Function at 0x21016bc60
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x110
cmp qword [0x21023ee48], 0
mov rbx, qword [0x21023d810]
je 0x21016bf48
mov rcx, qword [rbx + 0x4860]
test rcx, rcx
je 0x21016bda8
mov r8, qword [rbx + 0x4878]
test r8, r8
je 0x21016bcca
mov rax, qword [rbx + 0x47e0]
cmp qword [rbx + 0x47e8], rax
je 0x21016bddc
mov rcx, r8
call sym.CloseHandle
mov rcx, qword [rbx + 0x4860]
test rcx, rcx
je 0x21016bccf
call sym.CloseHandle
mov rcx, qword [rbx + 0x4868]
mov rbx, qword [0x21023d810]
test rcx, rcx
je 0x21016be4f
call sym.CloseHandle
mov rax, qword [0x21024fce8]
mov rsi, qword [0x21023d810]
mov edx, dword [rax + 0xfc18]
mov r8, qword [rsi + 0x4740]
movzx ebx, byte [rsi + 0x478c]
mov dword [rsi + 0x47e8], edx
mov dword [rsi + 0x47e0], edx
mov eax, dword [rax + 0xfc1c]
xor edx, edx
mov qword [rsi + 0x4860], 0
mov dword [rsi + 0x47ec], eax
mov dword [rsi + 0x47e4], eax
mov qword [rsi + 0x4868], 0
mov qword [rsi + 0x4870], 0
mov qword [rsi + 0x4878], 0
mov word [rsi + 0x4880], dx
mov byte [rsi + 0x4882], 0
test r8, r8
je 0x21016bef8
lea rdx, [rsi + 0x4798]
mov ecx, 0x44
mov qword [rsi + 0x4790], rdx
call sym.RtlCopySid
mov byte [rsi + 0x47dc], bl
add rsp, 0x110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.RevertToSelf
mov rcx, qword [rbx + 0x4868]
test rcx, rcx
je 0x21016bf10
mov r8, qword [rbx + 0x4878]
test r8, r8
je 0x21016bce6
mov rax, qword [rbx + 0x47e8]
cmp qword [rbx + 0x47e0], rax
jne 0x21016bcb6
cmp dword [rbx + 0x4850], 1
je 0x21016bcb6
cmp byte [rbx + 0x4882], 0
jne 0x21016bcb6
mov rcx, qword [rbx + 0x4870]
add rsp, 0x110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.ImpersonateLoggedOnUser
test byte [0x210273880], 1
jne 0x21016c130
mov rax, qword [0x21023d810]
mov r8, rsi
mov edx, 2
lea rcx, [rax + 0x4700]
call method.cygheap_user.ontherange_homebodies__passwd_
mov rcx, r12
call method.cyg_ldap.close__
mov rbx, qword [0x21023d810]
mov rax, qword [0x21024fce8]
mov r8, qword [rbx + 0x4740]
mov rsi, rbx
movzx r12d, byte [rbx + 0x478c]
mov edx, dword [rax + 0xfc18]
mov dword [rbx + 0x47e8], edx
mov dword [rbx + 0x47e0], edx
mov eax, dword [rax + 0xfc1c]
mov qword [rbx + 0x4860], 0
mov dword [rbx + 0x47ec], eax
mov dword [rbx + 0x47e4], eax
xor eax, eax
mov qword [rbx + 0x4868], 0
mov qword [rbx + 0x4870], 0
mov qword [rbx + 0x4878], 0
mov word [rbx + 0x4880], ax
mov byte [rbx + 0x4882], 0
test r8, r8
je 0x21016bef8
lea rdx, [rbx + 0x4798]
mov ecx, 0x44
mov qword [rbx + 0x4790], rdx
call sym.RtlCopySid
mov byte [rbx + 0x47dc], r12b
jmp 0x21016bd8e
mov qword [rsi + 0x4790], 0
jmp 0x21016bd8e
cmp qword [rbx + 0x4870], 0
je 0x21016bf30
mov r8, qword [rbx + 0x4878]
test r8, r8
jne 0x21016bdc8
jmp 0x21016be4f
add rsp, 0x110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r12, [rsp + 0x80]
lea rcx, [rbx + 0x4740]
mov qword [rsp + 0x80], 0
mov rdx, r12
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov byte [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
call sym.internal_getpwsid_cygpsid__cyg_ldap_
lea rcx, [rbx + 0x47f0]
mov rdx, r12
mov rsi, rax
call sym.internal_getgrsid_cygpsid__cyg_ldap_
mov rdi, rax
mov rax, qword [0x21023d810]
cmp byte [rax + 0x4334], 0
je 0x21016c118
test rsi, rsi
je 0x21016be18
mov rdx, qword [rsi]
lea r13, [rsp + 0x38]
mov byte [rsp + 0x7c], 0
lea rcx, [rbx + 0x4700]
mov qword [rsp + 0x30], r13
call method.cygheap_user.set_name_char_const_
mov rax, qword [0x21024fce8]
mov edx, dword [rsi + 0x10]
mov ecx, dword [rsi + 0x14]
mov dword [rax + 0xfc18], edx
mov dword [rax + 0xfc1c], ecx
test rdi, rdi
je 0x21016c032
cmp ecx, dword [rdi + 0x10]
je 0x21016be25
mov rdx, r12
call sym.internal_getgrgid_unsigned_int__cyg_ldap_
mov rbp, rax
test rax, rax
je 0x21016c158
lea r8, [rbp + 0x20]
mov rdx, r13
mov ecx, 0x44
mov qword [rsp + 0x30], r13
call sym.RtlCopySid
cmp qword [rsp + 0x30], 0
mov byte [rsp + 0x7c], 0
lea r14, [rsp + 0x30]
je 0x21016c161
mov rdx, r12
mov rcx, r14
call sym.internal_getgrsid_cygpsid__cyg_ldap_
cmp rax, rbp
je 0x21016c09a
test rax, rax
je 0x21016c09a
mov eax, dword [rax + 0x10]
mov rdx, qword [0x21024fce8]
mov dword [rsi + 0x14], eax
mov dword [rdx + 0xfc1c], eax
mov rdx, qword [rbx + 0x47f0]
mov rcx, qword [rsp + 0x30]
test rdx, rdx
je 0x21016c198
test rcx, rcx
je 0x21016c198
call sym.RtlEqualSid
test al, al
jne 0x21016be25
mov rcx, qword [rsp + 0x30]
call sym.check_token_membership_void_
test al, al
jne 0x21016c1a6
test rdi, rdi
je 0x21016c0ef
mov eax, dword [rdi + 0x10]
mov rdx, qword [0x21024fce8]
mov dword [rsi + 0x14], eax
mov dword [rdx + 0xfc1c], eax
mov rcx, qword [0x21024fb18]
test rcx, rcx
je 0x21016be25
mov qword [0x21024fb18], 0
call sym.CloseHandle
jmp 0x21016be25
mov r8, r12
xor edx, edx
xor ecx, ecx
call sym.internal_getgroups_int__unsigned_int__cyg_ldap_
jmp 0x21016bfe4
lea r9, str.user_not_found_in_passwd_DB
lea r8, str.void_internal_getlogin_cygheap_user_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21016be25
mov qword [rsp + 0x30], 0
test byte [0x210273880], 1
je 0x21016be25
lea r9, str.group_not_found_in_group_DB
lea r8, str.void_internal_getlogin_cygheap_user_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21016be25
cmp rdx, rcx
je 0x21016be25
jmp 0x21016c0c5
mov rcx, qword [0x21024fb20]
mov r9d, 0x50
mov r8, r14
mov edx, 5
call sym.NtSetInformationToken
test eax, eax
js 0x21016c1f7
mov r8, qword [rsp + 0x30]
movzx edi, byte [rsp + 0x7c]
test r8, r8
je 0x21016c22c
lea rdx, [rbx + 0x47f8]
mov ecx, 0x44
mov qword [rbx + 0x47f0], rdx
call sym.RtlCopySid
mov byte [rbx + 0x483c], dil
jmp 0x21016c0ef
test byte [0x210273880], 1
je 0x21016c0d7
mov dword [rsp + 0x20], eax
lea r9, str.NtSetInformationToken__TokenPrimaryGroup____y
lea r8, str.void_internal_getlogin_cygheap_user_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21016c0d7
mov qword [rbx + 0x47f0], 0
jmp 0x21016c0ef