SDBoth.Initialize___failed
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x190]
call fcn.1400c2090
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140020b0e
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [r14 + 0x48]
call fcn.140015ff8
mov qword [r14 + 0x48], r12
jmp 0x14000b1ef
mov rax, qword [rbp + 0x70]
jmp 0x14000b322
mov dword [rbp + 0x40], r12d
jmp 0x14000b333
mov ecx, edi
call qword [sym.imp.VssTrace.DLL_Ordinal_7]
nop dword [rax + rax]
test eax, eax
je 0x14000b35a
lea rcx, [rbp + 0x10]
call fcn.1400c3fe4
cmp dword [rbp + 0x10], 0
je 0x14000b35a
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
lea rax, str.ENTER
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x34]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x40]
mov r8d, dword [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.VssTrace.DLL_Ordinal_3]
nop dword [rax + rax]
nop
jmp 0x14000b35a
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbx], r12
jmp 0x14000b37c
test eax, eax
jle 0x140020bc2
movzx eax, ax
or eax, 0x80070000
mov dword [rbp + 0x18], eax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rsi
lea rbx, str.SECSECRC
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], 0x37a
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.CreateWellKnownSidType
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140027ed8
nop
jmp 0x14000b3c4
mov ebx, 0x8007000e
mov dword [rbp + 0x3f8], ebx
lea rdx, [0x140159b90]
lea rcx, [rbp + 0x3f8]
call sub.msvcrt.dll__CxxThrowException
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140020c5a
movzx eax, ax
or eax, 0x80070000
mov dword [rbp + 0x18], eax
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea rdi, str.CAutoSid::CreateBasicSid
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], 0x383
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.CreateWellKnownSidType
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140027ed8
nop
jmp 0x14000b423
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000b4c7
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000b4c7
call fcn.140015ff8
mov qword [r14 + 0x10], r12
jmp 0x14000b45d
mov ebx, 0x8007000e
mov dword [rbp + 0x198], ebx
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea rax, str.CVssSidCollection::Initialize
mov qword [rsp + 0x68], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x64b
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r9, str.SetOwner
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x190]
call fcn.1400c2a9c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140020d87
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [r14 + 0x10]
call fcn.140015ff8
mov qword [r14 + 0x10], r12
jmp 0x14000b4c7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140020d87
jmp 0x140020d7e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000b569
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000b569
call fcn.140015ff8
mov qword [r14 + 0x30], r12
jmp 0x14000b4ff
mov ebx, 0x8007000e
mov dword [rbp + 0x198], ebx
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea rax, str.CVssSidCollection::Initialize
mov qword [rsp + 0x68], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x64e
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r9, str.SetOwner
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x190]
call fcn.1400c2a9c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140020e72
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [r14 + 0x30]
call fcn.140015ff8
mov qword [r14 + 0x30], r12
jmp 0x14000b569
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140020e72
jmp 0x140020e69
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000b60b
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000b60b
call fcn.140015ff8
mov qword [r14 + 0x50], r12
jmp 0x14000b5a1
mov ebx, 0x8007000e
mov dword [rbp + 0x198], ebx
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea rax, str.CVssSidCollection::Initialize
mov qword [rsp + 0x68], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x651
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r9, str.SetOwner
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x190]
call fcn.1400c2a9c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140020f5d
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [r14 + 0x50]
call fcn.140015ff8
mov qword [r14 + 0x50], r12
jmp 0x14000b60b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140020f5d
jmp 0x140020f54
mov rax, qword [rbp + 0x120]
jmp 0x14000b744
mov dword [rbp + 0xf0], r12d
jmp 0x14000b758
mov ecx, edi
call qword [sym.imp.VssTrace.DLL_Ordinal_7]
nop dword [rax + rax]
test eax, eax
je 0x14000b785
lea rcx, [rbp + 0xc0]
call fcn.1400c3fe4
cmp dword [rbp + 0xc0], 0
je 0x14000b785
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
lea rax, str.ENTER
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0xe8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0xf0]
mov r8d, dword [rbp + 0xe0]
mov rdx, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.VssTrace.DLL_Ordinal_3]
nop dword [rax + rax]
nop
jmp 0x14000b785
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbx], r12
jmp 0x14000b7ac
test eax, eax
jle 0x140021043
movzx eax, ax
or eax, 0x80070000
mov dword [rbp + 0xc8], eax
lea rdi, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rdi
lea rbx, str.CAutoSid::CreateBasicSid
mov qword [rsp + 0x68], rbx
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x37a
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.CreateWellKnownSidType
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.140027ed8
nop
jmp 0x14000b7fb
mov ebx, 0x8007000e
mov dword [rbp + 0x3f8], ebx
lea rdx, [0x140159b90]
lea rcx, [rbp + 0x3f8]
call sub.msvcrt.dll__CxxThrowException
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1400210ef
movzx eax, ax
or eax, 0x80070000
mov dword [rbp + 0xc8], eax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x383
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.CreateWellKnownSidType
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.140027ed8
nop
jmp 0x14000b84c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000b9f3
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000b9f3
call fcn.140015ff8
mov qword [r14 + 0x18], r12
jmp 0x14000b989
mov ebx, 0x8007000e
mov dword [rbp + 0x198], ebx
mov qword [rsp + 0x60], rdi
lea rax, str.CVssSidCollection::Initialize
mov qword [rsp + 0x68], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x65c
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r9, str.SetGroup
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x190]
call fcn.1400c2a9c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140021214
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [r14 + 0x18]
call fcn.140015ff8
mov qword [r14 + 0x18], r12
jmp 0x14000b9f3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140021214
jmp 0x14002120b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000ba95
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000ba95
call fcn.140015ff8
mov qword [r14 + 0x38], r12
jmp 0x14000ba2b
mov ebx, 0x8007000e
mov dword [rbp + 0x198], ebx
mov qword [rsp + 0x60], rdi
lea rax, str.CVssSidCollection::Initialize
mov qword [rsp + 0x68], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x65f
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r9, str.SetGroup
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x190]
call fcn.1400c2a9c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400212f8
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [r14 + 0x38]
call fcn.140015ff8
mov qword [r14 + 0x38], r12
jmp 0x14000ba95
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400212f8
jmp 0x1400212ef
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000bb37
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000bb37
call fcn.140015ff8
mov qword [r14 + 0x58], r12
jmp 0x14000bacd
mov ebx, 0x8007000e
mov dword [rbp + 0x198], ebx
mov qword [rsp + 0x60], rdi
lea rax, str.CVssSidCollection::Initialize
mov qword [rsp + 0x68], rax
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x662
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r9, str.SetGroup
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x190]
call fcn.1400c2a9c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400213dc
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [r14 + 0x58]
call fcn.140015ff8
mov qword [r14 + 0x58], r12
jmp 0x14000bb37
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400213dc
jmp 0x1400213d3
mov rax, qword [rbp + 0x120]
jmp 0x14000bc5b
mov dword [rbp + 0xf0], r12d
jmp 0x14000bc6f
mov ecx, edi
call qword [sym.imp.VssTrace.DLL_Ordinal_7]
nop dword [rax + rax]
test eax, eax
je 0x14000bc9c
lea rcx, [rbp + 0xc0]
call fcn.1400c3fe4
cmp dword [rbp + 0xc0], 0
je 0x14000bc9c
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
lea rax, str.ENTER
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0xe8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0xf0]
mov r8d, dword [rbp + 0xe0]
mov rdx, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.VssTrace.DLL_Ordinal_3]
nop dword [rax + rax]
nop
jmp 0x14000bc9c
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbx], r12
jmp 0x14000bcbc
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea r9, str.CVssSidCollection::AddWellKnownSid
mov qword [rsp + 0x68], r9
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x54c
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.CreateWellKnownSid_type__NULL__NULL__dwSid_
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.1400c3b7c
int3
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea r9, str.CVssSidCollection::AddWellKnownSid
mov qword [rsp + 0x68], r9
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x54f
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.CreateWellKnownSid_type__NULL__NULL__dwSid_
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.1400c3b7c
int3
mov ebx, 0x8007000e
mov dword [rbp + 0x3f8], ebx
lea rdx, [0x140159b90]
lea rcx, [rbp + 0x3f8]
call sub.msvcrt.dll__CxxThrowException
int3
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea r9, str.CVssSidCollection::AddWellKnownSid
mov qword [rsp + 0x68], r9
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x558
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
mov r9d, dword [rbp + 0x3f0]
lea r8, str.CreateWellKnownSid_type__NULL__pSid____ld__
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.1400c3b7c
nop
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
nop
jmp 0x14000bdfe
mov rax, qword [rbp + 0x120]
jmp 0x14000c020
mov dword [rbp + 0xf0], r12d
jmp 0x14000c034
mov ecx, edi
call qword [sym.imp.VssTrace.DLL_Ordinal_7]
nop dword [rax + rax]
test eax, eax
je 0x14000c061
lea rcx, [rbp + 0xc0]
call fcn.1400c3fe4
cmp dword [rbp + 0xc0], 0
je 0x14000c061
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
lea rax, str.ENTER
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0xe8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0xe4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0xf0]
mov r8d, dword [rbp + 0xe0]
mov rdx, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.VssTrace.DLL_Ordinal_3]
nop dword [rax + rax]
nop
jmp 0x14000c061
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbx], r12
jmp 0x14000c07d
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea r9, str.CVssSidCollection::AddWellKnownSid
mov qword [rsp + 0x68], r9
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x54c
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.CreateWellKnownSid_type__NULL__NULL__dwSid_
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.1400c3b7c
int3
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea r9, str.CVssSidCollection::AddWellKnownSid
mov qword [rsp + 0x68], r9
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x54f
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.CreateWellKnownSid_type__NULL__NULL__dwSid_
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.1400c3b7c
int3
mov ebx, 0x8007000e
mov dword [rbp + 0x3f8], ebx
lea rdx, [0x140159b90]
lea rcx, [rbp + 0x3f8]
call sub.msvcrt.dll__CxxThrowException
int3
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
lea r9, str.CVssSidCollection::AddWellKnownSid
mov qword [rsp + 0x68], r9
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x558
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
mov r9d, dword [rbp + 0x3f0]
lea r8, str.CreateWellKnownSid_type__NULL__pSid____ld__
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.1400c3b7c
int3
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
lea rax, str.SECSECRC
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x55e
mov dword [rsp + 0x7c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rbp - 0x80], 0xff
mov dword [rbp], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
lea r8, str.Set_m_pSidAdmin
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.140009fb0
mov rax, rbx
mov rbx, r12
mov qword [r14 + 0x68], rax
mov rax, r12
jmp 0x14000c14b