Function at 0x140155480
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
push rdi
push r14
lea rbp, [rsp - 0xb8]
sub rsp, 0x1b8
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rdi, r8
mov r14d, edx
mov rsi, rcx
test r8, r8
jne 0x1401554be
mov eax, 0xc0000001
jmp 0x140155b55
mov r8, qword [r8 + 0x58]
mov eax, r14d
and al, 0x13
mov qword [rsp + 0x1b0], rbx
neg al
mov eax, r14d
sbb ecx, ecx
and ecx, 0x80000
mov edx, ecx
bts edx, 0x12
and eax, 0xa0000024
mov eax, r14d
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
and eax, 0x50000048
mov eax, 0x10c0000
cmove ecx, edx
bt r14d, 0x10
cmovb ecx, eax
mov rax, qword [rdi + 0x48]
mov edx, ecx
lea rcx, [rsp + 0x48]
call qword [case.0x1400f654f.0]
mov ebx, eax
lfence
test eax, eax
js 0x140155b4d
mov rcx, qword [rdi + 0x40]
lea rax, str.Service
mov r8b, 1
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x140155b29
mov rcx, qword [rdi + 0x40]
lea rax, str.SCManager
mov r8b, 1
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
jne 0x140155b29
mov rcx, qword [rdi + 0x40]
lea rax, [0x1401dbaf8]
mov r8b, 1
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1401555d8
mov rcx, qword ds:[rsp + 0x48]
mov r8, rsi
mov edx, r14d
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140155b4b
mov rcx, qword [rdi + 0x40]
lea rax, str.FileObject
mov r8b, 1
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14015562b
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov r8d, r14d
mov edx, 1
call sym.ProcessHacker.exe_PhSetSeObjectSecurity
mov rcx, qword ds:[rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140155b4b
mov rcx, qword [rdi + 0x40]
lea rax, str.LsaAccount
mov r8b, 1
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x140155b09
mov rcx, qword [rdi + 0x40]
lea rax, str.LsaPolicy
mov r8b, 1
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
jne 0x140155b09
mov rcx, qword [rdi + 0x40]
lea rax, str.LsaSecret
mov r8b, 1
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x40], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x140155b09
mov rcx, qword [rdi + 0x40]
lea rax, str.LsaTrusted
mov r8b, 1
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x30], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x140155b09
mov rcx, qword ds:[rdi + 0x40]
lea rax, str.SamAlias
mov r8b, 1
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x140155b4b
mov rcx, qword [rdi + 0x40]
lea rax, str.SamDomain
mov r8b, 1
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x140155b4b
mov rcx, qword [rdi + 0x40]
lea rax, str.SamGroup
mov r8b, 1
mov qword [rbp + 8], rax
lea rdx, [rbp]
mov qword [rbp], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
jne 0x140155b4b
mov rcx, qword [rdi + 0x40]
lea rax, str.SamServer
mov r8b, 1
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x140155b4b
mov rcx, qword [rdi + 0x40]
lea rax, str.SamUser
mov r8b, 1
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x20], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x140155b4b
mov rcx, qword ds:[rdi + 0x40]
lea rax, str.TokenDefault
mov r8b, 1
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x30], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14015586c
xor edi, edi
mov byte [rsp + 0x41], 0
lea r9, [rsp + 0x40]
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
mov byte [rsp + 0x40], 0
lea rdx, [rsp + 0x41]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
mov ebx, eax
test eax, eax
js 0x14015585c
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x14015583b
mov rcx, qword [rsp + 0x48]
mov ebx, 0xc0000079
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140155b4b
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x58]
mov r9d, 8
mov qword [rsp + 0x58], rax
lea edx, [r9 - 2]
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140155b4b
mov rcx, qword [rdi + 0x40]
lea rax, str.PowerDefault
mov r8b, 1
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x40], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14015596a
mov r8b, 2
mov dword [rbp + 0x78], 0
lea rdx, [rbp + 0x78]
mov word [rbp + 0x7c], 0x500
lea rcx, [rbp + 0x90]
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rbp + 0x90]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rbp + 0x90]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov r8b, 1
lea rdx, [rbp + 0x90]
mov rcx, rsi
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
lea rdx, [0x140238018]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov edx, 0x1100
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetControlSecurityDescriptor]
mov rdx, rsi
mov ecx, 0xf
call fcn.1401113a0
mov rdi, rax
test rax, rax
je 0x140155b4b
mov rcx, rax
call fcn.140156040
mov ebx, eax
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140155b4b
nop
call fcn.1400fbcc0
jmp 0x140155b4b
mov rcx, qword [rdi + 0x40]
lea rax, str.RdpDefault
mov r8b, 1
mov qword [rbp + 0x58], rax
lea rdx, [rbp + 0x50]
mov qword [rbp + 0x50], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140155a59
call fcn.140156200
mov rcx, rax
test rax, rax
jne 0x1401559af
mov ebx, 0xc0000135
jmp 0x140155b4b
mov rax, qword [0x140241ba0]
xor edi, edi
test rax, rax
jne 0x140155a18
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140155a48
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140155a48
cmp dword ds:[rdx + rcx], 0x4550
jne 0x140155a48
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140155a48
cmp dword [rdx + 4], edi
je 0x140155a48
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.WTSSetListenerSecurityW
call fcn.1400fa1a0
mov qword [0x140241ba0], rax
test rax, rax
je 0x140155a4f
mov qword [rsp + 0x28], rsi
lea r9, str.RDP_Tcp
xor r8d, r8d
mov dword [rsp + 0x20], 0xc
xor edx, edx
xor ecx, ecx
call qword [case.0x1400f654f.0]
test eax, eax
mov ebx, 0xc0000079
cmovne ebx, edi
jmp 0x140155b4b
mov qword [0x140241ba0], rdi
mov ebx, 0xc000007a
jmp 0x140155b4b
mov rcx, qword [rdi + 0x40]
lea rax, str.WmiDefault
mov r8b, 1
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x60]
mov qword [rbp + 0x60], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x1401555af
mov r8b, 2
mov dword [rbp + 0x70], 0
lea rdx, [rbp + 0x70]
mov word [rbp + 0x74], 0x500
lea rcx, [rbp + 0x80]
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rbp + 0x80]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rbp + 0x80]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov r8b, 1
lea rdx, [rbp + 0x80]
mov rcx, rsi
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
lea rdx, [rbp + 0x80]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov rcx, rsi
call fcn.1401567a0
mov ebx, eax
jmp 0x140155b4b
mov rcx, qword [rsp + 0x48]
mov r8, rsi
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_LsaSetSecurityObject]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x140155b4b
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov r8d, r14d
mov edx, 2
call sym.ProcessHacker.exe_PhSetSeObjectSecurity
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x1b0]
mov rcx, qword ds:[rbp + 0xa0]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x1b8
pop r14
pop rdi
pop rsi
pop rbp
ret