Function at 0x140154a60
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0xb8]
sub rsp, 0x1b8
mov rbx, r8
mov edi, edx
mov r15, rcx
test r8, r8
jne 0x140154a97
mov eax, 0xc0000001
add rsp, 0x1b8
pop r15
pop rdi
pop rbx
pop rbp
ret
mov r8, qword [r8 + 0x58]
mov eax, edi
and al, 0x77
mov qword [rsp + 0x1a0], r14
neg al
mov eax, edi
sbb ecx, ecx
and ecx, 0x20000
mov edx, ecx
bts edx, 0x18
and al, 8
mov eax, 0x1020000
cmove edx, ecx
bt edi, 0x10
lea rcx, [rsp + 0x50]
cmovb edx, eax
mov rax, qword [rbx + 0x48]
call qword [case.0x1400f654f.0]
mov r14d, eax
lfence
test eax, eax
js 0x140155456
mov rcx, qword [rbx + 0x40]
lea rax, str.Service
mov r8b, 1
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x1e0], rsi
mov qword [rbp - 0x78], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x140155428
mov rcx, qword [rbx + 0x40]
lea rax, str.SCManager
mov r8b, 1
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x68]
mov qword [rbp - 0x68], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
jne 0x140155428
mov rcx, qword [rbx + 0x40]
lea rax, [0x1401dbaf8]
mov r8b, 1
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x58]
mov qword [rbp - 0x58], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140154c7e
mov rcx, qword [0x140241998]
mov edx, 4
mov rsi, qword [rsp + 0x50]
mov r8d, 0x100
mov dword [rbp + 0xf0], 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0xf0]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1401868c0
mov r9d, dword [rbp + 0xf0]
lea rax, [rbp + 0xf0]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, rsi
call fcn.1401332a0
mov r14d, eax
cmp eax, 0xc0000023
jne 0x140154c3d
mov rcx, qword [0x140241998]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword ds:[rbp + 0xf0]
mov edx, 4
mov rcx, qword [0x140241998]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0xf0]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1401868c0
mov r9d, dword [rbp + 0xf0]
lea rax, [rbp + 0xf0]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, rsi
call fcn.1401332a0
mov r14d, eax
nop dword [rax]
test r14d, r14d
jns 0x140154c6b
lfence
mov rcx, qword [0x140241998]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword ds:[rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14015544b
mov rcx, qword [rsp + 0x50]
mov qword [r15], rbx
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14015544b
mov rcx, qword ds:[rbx + 0x40]
lea rax, str.FileObject
mov r8b, 1
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x48], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140154cd1
mov rcx, qword [rsp + 0x50]
mov r9, r15
mov r8d, edi
mov edx, 1
call sym.ProcessHacker.exe_PhGetSeObjectSecurity
mov rcx, qword [rsp + 0x50]
mov r14d, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14015544b
mov rcx, qword [rbx + 0x40]
lea rax, str.LsaAccount
mov r8b, 1
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x38], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x1401553b8
mov rcx, qword [rbx + 0x40]
lea rax, str.LsaPolicy
mov r8b, 1
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x28], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
jne 0x1401553b8
mov rcx, qword [rbx + 0x40]
lea rax, str.LsaSecret
mov r8b, 1
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x18]
mov qword [rbp - 0x18], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x1401553b8
mov rcx, qword [rbx + 0x40]
lea rax, str.LsaTrusted
mov r8b, 1
mov qword [rbp], rax
lea rdx, [rbp - 8]
mov qword [rbp - 8], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x1401553b8
mov rcx, qword ds:[rbx + 0x40]
lea rax, str.SamAlias
mov r8b, 1
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 8]
mov qword [rbp + 8], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14015544b
mov rcx, qword [rbx + 0x40]
lea rax, str.SamDomain
mov r8b, 1
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0x18]
mov qword [rbp + 0x18], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14015544b
mov rcx, qword [rbx + 0x40]
lea rax, str.SamGroup
mov r8b, 1
mov qword [rbp + 0x30], rax
lea rdx, [rbp + 0x28]
mov qword [rbp + 0x28], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
jne 0x14015544b
mov rcx, qword [rbx + 0x40]
lea rax, str.SamServer
mov r8b, 1
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x38]
mov qword [rbp + 0x38], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14015544b
mov rcx, qword [rbx + 0x40]
lea rax, str.SamUser
mov r8b, 1
mov qword [rbp + 0x50], rax
lea rdx, [rbp + 0x48]
mov qword [rbp + 0x48], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14015544b
mov rcx, qword ds:[rbx + 0x40]
lea rax, str.TokenDefault
mov r8b, 1
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0x58]
mov qword [rbp + 0x58], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140154f95
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x70]
xor edi, edi
mov qword [rsp + 0x1b0], r12
mov qword [rsp + 0x70], rdi
lea edx, [rdi + 6]
call fcn.140113ba0
mov r12, qword [rsp + 0x70]
mov r14d, eax
test eax, eax
js 0x140154f66
mov rax, qword [r12]
test rax, rax
jne 0x140154ed2
mov r14d, 0xc0000079
jmp 0x140154f66
movzx ebx, word [rax + 2]
mov edx, 4
mov rcx, qword [0x140241998]
lea r8, [rbx + 0x28]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r8, [rbx + 0x28]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1401868c0
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov r8, qword [r12]
xor r9d, r9d
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x140241998]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140188690
mov rcx, qword [0x140241998]
mov r8, rsi
xor edx, edx
mov qword [r15], rbx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r12, r12
je 0x140154f7d
mov rcx, qword [0x140241998]
mov r8, r12
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
mov r12, qword [rsp + 0x1b0]
jmp 0x14015544b
mov rcx, qword [rbx + 0x40]
lea rax, str.PowerDefault
mov r8b, 1
mov qword [rbp + 0x70], rax
lea rdx, [rbp + 0x68]
mov qword [rbp + 0x68], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x1401550f3
lea rcx, [rsp + 0x78]
call fcn.140155e60
mov r14d, eax
test eax, eax
js 0x14015544b
mov qword [rsp + 0x1a8], r13
xor edi, edi
mov r13, qword [rsp + 0x78]
test r13, r13
je 0x140154ff7
mov rbx, qword [r13 + 8]
jmp 0x140154ffa
mov rbx, rdi
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x60], rdi
call fcn.140122400
test rax, rax
je 0x1401550bd
call fcn.140122400
lea r9, [rsp + 0x58]
mov edx, 1
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [case.0x1400f654f.0]
test eax, eax
je 0x1401550bd
mov ebx, dword [rsp + 0x58]
mov edx, 4
mov rcx, qword [0x140241998]
mov r8d, ebx
mov rdi, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.140188690
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x1401550bd
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x140241998]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140188690
mov rcx, qword [0x140241998]
mov r8, rsi
xor edx, edx
mov qword [r15], rbx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1401550c3
mov r14d, 0xc0000079
lea rcx, ds:[r13 - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
mov r13, qword [rsp + 0x1a8]
cmp eax, 1
jne 0x14015544b
call fcn.1400fbcc0
jmp 0x14015544b
mov rcx, qword [rbx + 0x40]
lea rax, str.RdpDefault
mov r8b, 1
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0x78]
mov qword [rbp + 0x78], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x1401552f0
xor edi, edi
mov dword [rbp + 0xf8], edi
call fcn.140156200
mov rcx, rax
test rax, rax
jne 0x140155148
mov r14d, 0xc0000135
jmp 0x14015544b
mov rax, qword [0x140241b80]
test rax, rax
jne 0x1401551ce
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401552d1
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401552d1
cmp dword [rdx + rcx], 0x4550
jne 0x1401552d1
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401552d1
nop dword [rax + rax]
cmp dword [rdx + 4], edi
je 0x1401552d1
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.WTSGetListenerSecurityW
call fcn.1400fa1a0
mov qword [0x140241b80], rax
test rax, rax
je 0x1401552d8
lea rcx, [rbp + 0xf8]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
lea r9, str.Rdp_Tcp
mov dword [rsp + 0x30], edi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], 0xc
call qword [case.0x1400f654f.0]
nop
test eax, eax
jne 0x1401552e5
mov eax, dword [rbp + 0xf8]
test eax, eax
je 0x1401552e5
mov rcx, qword [0x140241998]
mov r8d, eax
mov edx, 4
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1401868c0
mov ecx, dword [rbp + 0xf8]
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x38], rax
lea r9, str.Rdp_Tcp
mov rax, qword [0x140241b80]
xor r8d, r8d
mov dword [rsp + 0x30], ecx
xor edx, edx
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov dword [rsp + 0x20], 0xc
call qword [case.0x1400f654f.0]
test eax, eax
je 0x1401552e5
mov rcx, rsi
mov r14d, edi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x140241998]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140188690
mov rcx, qword [0x140241998]
mov r8, rsi
xor edx, edx
mov qword [r15], rbx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14015544b
mov qword [0x140241b80], rdi
mov r14d, 0xc000007a
jmp 0x14015544b
mov r14d, 0xc0000079
jmp 0x14015544b
mov rcx, qword [rbx + 0x40]
lea rax, str.WmiDefault
mov r8b, 1
mov qword [rbp + 0x90], rax
lea rdx, [rbp + 0x88]
mov qword [rbp + 0x88], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x140155391
lea rcx, [rbp - 0x80]
call fcn.140156400
mov r14d, eax
test eax, eax
js 0x14015544b
mov rsi, qword [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x140241998]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140188690
mov rcx, qword [0x140241998]
mov r8, rsi
xor edx, edx
mov qword [r15], rbx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14015544b
mov rcx, qword ds:[rsp + 0x50]
mov r8, r15
mov edx, edi
call sym.ProcessHacker.exe_PhGetObjectSecurity
mov rcx, qword [rsp + 0x50]
mov r14d, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14015544b
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x68]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_LsaQuerySecurityObject]
mov r14d, eax
test eax, eax
js 0x140155417
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x140241998]
mov edx, 4
mov rsi, qword [rsp + 0x68]
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140188690
mov rcx, qword [rsp + 0x68]
mov qword [r15], rbx
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword ds:[rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x14015544b
mov rcx, qword [rsp + 0x50]
mov r9, r15
mov r8d, edi
mov edx, 2
call sym.ProcessHacker.exe_PhGetSeObjectSecurity
mov rcx, qword [rsp + 0x50]
mov r14d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x1e0]
mov eax, r14d
mov r14, qword [rsp + 0x1a0]
add rsp, 0x1b8
pop r15
pop rdi
pop rbx
pop rbp
ret