Function at 0x1401920e0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
push r12
push r13
sub rsp, 0x78
mov r13, r8
mov r9d, edx
mov r12, rcx
test r8, r8
jne 0x140192108
mov eax, 0xc0000001
add rsp, 0x78
pop r13
pop r12
ret
mov eax, r9d
mov qword [rsp + 0x50], r15
and al, 0x13
neg al
mov eax, 0x10c0000
sbb ecx, ecx
and ecx, 0x80000
mov r8d, ecx
bts r8d, 0x12
test r9d, 0xa0000024
cmove r8d, ecx
lea rcx, [rsp + 0x40]
mov edx, r8d
bts edx, 0x18
test r9d, 0x50000048
cmove edx, r8d
mov r8, qword [r13 + 0x78]
bt r9d, 0x10
cmovb edx, eax
mov rax, qword [r13 + 0x58]
call qword [case.0x14013d64a.0]
mov r15d, eax
lfence
test eax, eax
js 0x140192468
mov qword ss:[rsp + 0x90], rbx
mov qword ss:[rsp + 0x70], rbp
mov qword [rsp + 0x68], rsi
mov rsi, qword [r13 + 0x50]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r14
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14019225a
mov rsi, qword ds:[rsi + 8]
lea r14, str.Service
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401921f6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019224b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x1401921d0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192306
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x140192237
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019225a
add rsi, 2
sub rdi, 1
jne 0x140192210
jmp 0x140192306
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401921ff
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x140192385
mov rsi, qword ds:[rsi + 8]
lea r14, str.SCManager
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401922ba
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192332
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x140192290
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140192306
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x1401922fb
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192385
add rsi, 2
sub rdi, 1
jne 0x1401922d0
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
test eax, eax
je 0x140192345
mov rcx, qword [rsp + 0x40]
xor r15d, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140192449
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401922c3
cmp dword [0x1402bff40], 0xffffffff
jae 0x14019235c
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140192366
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov rcx, qword [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x140192449
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 8
jne 0x140192488
mov rsi, qword [rsi + 8]
lea rbp, [0x14026d620]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401923da
nop dword [rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192476
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x1401923b0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140192426
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192418
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192488
add rsi, 2
sub rdi, 1
jne 0x1401923f0
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov r15d, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rsp + 0x58]
mov eax, r15d
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
add rsp, 0x78
pop r13
pop r12
ret
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401923e3
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14019253a
mov rsi, qword [rsi + 8]
lea rbp, str.FileObject
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401924d6
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019252b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x1401924b0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192426
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192518
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019253a
add rsi, 2
sub rdi, 1
jne 0x1401924f0
jmp 0x140192426
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401924df
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x1401925fa
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaAccount
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192596
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401925eb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192570
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192826
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x1401925d8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401925fa
add rsi, 2
sub rdi, 1
jne 0x1401925b0
jmp 0x140192826
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019259f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x1401926ba
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaPolicy
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192656
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401926ab
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192630
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192826
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192698
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401926ba
add rsi, 2
sub rdi, 1
jne 0x140192670
jmp 0x140192826
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019265f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14019277a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaSecret
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192716
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019276b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x1401926f0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192826
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192758
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019277a
add rsi, 2
sub rdi, 1
jne 0x140192730
jmp 0x140192826
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019271f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14019285d
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaTrusted
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401927da
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019284e
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x1401927b0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140192826
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192818
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019285d
add rsi, 2
sub rdi, 1
jne 0x1401927f0
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_LsaSetSecurityObject]
mov rcx, qword [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x140192449
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401927e3
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14019291a
mov rsi, qword [rsi + 8]
lea rbp, str.SamAlias
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401928b6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019290b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192890
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192449
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x1401928f8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019291a
add rsi, 2
sub rdi, 1
jne 0x1401928d0
jmp 0x140192449
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401928bf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x1401929da
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamDomain
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192976
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401929cb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192950
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192449
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x1401929b8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401929da
add rsi, 2
sub rdi, 1
jne 0x140192990
jmp 0x140192449
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019297f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x140192a9a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamGroup
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192a36
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192a8b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192a10
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192449
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192a78
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192a9a
add rsi, 2
sub rdi, 1
jne 0x140192a50
jmp 0x140192449
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192a3f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x140192b5a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamServer
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192af6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192b4b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192ad0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192449
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192b38
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192b5a
add rsi, 2
sub rdi, 1
jne 0x140192b10
jmp 0x140192449
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192aff
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x140192c1a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamUser
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192bb6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192c0b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192b90
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192449
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192bf8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192c1a
add rsi, 2
sub rdi, 1
jne 0x140192bd0
jmp 0x140192449
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192bbf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x140192d5a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.TokenDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192c7a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192d3d
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192c50
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140192cc6
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192cbc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192d5a
add rsi, 2
sub rdi, 1
jne 0x140192c90
xor r15d, r15d
mov byte [rsp + 0xa8], 0
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x48]
mov byte [rsp + 0xa0], 0
lea rdx, [rsp + 0xa8]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
nop dword [rax]
test eax, eax
js 0x14019243b
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140192d4f
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0xa0]
mov r9d, 8
mov qword [rsp + 0xa0], rax
mov edx, 6
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
jmp 0x14019243b
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192c83
mov r15d, 0xc0000079
jmp 0x14019243e
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x140192ea5
mov rsi, qword ds:[rsi + 8]
lea rbp, str.PowerDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192dba
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192e93
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192d90
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140192e06
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192dfc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192ea5
add rsi, 2
sub rdi, 1
jne 0x140192dd0
call fcn.140189140
mov rdx, rax
mov r8b, 1
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
lea rdx, [0x140245150]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov edx, 0x1100
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetControlSecurityDescriptor]
mov rdx, r12
mov ecx, 0xf
call fcn.14013b8a0
mov rbx, rax
test rax, rax
je 0x140192449
mov rcx, rax
call fcn.140180fe0
mov r15d, eax
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140192449
call fcn.140141ca0
jmp 0x140192449
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192dc3
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140193039
mov rsi, qword [rsi + 8]
lea rbp, str.RdpDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192efa
nop dword [rax]
movdqu xmm1, xmmword [rbp]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192fc7
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192ed0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140192f46
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192f3c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193039
add rsi, 2
sub rdi, 1
jne 0x140192f10
mov rax, qword [0x1402cabd8]
xor r15d, r15d
test rax, rax
jne 0x140193005
call fcn.140180d40
nop
test rax, rax
je 0x140192ff5
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140192fd9
mov edx, dword ds:[rax + 0x3c]
lea ecx, [rdx - 1]
cmp ecx, 0x7ffffffd
ja 0x140192fd9
cmp dword [rdx + rax], 0x4550
jne 0x140192fd9
add rdx, 0x88
add rdx, rax
mov ecx, dword [rdx]
test ecx, ecx
je 0x140192fd9
cmp dword [rdx + 4], r15d
je 0x140192fd9
lea r8, ds:[rax + rcx]
mov word [rsp + 0x20], r15w
mov rcx, rax
lea r9, str.WTSSetListenerSecurityW
call fcn.14017dc40
jmp 0x140192fdc
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192f03
mov rax, r15
mov qword [0x1402cabd8], rax
test rax, rax
jne 0x140193005
mov ecx, 0xc000007a
mov r15d, ecx
jmp 0x140192449
mov ecx, 0xc0000135
mov r15d, ecx
jmp 0x140192449
mov qword [rsp + 0x28], r12
lea r9, str.RDP_Tcp
xor r8d, r8d
mov dword [rsp + 0x20], 0xc
xor edx, edx
xor ecx, ecx
call qword [case.0x14013d64a.0]
test eax, eax
mov ecx, 0xc0000079
cmovne ecx, r15d
mov r15d, ecx
jmp 0x140192449
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140192426
mov rsi, qword ds:[rsi + 8]
lea r14, str.WmiDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14019309a
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019311c
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x140193070
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x1401930e6
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x1401930db
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192426
add rsi, 2
sub rdi, 1
jne 0x1401930b0
call fcn.140189140
mov r8b, 1
mov rdx, rax
mov rcx, r12
mov rbx, rax
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov rcx, r12
call fcn.140181560
mov r15d, eax
jmp 0x140192449
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401930a3