Function at 0x14018e840
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
push r12
push r13
sub rsp, 0x78
mov r13, r8
mov r9d, edx
mov r12, rcx
test r8, r8
jne 0x14018e868
mov eax, 0xc0000001
add rsp, 0x78
pop r13
pop r12
ret
mov eax, r9d
mov qword [rsp + 0x50], r15
and al, 0x13
neg al
mov eax, 0x10c0000
sbb ecx, ecx
and ecx, 0x80000
mov r8d, ecx
bts r8d, 0x12
test r9d, 0xa0000024
cmove r8d, ecx
lea rcx, [rsp + 0x40]
mov edx, r8d
bts edx, 0x18
test r9d, 0x50000048
cmove edx, r8d
mov r8, qword [r13 + 0x78]
bt r9d, 0x10
cmovb edx, eax
mov rax, qword [r13 + 0x58]
call qword [case.0x14013b5a0.0]
mov r15d, eax
lfence
test eax, eax
js 0x14018eba8
mov qword ss:[rsp + 0x90], rbx
mov qword ss:[rsp + 0x70], rbp
mov qword [rsp + 0x68], rsi
mov rsi, qword [r13 + 0x50]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r14
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14018e9ba
mov rsi, qword ds:[rsi + 8]
lea r14, str.Service
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018e956
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018e9ab
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018e930
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018ea66
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x14018e997
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018e9ba
add rsi, 2
sub rdi, 1
jne 0x14018e970
jmp 0x14018ea66
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018e95f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018eacb
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SCManager
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ea1a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018ea92
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018e9f0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018ea66
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018ea58
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018eacb
add rsi, 2
sub rdi, 1
jne 0x14018ea30
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
test eax, eax
je 0x14018eaa5
mov rcx, qword [rsp + 0x40]
xor r15d, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14018eb89
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ea23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov rcx, qword ds:[rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14018eb89
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 8
jne 0x14018ebc8
mov rsi, qword [rsi + 8]
lea rbp, [0x14026a2f0]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018eb1d
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018ebb6
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018eaf3
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018eb66
sub rbp, rsi
nop
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018eb58
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018ebc8
add rsi, 2
sub rdi, 1
jne 0x14018eb30
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov r15d, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rsp + 0x58]
mov eax, r15d
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
add rsp, 0x78
pop r13
pop r12
ret
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018eb26
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018ec7a
mov rsi, qword [rsi + 8]
lea rbp, str.FileObject
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ec16
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018ec6b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018ebf0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018eb66
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018ec58
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018ec7a
add rsi, 2
sub rdi, 1
jne 0x14018ec30
jmp 0x14018eb66
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ec1f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018ed3a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaAccount
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ecd6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018ed2b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018ecb0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018ef66
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018ed18
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018ed3a
add rsi, 2
sub rdi, 1
jne 0x14018ecf0
jmp 0x14018ef66
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ecdf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018edfa
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaPolicy
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ed96
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018edeb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018ed70
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018ef66
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018edd8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018edfa
add rsi, 2
sub rdi, 1
jne 0x14018edb0
jmp 0x14018ef66
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ed9f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018eeba
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaSecret
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ee56
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018eeab
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018ee30
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018ef66
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018ee98
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018eeba
add rsi, 2
sub rdi, 1
jne 0x14018ee70
jmp 0x14018ef66
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ee5f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018ef9d
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaTrusted
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ef1a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018ef8e
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018eef0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018ef66
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018ef58
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018ef9d
add rsi, 2
sub rdi, 1
jne 0x14018ef30
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_LsaSetSecurityObject]
mov rcx, qword [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x14018eb89
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ef23
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14018f05a
mov rsi, qword [rsi + 8]
lea rbp, str.SamAlias
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018eff6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018f04b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018efd0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018eb89
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018f038
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018f05a
add rsi, 2
sub rdi, 1
jne 0x14018f010
jmp 0x14018eb89
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018efff
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018f11a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamDomain
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018f0b6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018f10b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018f090
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018eb89
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018f0f8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018f11a
add rsi, 2
sub rdi, 1
jne 0x14018f0d0
jmp 0x14018eb89
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018f0bf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14018f1da
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamGroup
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018f176
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018f1cb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018f150
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018eb89
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018f1b8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018f1da
add rsi, 2
sub rdi, 1
jne 0x14018f190
jmp 0x14018eb89
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018f17f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018f29a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamServer
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018f236
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018f28b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018f210
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018eb89
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018f278
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018f29a
add rsi, 2
sub rdi, 1
jne 0x14018f250
jmp 0x14018eb89
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018f23f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14018f35a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamUser
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018f2f6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018f34b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018f2d0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018eb89
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018f338
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018f35a
add rsi, 2
sub rdi, 1
jne 0x14018f310
jmp 0x14018eb89
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018f2ff
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14018f497
mov rsi, qword ds:[rsi + 8]
lea rbp, str.TokenDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018f3ba
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018f47a
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018f390
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018f406
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018f3fc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018f497
add rsi, 2
sub rdi, 1
jne 0x14018f3d0
xor r15d, r15d
mov byte [rsp + 0xa8], 0
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x48]
mov byte [rsp + 0xa0], 0
lea rdx, [rsp + 0xa8]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
nop dword [rax]
test eax, eax
js 0x14018eb7b
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14018f48c
mov rcx, qword [rsp + 0x40]
lea r9d, [r15 + 8]
lea r8, [rsp + 0xa0]
mov qword [rsp + 0xa0], rax
lea edx, [r15 + 6]
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
jmp 0x14018eb7b
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018f3c3
mov r15d, 0xc0000079
jmp 0x14018eb7e
mov rsi, qword ds:[r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14018f5e5
mov rsi, qword ds:[rsi + 8]
lea rbp, str.PowerDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018f4fa
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018f5d3
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018f4d0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018f546
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018f53c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018f5e5
add rsi, 2
sub rdi, 1
jne 0x14018f510
call fcn.140185b00
mov rdx, rax
mov r8b, 1
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
lea rdx, [0x140241ef0]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov edx, 0x1100
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetControlSecurityDescriptor]
mov rdx, r12
mov ecx, 0xf
call fcn.140139820
mov rbx, rax
test rax, rax
je 0x14018eb89
mov rcx, rax
call fcn.14017d280
mov r15d, eax
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14018eb89
call fcn.14013fb00
jmp 0x14018eb89
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018f503
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018f772
mov rsi, qword [rsi + 8]
lea rbp, str.RdpDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018f63a
nop dword [rax]
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018f707
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018f610
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018f686
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018f67c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018f772
add rsi, 2
sub rdi, 1
jne 0x14018f650
mov rax, qword [0x1402c5218]
xor r15d, r15d
test rax, rax
jne 0x14018f73e
call fcn.14017cfe0
nop
test rax, rax
je 0x14018f733
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14018f719
mov edx, dword ds:[rax + 0x3c]
lea ecx, [rdx - 1]
cmp ecx, 0x7ffffffd
ja 0x14018f719
cmp dword [rdx + rax], 0x4550
jne 0x14018f719
add rdx, 0x88
add rdx, rax
mov ecx, dword [rdx]
test ecx, ecx
je 0x14018f719
cmp dword [rdx + 4], r15d
je 0x14018f719
lea r8, ds:[rax + rcx]
mov word [rsp + 0x20], r15w
mov rcx, rax
lea r9, str.WTSSetListenerSecurityW
call fcn.140177a80
jmp 0x14018f71c
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018f643
mov rax, r15
mov qword [0x1402c5218], rax
test rax, rax
jne 0x14018f73e
mov r15d, 0xc000007a
jmp 0x14018eb89
mov r15d, 0xc0000135
jmp 0x14018eb89
mov qword [rsp + 0x28], r12
lea r9, str.RDP_Tcp
xor r8d, r8d
mov dword [rsp + 0x20], 0xc
xor edx, edx
xor ecx, ecx
call qword [case.0x14013b5a0.0]
test eax, eax
mov ecx, 0xc0000079
cmovne ecx, r15d
mov r15d, ecx
jmp 0x14018eb89
mov rdi, qword ds:[r13 + 0x50]
mov rsi, qword [rdi]
cmp rsi, 0x14
jne 0x14018eb66
mov rdi, qword ds:[rdi + 8]
lea r14, str.WmiDefault
mov rcx, rsi
shr rcx, 4
test rcx, rcx
je 0x14018f7da
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018f85c
add rdi, 0x10
add r14, 0x10
sub rcx, 1
jne 0x14018f7b0
shr rsi, 1
and esi, 7
test rsi, rsi
je 0x14018f826
sub r14, rdi
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx ebp, word [r14 + rdi]
cmp cx, bp
je 0x14018f81b
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018eb66
add rdi, 2
sub rsi, 1
jne 0x14018f7f0
call fcn.140185b00
mov r8b, 1
mov rdx, rax
mov rcx, r12
mov rbx, rax
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov rcx, r12
call fcn.14017d7c0
mov r15d, eax
jmp 0x14018eb89
and esi, 0xf
shl rcx, 4
add rsi, rcx
shr rsi, 1
jmp 0x14018f7e0