Function at 0x140001a90
Capabilities:
Enumerate pe sections
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x448]
sub rsp, 0x548
mov rax, rdx
xor edx, edx
cmp ecx, 2
jl 0x140001abc
mov rcx, qword [rax + 8]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x140001acf
mov r8d, 0x801
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140001ae4
lea eax, [rdi - 1]
add rsp, 0x548
pop rdi
pop rbp
ret
mov qword [rsp + 0x568], rbx
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x540], rsi
mov qword [rsp + 0x538], r12
mov qword [rsp + 0x530], r13
movsxd r13, dword [rdi + 0x3c]
add r13, rdi
mov qword [rsp + 0x528], r14
mov qword [rsp + 0x520], r15
xor r15d, r15d
mov ebx, r15d
mov qword [rbp - 0x70], rcx
movzx eax, word [r13 + 0x14]
lea rsi, [r13 + 0x18]
add rsi, rax
mov qword [rbp + 0x478], rsi
cmp r15w, word [r13 + 6]
jae 0x140001b99
lea r14, [0x140021758]
nop dword [rax]
mov dword [rsp + 0x28], ecx
xor edx, edx
mov r9d, ecx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea ecx, [rdx + 0x7f]
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x140001b90
movzx eax, word [r13 + 6]
add rsi, 0x28
inc rbx
mov qword [rbp + 0x478], rsi
mov rcx, 0xffffffffffffffff
cmp rbx, rax
jb 0x140001b50
jmp 0x140001b99
test rsi, rsi
jne 0x140001c08
lea rcx, [rsi - 1]
movzx esi, word [r13 + 0x14]
mov rbx, r15
add rsi, 0x18
add rsi, r13
mov qword [rbp + 0x478], rsi
cmp r15w, word [r13 + 6]
jae 0x140001bfe
lea r14, str..text
nop dword [rax]
mov dword [rsp + 0x28], ecx
xor edx, edx
mov r9d, ecx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea ecx, [rdx + 0x7f]
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x140001c08
movzx eax, word [r13 + 6]
add rsi, 0x28
inc rbx
mov qword [rbp + 0x478], rsi
mov rcx, 0xffffffffffffffff
cmp rbx, rax
jb 0x140001bc0
mov rsi, r15
mov qword [rbp + 0x478], r15
mov r9d, dword [rsi + 0xc]
mov rax, r15
mov esi, dword [rsi + 0x10]
mov qword [rbp + 0x470], r9
lea r14, [r9 + rdi]
test rsi, rsi
je 0x140001c58
movzx ecx, byte [0x140021cd0]
mov rdx, qword [0x140021cc8]
mov r8, qword [str.CDefPolicy::Query]
cmp qword [rax + r14], r8
jne 0x140001c4f
cmp qword [rax + r14 + 8], rdx
jne 0x140001c4f
cmp byte [rax + r14 + 0x10], cl
je 0x140001e34
add rax, 4
cmp rax, rsi
jb 0x140001c37
mov rax, 0xffffffffffffffff
mov rbx, r15
mov qword [rbp - 0x68], rax
mov r12, r14
mov r15, rsi
test rsi, rsi
je 0x140001c9f
lea rcx, [rbx + r12]
mov r8d, 0x29
lea rdx, str.CEnforcementCore::GetInstanceOfTSLicense
call fcn.1400184a0
test eax, eax
je 0x140001e4a
add rbx, 4
cmp rbx, r15
jb 0x140001c71
mov rax, 0xffffffffffffffff
xor ebx, ebx
mov qword [rbp - 0x60], rax
mov r12, r14
mov r15, rsi
test rsi, rsi
je 0x140001cde
lea rcx, [rbx + r12]
mov r8d, 0x38
lea rdx, str.CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
call fcn.1400184a0
test eax, eax
je 0x140001e65
add rbx, 4
cmp rbx, r15
jb 0x140001cb0
mov rax, 0xffffffffffffffff
xor ebx, ebx
mov qword [rsp + 0x58], rax
mov r12, r14
mov r15, rsi
test rsi, rsi
je 0x140001d1e
lea rcx, [rbx + r12]
mov r8d, 0x17
lea rdx, str.IsSingleSessionPerUser
call fcn.1400184a0
test eax, eax
je 0x140001e81
add rbx, 4
cmp rbx, r15
jb 0x140001cf0
mov rax, 0xffffffffffffffff
mov r15, qword [rbp + 0x470]
movabs rcx, 0x3a3a736c69745543
mov qword [rsp + 0x70], rax
cmp qword [rax + rdi - 8], rcx
jne 0x140001d44
sub rax, 8
mov qword [rsp + 0x70], rax
xor r12d, r12d
mov ebx, r12d
test rsi, rsi
je 0x140001d77
nop
lea rcx, [rbx + r14]
mov r8d, 0x21
lea rdx, str.CSLQuery::IsTerminalTypeLocalOnly
call fcn.1400184a0
test eax, eax
je 0x140001e91
add rbx, 4
cmp rbx, rsi
jb 0x140001d50
mov rbx, r12
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x68], r12
test rsi, rsi
je 0x140001db7
nop dword [rax + rax]
lea rcx, [rbx + r14]
mov r8d, 0x80
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowRemoteConnections
call fcn.1400184a0
test eax, eax
je 0x140001ea9
add rbx, 4
cmp rbx, rsi
jb 0x140001d90
mov qword [rbp - 0x78], r12
mov r14d, dword [r13 + 0x90]
add r14, rdi
mov rbx, r14
cmp dword [r14 + 0xc], 0
je 0x140001df5
nop
mov ecx, dword [rbx + 0xc]
lea rdx, str.msvcrt.dll
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001eb6
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140001dd0
mov eax, 0xfffffffe
mov r14, qword [rsp + 0x528]
mov r13, qword [rsp + 0x530]
mov r12, qword [rsp + 0x538]
mov rsi, qword [rsp + 0x540]
mov rbx, qword [rsp + 0x568]
mov r15, qword [rsp + 0x520]
add rsp, 0x548
pop rdi
pop rbp
ret
lea rcx, [rax + r9]
mov rbx, r15
mov qword [rbp - 0x68], rcx
mov r12, r14
mov r15, rsi
jmp 0x140001c71
mov rcx, qword [rbp + 0x470]
mov r12, r14
add rcx, rbx
mov r15, rsi
mov qword [rbp - 0x60], rcx
xor ebx, ebx
jmp 0x140001cb0
mov rcx, qword [rbp + 0x470]
mov r12, r14
add rcx, rbx
mov r15, rsi
mov qword [rsp + 0x58], rcx
xor ebx, ebx
jmp 0x140001cf0
mov r15, qword [rbp + 0x470]
lea rax, [rbx + r15]
jmp 0x140001d25
lea rax, [rbx + r15]
mov rbx, r12
mov qword [rsp + 0x68], rax
mov r12, 0xffffffffffffffff
jmp 0x140001d90
lea rax, [rbx + r15]
mov qword [rbp - 0x78], rax
jmp 0x140001dbb
mov esi, dword [rbx]
add rsi, rdi
mov rax, qword [rsi]
test rax, rax
je 0x140001ef5
nop dword [rax]
nop word [rax + rax]
lea rcx, [rax + 2]
add rcx, rdi
lea rdx, str.memset
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001f63
mov rax, qword [rsi + 8]
add rsi, 8
test rax, rax
jne 0x140001ed0
mov qword [rsp + 0x78], r12
cmp dword [r14 + 0xc], 0
mov rbx, r14
mov qword [rsp + 0x60], r12
je 0x140001f31
nop dword [rax]
mov ecx, dword [rbx + 0xc]
lea rdx, str.api_ms_win_core_kernel32_legacy_l1_1_1.dll
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001f78
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140001f10
cmp dword [r14 + 0xc], 0
mov rbx, r14
je 0x140001fba
nop dword [rax + rax]
mov ecx, dword [rbx + 0xc]
lea rdx, [0x1400217c8]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001f78
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140001f40
jmp 0x140001fba
mov ecx, dword [rbx + 0x10]
mov eax, dword [rbx]
sub rcx, rax
sub rcx, rdi
add rcx, rsi
mov qword [rsp + 0x78], rcx
jmp 0x140001efa
mov esi, dword [rbx]
add rsi, rdi
mov rax, qword [rsi]
test rax, rax
je 0x140001fb5
nop word [rax + rax]
lea rcx, [rax + 2]
add rcx, rdi
lea rdx, str.VerifyVersionInfoW
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001fec
mov rax, qword [rsi + 8]
add rsi, 8
test rax, rax
jne 0x140001f90
mov qword [rsp + 0x60], r12
mov eax, dword [r13 + 0xa0]
add rax, rdi
mov qword [rsp + 0x40], rax
mov eax, 0xaaaaaaab
mul dword [r13 + 0xa4]
mov esi, edx
shr esi, 3
mov dword [rbp + 0x470], esi
test esi, esi
jne 0x140002002
lea eax, [rsi - 3]
jmp 0x140001dfa
mov r15d, dword [rbx + 0x10]
mov eax, dword [rbx]
sub r15, rax
sub r15, rdi
add r15, rsi
mov qword [rsp + 0x60], r15
jmp 0x140001fba
xor ebx, ebx
lea rcx, [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov r14d, ebx
mov qword [rsp + 0x38], rbx
mov r12d, ebx
mov r13d, ebx
lea r8d, [rbx + 2]
mov r15d, ebx
call qword [sym.imp.Zydis.dll_ZydisDecoderInit]
mov dword [rbp + 0x460], ebx
mov eax, ebx
test esi, esi
je 0x14000235d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rbp + 0x470]
mov rsi, rcx
mov qword [rbp - 0x80], rdx
nop
mov ebx, eax
test r14, r14
jne 0x1400020cb
mov r9, qword [rbp - 0x68]
lea rax, [rbx + rbx*2]
lea r8, [rcx + rax*4]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140001070
test rax, rax
je 0x1400020c6
mov ecx, dword [rsi + 8]
mov rax, rsi
test cl, 1
je 0x140002088
lea rax, [rdi + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
je 0x1400020be
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
jne 0x1400020a0
mov r14d, dword [rax]
jmp 0x140002310
mov rcx, qword [rsp + 0x40]
lea rbx, [rbx + rbx*2]
shl rbx, 2
cmp qword [rsp + 0x30], 0
jne 0x14000214a
mov r9, qword [rbp - 0x60]
lea r8, [rbx + rcx]
lea rcx, [rsp + 0x48]
mov rdx, rdi
call fcn.140001070
test rax, rax
je 0x14000214a
mov ecx, dword [rsi + 8]
mov rax, rsi
test cl, 1
je 0x140002108
lea rax, [rdi + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
je 0x14000213e
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
jne 0x140002120
mov eax, dword [rax]
mov qword [rsp + 0x30], rax
jmp 0x140002315
test r12, r12
jne 0x1400021b6
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov r9, qword [rsp + 0x58]
add r8, rbx
mov rdx, rdi
call fcn.140001070
test rax, rax
je 0x1400021b6
mov ecx, dword [rsi + 8]
mov rax, rsi
test cl, 1
je 0x140002181
lea rax, [rdi + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
je 0x1400021ae
nop dword [rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
jne 0x140002190
mov r12d, dword [rax]
jmp 0x140002310
test r13, r13
jne 0x140002226
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov r9, qword [rsp + 0x70]
add r8, rbx
mov rdx, rdi
call fcn.140001070
test rax, rax
je 0x140002226
mov ecx, dword [rsi + 8]
mov rax, rsi
test cl, 1
je 0x1400021ed
lea rax, [rdi + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
je 0x14000221e
nop dword [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
jne 0x140002200
mov r13d, dword [rax]
jmp 0x140002310
cmp qword [rsp + 0x38], 0
jne 0x14000229c
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov r9, qword [rsp + 0x68]
add r8, rbx
mov rdx, rdi
call fcn.140001070
test rax, rax
je 0x14000229c
mov ecx, dword [rsi + 8]
mov rax, rsi
test cl, 1
je 0x140002260
lea rax, [rdi + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
je 0x14000228e
nop dword [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, rdi
test byte [rcx], 0x20
jne 0x140002270
mov ebx, dword [rax]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rbx
jmp 0x14000231a
test r15, r15
jne 0x140002310
mov eax, dword [rbp + 0x460]
mov rdx, rdi
mov r9, qword [rbp - 0x78]
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x40]
lea r8, [rax + rcx*4]
lea rcx, [rsp + 0x48]
call fcn.140001070
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140002310
mov ecx, dword [rsi + 8]
mov r15, rsi
test cl, 1
je 0x1400022e1
lea r15, [rdi + rcx]
and r15, 0xfffffffffffffffc
mov ecx, dword [r15 + 8]
add rcx, rdi
test byte [rcx], 0x20
je 0x140002310
nop dword [rax]
movzx r15d, byte [rcx + 2]
lea rcx, [rcx + 4]
inc r15
and r15, 0xfffffffffffffffe
lea r15, [rcx + r15*2]
mov ecx, dword [r15 + 8]
add rcx, rdi
test byte [rcx], 0x20
jne 0x1400022f0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
test r14, r14
je 0x140002338
test rax, rax
je 0x140002338
test r12, r12
je 0x140002338
test r13, r13
je 0x140002338
test rbx, rbx
je 0x140002338
test r15, r15
jne 0x140002368
mov eax, dword [rbp + 0x460]
add rsi, 0xc
mov rcx, qword [rsp + 0x40]
inc eax
mov dword [rbp + 0x460], eax
cmp eax, dword [rbp + 0x470]
jb 0x140002050
jmp 0x140002368
mov rax, qword [rbp + 0x470]
mov qword [rbp - 0x80], rax
mov edx, 1
mov rcx, rdi
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x140002389
mov eax, 0xfffffffc
jmp 0x140001dfa
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x1400023a5
lea eax, [rbx - 5]
jmp 0x140001dfa
movzx eax, word [rax + 0x34]
lea rcx, str.__hu._hu._hu._hu__n
movzx r9d, word [rbx + 0x36]
movzx r8d, word [rbx + 0x30]
movzx edx, word [rbx + 0x32]
mov dword [rsp + 0x20], eax
call fcn.140001010
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x140002429
mov rsi, qword [rsp + 0x60]
test r12, r12
je 0x1400023fc
mov r9, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.1400017f0
test eax, eax
jne 0x140002429
mov rax, qword [rsp + 0x78]
test r13, r13
je 0x140002429
mov r9, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.1400017f0
test eax, eax
jne 0x140002429
lea rcx, str.ERROR:_SingleUserPatch_not_found
call fcn.140007148
test r14, r14
je 0x140002440
mov r8, rdi
lea rcx, [rsp + 0x48]
mov rdx, r14
call fcn.1400014b0
jmp 0x14000244c
lea rcx, str.ERROR:_CDefPolicy_Query_not_found
call fcn.140007148
mov ecx, dword [rbx + 0x30]
cmp ecx, 0x60001
jbe 0x140002cc5
test r15, r15
jne 0x140002473
lea rcx, str.ERROR:_CSLQuery_Initialize_not_found
call fcn.140007148
xor eax, eax
jmp 0x140001dfa
mov eax, dword [r15]
mov r14d, dword [r15 + 4]
sub r14, rax
mov qword [rsp + 0x78], r14
lea rsi, [rax + rdi]
cmp ecx, 0x60002
jne 0x140002546
mov rbx, qword [rbp - 0x80]
lea rax, [rbp - 0x50]
add rbx, rdi
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea r9, [rbp + 0x2d0]
mov r8, r14
lea rcx, [rsp + 0x48]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140002516
nop
movzx eax, byte [rbp + 0x2d8]
add rbx, rax
sub r14, rax
cmp dword [rbp + 0x2d4], 0x47
jne 0x1400024f1
cmp dword [rbp - 0x30], 4
jne 0x1400024f1
cmp byte [rbp - 0x27], 1
jne 0x1400024f1
cmp dword [rbp + 0x20], 1
jne 0x1400024f1
cmp dword [rbp + 0x28], 0xc5
je 0x140002529
lea rax, [rbp - 0x50]
mov r8, r14
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x1400024c0
lea rcx, str.ERROR:_SLGetWindowsInformationDWORDWrapper_not_found
call fcn.140007148
xor eax, eax
jmp 0x140001dfa
mov rdx, qword [rbp - 0x20]
lea rcx, str.SLPolicyInternal.x641_nSLPolicyOffset.x64_llX_nSLPolicyFunc.x64New_Win8SL_n
sub rdx, rdi
add rdx, rbx
call fcn.140001010
xor eax, eax
jmp 0x140001dfa
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140002575
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14000256c
mov r9, rax
lea rcx, [rsp + 0x48]
mov r8, rdi
call fcn.140001170
jmp 0x140002581
lea rcx, str.ERROR:_IsLicenseTypeLocalOnly_not_found
jmp 0x14000257c
lea rcx, str.ERROR:_GetInstanceOfTSLicense_not_found
call fcn.140007148
mov edx, dword [r15]
lea rcx, str.SLInitHook.x641_nSLInitOffset.x64_lX_nSLInitFunc.x64New_CSLQuery_Initialize_n
call fcn.140001010
movzx eax, word [rbx + 0x34]
lea rcx, str._n__hu._hu._hu._hu_SLInit__n
movzx r9d, word [rbx + 0x36]
movzx r8d, word [rbx + 0x30]
movzx edx, word [rbx + 0x32]
mov dword [rsp + 0x20], eax
call fcn.140001010
mov rdx, qword [rbp + 0x478]
xor r12d, r12d
mov ebx, r12d
mov r15d, dword [rdx + 0xc]
mov r14d, dword [rdx + 0x10]
add r15, rdi
test r14, r14
je 0x1400025fe
nop
lea rcx, [rbx + r15]
mov r8d, 0x7e
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowMultipleSessions
call fcn.1400184a0
test eax, eax
je 0x140002753
add rbx, 4
cmp rbx, r14
jb 0x1400025d0
mov rdx, qword [rbp + 0x478]
mov r14d, dword [rdx + 0xc]
mov r9, 0xffffffffffffffff
mov r15d, dword [rdx + 0x10]
add r14, rdi
mov rbx, r12
mov r13, r9
test r15, r15
je 0x140002655
nop dword [rax + rax]
lea rcx, [rbx + r14]
mov r8d, 0x78
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowAppServerMode
call fcn.1400184a0
test eax, eax
je 0x140002774
add rbx, 4
cmp rbx, r15
jb 0x140002620
mov rdx, qword [rbp + 0x478]
mov r9, 0xffffffffffffffff
mov r14d, dword [rdx + 0xc]
mov rbx, r12
mov r15d, dword [rdx + 0x10]
add r14, rdi
mov r12, r9
test r15, r15
je 0x1400026a5
nop dword [rax + rax]
lea rcx, [rbx + r14]
mov r8d, 0x6e
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowMultimon
call fcn.1400184a0
test eax, eax
je 0x140002794
add rbx, 4
cmp rbx, r15
jb 0x140002670
mov rdx, qword [rbp + 0x478]
mov r9, 0xffffffffffffffff
mov r14d, dword [rdx + 0xc]
xor ebx, ebx
mov eax, dword [rdx + 0x10]
add r14, rdi
mov r15, r9
test rax, rax
je 0x1400026f8
nop dword [rax]
lea rcx, [rbx + r14]
mov r8d, 0x72
lea rdx, str.TerminalServices_RemoteConnectionManager_MaxUserSessions
call fcn.1400184a0
test eax, eax
je 0x1400027b0
mov rdx, qword [rbp + 0x478]
add rbx, 4
mov eax, dword [rdx + 0x10]
cmp rbx, rax
jb 0x1400026c0
mov r9, 0xffffffffffffffff
mov eax, dword [rdx + 0xc]
xor ebx, ebx
mov ecx, dword [rdx + 0x10]
add rax, rdi
mov qword [rbp + 0x470], rax
mov r14, r9
test rcx, rcx
je 0x1400027e4
lea rcx, [rbx + rax]
mov r8d, 0xb4
lea rdx, str.TerminalServices_RemoteConnectionManager_ce0ad219_4670_4988_98fb_89b14c2f072b_MaxSessions
call fcn.1400184a0
test eax, eax
je 0x1400027d2
mov rcx, qword [rbp + 0x478]
add rbx, 4
mov eax, dword [rcx + 0x10]
cmp rbx, rax
mov rax, qword [rbp + 0x470]
jb 0x140002716
jmp 0x1400027e4
mov rdx, qword [rbp + 0x478]
mov r13d, dword [rdx + 0xc]
mov r14d, dword [rdx + 0xc]
add r13, rbx
mov r15d, dword [rdx + 0x10]
add r14, rdi
mov rbx, r12
jmp 0x140002620
mov rax, qword [rbp + 0x478]
mov r12d, dword [rax + 0xc]
mov r14d, dword [rax + 0xc]
add r12, rbx
mov r15d, dword [rax + 0x10]
add r14, rdi
xor ebx, ebx
jmp 0x140002670
mov rax, qword [rbp + 0x478]
mov r15d, dword [rax + 0xc]
mov r14d, dword [rax + 0xc]
add r15, rbx
add r14, rdi
xor ebx, ebx
jmp 0x1400026c0
mov rcx, qword [rbp + 0x478]
mov r14d, dword [rcx + 0xc]
mov eax, dword [rcx + 0xc]
add r14, rbx
add rax, rdi
mov qword [rbp + 0x470], rax
xor ebx, ebx
jmp 0x140002716
mov rax, qword [rbp + 0x478]
mov r9d, dword [rax + 0xc]
add r9, rbx
mov qword [rbp - 0x70], r9
mov r8, qword [rsp + 0x78]
lea rbx, [rsp + 0x68]
xor eax, eax
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x68], rax
mov rdx, rsi
mov qword [rbp + 0x470], rax
lea rcx, [rsp + 0x48]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
cmp r8, 0x100
jbe 0x1400029c0
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140002bb6
nop dword [rax]
movzx eax, byte [rbp + 0x2d8]
mov rcx, qword [rsp + 0x78]
add rsi, rax
mov edx, dword [rbp + 0x20]
sub rcx, rax
cmp qword [rbx], 0
movzx r8d, byte [rbp - 7]
mov eax, dword [rbp + 0x2d4]
mov qword [rsp + 0x78], rcx
jne 0x1400028c7
cmp eax, 0x1b7
jne 0x1400028c7
cmp dword [rbp - 0x30], 2
jne 0x14000297e
cmp dword [rbp - 0x20], 0xc5
jne 0x14000297e
test r8b, r8b
je 0x14000297e
cmp edx, 1
jne 0x14000296d
cmp dword [rbp + 0x28], 0x25
jne 0x14000296d
mov rax, qword [rbp - 0x10]
sub rax, rdi
add rax, rsi
mov qword [rbx], rax
jmp 0x14000297e
cmp eax, 0x18e
jne 0x140002957
cmp edx, 2
jne 0x14000297e
cmp dword [rbp + 0x30], 0xc5
jne 0x14000297e
cmp byte [rbp + 0x49], 0
je 0x14000297e
cmp dword [rbp - 0x30], 1
jne 0x14000297e
cmp dword [rbp - 0x28], 0x36
jne 0x14000297e
mov rax, qword [rbp + 0x40]
sub rax, rdi
add rax, rsi
cmp rax, qword [rbp - 0x78]
jne 0x14000291b
lea rbx, [rbp + 0x470]
jmp 0x14000297e
cmp rax, r13
jne 0x140002926
lea rbx, [rbp - 0x80]
jmp 0x14000297e
cmp rax, r12
jne 0x140002932
lea rbx, [rsp + 0x70]
jmp 0x14000297e
cmp rax, r15
jne 0x14000293e
lea rbx, [rsp + 0x60]
jmp 0x14000297e
cmp rax, r14
jne 0x14000294a
lea rbx, [rsp + 0x40]
jmp 0x14000297e
cmp rax, qword [rbp - 0x70]
jne 0x14000297e
lea rbx, [rsp + 0x38]
jmp 0x14000297e
cmp eax, 0x1b7
jne 0x14000297e
cmp dword [rbp - 0x30], 2
jne 0x14000297e
cmp dword [rbp - 0x20], 0xc5
jne 0x14000297e
test r8b, r8b
je 0x14000297e
cmp edx, 4
jne 0x14000297e
cmp qword [rbp + 0x30], 1
je 0x1400029ac
lea rax, [rbp - 0x50]
mov r8, rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2d0]
mov rdx, rsi
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140002850
jmp 0x140002b8e
mov rax, qword [rbp - 0x10]
sub rax, rdi
add rax, rsi
mov qword [rsp + 0x30], rax
jmp 0x140002b8e
mov r8d, 0x11000
mov qword [rbp + 0x478], r8
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140002bb6
nop dword [rax + rax]
movzx eax, byte [rbp + 0x2d8]
sub qword [rbp + 0x478], rax
add rsi, rax
mov eax, dword [rbp + 0x2d4]
mov r11d, dword [rbp + 0x20]
mov ecx, dword [rbp - 0x30]
cmp eax, 0x139
jne 0x140002a28
cmp ecx, 4
jne 0x140002a28
cmp byte [rbp - 0x27], 1
jne 0x140002a28
cmp r11d, 1
jne 0x140002a28
cmp dword [rbp + 0x28], 0xc5
jne 0x140002a28
add rsi, qword [rbp - 0x20]
jmp 0x140002b61
cmp qword [rbx], 0
movzx edx, byte [rbp - 7]
jne 0x140002a73
cmp eax, 0x1b7
jne 0x140002a73
cmp ecx, 2
jne 0x140002b61
cmp dword [rbp - 0x20], 0xc5
jne 0x140002b61
test dl, dl
je 0x140002b61
cmp r11d, 1
jne 0x140002b34
mov rax, qword [rbp - 0x10]
sub rax, rdi
add rax, rsi
mov qword [rbx], rax
jmp 0x140002b61
mov rdx, r13
mov r8, r12
mov r9, r15
mov r10, r14
cmp eax, 0x18e
jne 0x140002b1b
cmp r11d, 2
jne 0x140002b61
cmp dword [rbp + 0x30], 0xc5
jne 0x140002b61
cmp byte [rbp + 0x49], 0
je 0x140002b61
cmp ecx, 1
jne 0x140002b61
cmp dword [rbp - 0x28], 0x37
jne 0x140002b61
mov rcx, qword [rbp + 0x40]
sub rcx, rdi
add rcx, rsi
cmp rcx, qword [rbp - 0x78]
jne 0x140002ada
lea rbx, [rbp + 0x470]
jmp 0x140002b61
cmp rcx, rdx
jne 0x140002ae5
lea rbx, [rbp - 0x80]
jmp 0x140002b61
cmp rcx, r8
jne 0x140002af1
lea rbx, [rsp + 0x70]
jmp 0x140002b61
cmp rcx, r9
jne 0x140002afd
lea rbx, [rsp + 0x60]
jmp 0x140002b61
cmp rcx, r10
jne 0x140002b09
lea rbx, [rsp + 0x40]
jmp 0x140002b61
cmp rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x38]
cmovne rax, rbx
mov rbx, rax
jmp 0x140002b61
cmp eax, 0x1b7
jne 0x140002b5a
cmp ecx, 2
jne 0x140002b61
cmp dword [rbp - 0x20], 0xc5
jne 0x140002b61
movzx edx, byte [rbp - 7]
test dl, dl
je 0x140002b61
cmp r11d, 1
jne 0x140002b61
mov eax, dword [rbp + 0x28]
add eax, 0xffffffdb
cmp eax, r11d
ja 0x140002b61
mov rax, qword [rbp - 0x10]
sub rax, rdi
add rax, rsi
mov qword [rsp + 0x30], rax
jmp 0x140002b61
cmp eax, 0x2b6
je 0x140002b8e
mov r8, qword [rbp + 0x478]
lea rax, [rbp - 0x50]
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
mov rdx, rsi
lea rcx, [rsp + 0x48]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x1400029e0
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x140002bad
lea rcx, str.bServerSku.x64_llX_n
call fcn.140001010
mov rbx, qword [rbp + 0x470]
jmp 0x140002bc4
mov rbx, qword [rbp + 0x470]
jmp 0x140002bb8
xor ebx, ebx
lea rcx, str.ERROR:_bServerSku_not_found
call fcn.140007148
test rbx, rbx
je 0x140002bda
mov rdx, rbx
lea rcx, str.bRemoteConnAllowed.x64_llX_n
call fcn.140001010
jmp 0x140002be6
lea rcx, str.ERROR:_bRemoteConnAllowed_not_found
call fcn.140007148
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x140002bfd
lea rcx, str.bFUSEnabled.x64_llX_n
call fcn.140001010
jmp 0x140002c09
lea rcx, str.ERROR:_bFUSEnabled_not_found
call fcn.140007148
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140002c21
lea rcx, str.bAppServerAllowed.x64_llX_n
call fcn.140001010
jmp 0x140002c2d
lea rcx, str.ERROR:_bAppServerAllowed_not_found
call fcn.140007148
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140002c45
lea rcx, str.bMultimonAllowed.x64_llX_n
call fcn.140001010
jmp 0x140002c51
lea rcx, str.ERROR:_bMultimonAllowed_not_found
call fcn.140007148
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140002c69
lea rcx, str.lMaxUserSessions.x64_llX_n
call fcn.140001010
jmp 0x140002c75
lea rcx, str.ERROR:_lMaxUserSessions_not_found
call fcn.140007148
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002c8d
lea rcx, str.ulMaxDebugSessions.x64_llX_n
call fcn.140001010
jmp 0x140002c99
lea rcx, str.ERROR:_ulMaxDebugSessions_not_found
call fcn.140007148
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140002cb9
mov rdx, rax
lea rcx, str.bInitialized.x64_llX_n
call fcn.140001010
xor eax, eax
jmp 0x140001dfa
lea rcx, str.ERROR:_bInitialized_not_found
call fcn.140007148
xor eax, eax
jmp 0x140001dfa