Function at 0x140011000
Capabilities:
Get user security identifier
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
vminpd xmm10, xmm0, xmmword [rbp + 0x108682cc]
cdq
fst qword [rbx - 0x396dc69]
mov dl, 0xf6
int3
invalid
jle 0x14001000c
xor dh, dh
stosb byte [rdi], al
outsb dx, byte [rsi]
mov edx, 0x1bbffbc5
dec byte [rbx - 0x21]
invalid
sti
and edx, dword [rbx - 0x24]
lodsd eax, dword [rsi]
mov eax, 0xa9bdc2c3
jg 0x140010066
invalid
invalid
test eax, 0x3e389c98
lea edi, [rdx + 0x412de9a5]
ret 0x2206
and al, byte [rdx + 0x31008282]
fnstcw word [rcx - 0x6262629e]
cdq
invalid
invalid
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
mov eax, 0x3b88
call fcn.140019310
sub rsp, 0x3b88
mov r12, rdx
mov ebx, ecx
xor edx, edx
mov ecx, 3
movaps xmmword [rsp + 0x3b60], xmm7
call fcn.140017a80
stmxcsr dword [rsp + 0x40]
xor r14d, r14d
mov edx, 0x400
or dword [rsp + 0x40], 0x8040
pxor xmm7, xmm7
ldmxcsr dword [rsp + 0x40]
movsxd r8, ebx
xor ebx, ebx
movaps xmmword [rsp + rdx + 0x3330], xmm7
movaps xmmword [rsp + rdx + 0x3320], xmm7
movaps xmmword [rsp + rdx + 0x3310], xmm7
movaps xmmword [rsp + rdx + 0x3300], xmm7
sub rdx, 0x40
jne 0x140011059
movaps xmmword [rsp + 0x3b70], xmm7
xor r13b, r13b
xor r15d, r15d
mov edx, 0x400
movaps xmmword [rsp + rdx + 0x3730], xmm7
movaps xmmword [rsp + rdx + 0x3720], xmm7
movaps xmmword [rsp + rdx + 0x3710], xmm7
movaps xmmword [rsp + rdx + 0x3700], xmm7
sub rdx, 0x40
jne 0x140011092
xor sil, sil
xor r10d, r10d
mov r11d, 1
cmp r8, 1
jle 0x1400110f1
lea r9, [r8 - 1]
mov rdi, qword [r12 + r11*8]
mov dl, byte [rdi]
and dl, 0xfd
cmp dl, 0x2d
je 0x140013a7e
inc r11
cmp r11, r8
jl 0x1400110ce
test sil, sil
jne 0x14001276d
mov rdx, qword [0x1400352a0]
test rdx, rdx
mov qword [rsp + 0x60], rdx
je 0x140011272
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14001112e
mov rax, rdx
add rdx, rcx
call fcn.140017e80
cmp rax, 3
jbe 0x14001114a
mov rdx, qword [rsp + 0x60]
movzx ecx, byte [rdx]
call fcn.140019558
cmp eax, 0x43
je 0x140012947
xor r14d, r14d
mov r11d, 0x5c
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x3b58], 0x400
mov dword [rsp + 0x3b5c], 0x3e8
mov dword [rsp + 0x3b80], 0x10
mov rcx, rax
and ecx, 0xf
and rax, 0xfffffffffffffff0
pxor xmm2, xmm2
movd xmm1, r11d
punpcklbw xmm1, xmm1
punpcklbw xmm1, xmm1
pshufd xmm1, xmm1, 0
movdqa xmm0, xmmword [rax]
pcmpeqb xmm2, xmm0
pcmpeqb xmm0, xmm1
pmovmskb r11d, xmm0
pmovmskb r10d, xmm2
shr r11d, cl
shr r10d, cl
test r11d, r11d
jne 0x1400111c1
test r10d, r10d
je 0x1400111dc
jmp 0x1400111d8
bsf r11d, r11d
bsf r10d, r10d
je 0x1400111d0
cmp r11d, r10d
jg 0x1400111d8
add rax, rcx
add rax, r11
jmp 0x1400111e1
xor eax, eax
jmp 0x1400111e1
call fcn.140017eb0
test rax, rax
je 0x1400135c8
mov rdi, rsp
lea rsi, [rsp + 0x3b58]
mov edx, 2
mov r8d, 1
lea r9, [rsp + 0x27a4]
mov qword [rdi + 0x20], rsi
mov rcx, qword [rsp + 0x60]
call sub.Secur32.dll_TranslateNameA
test al, al
je 0x1400135ba
lea rdx, [rsp + 0x3740]
lea rcx, [rsp + 0x27a4]
test cl, 3
je 0x140011246
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14001124b
inc rdx
test cl, 3
jne 0x140011233
call fcn.140017ef0
test r14d, r14d
je 0x140011263
lea rdx, str.GetDNForUser
mov qword [0x1400352b0], rdx
jmp 0x140012778
lea rax, [rsp + 0x3740]
mov qword [0x1400352a0], rax
xor ecx, ecx
mov edx, 0x185
call qword [sym.imp.WLDAP32.dll_Ordinal_25]
mov r10, rax
test r10, r10
jne 0x140012c7e
call qword [sym.imp.WLDAP32.dll_Ordinal_16]
mov ebx, eax
test ebx, ebx
je 0x1400112aa
lea rdx, str.GetSchemaMasterDNSName
mov qword [0x1400352b0], rdx
jmp 0x140012730
cmp dword [0x1400352c0], 0
je 0x1400112c7
lea rcx, str.Schema_Master_DNS_name_is__s_n
lea rdx, [rsp + 0x3340]
call fcn.140019590
mov r8d, reloc.WLDAP32.dll_Ordinal_16
lea rax, [rsp + 0x3b70]
lea rdx, [rsp + 0x3340]
test r8d, r8d
je 0x140011315
test dl, 3
je 0x1400112ff
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x140011304
mov byte [rax], cl
inc rax
dec r8d
je 0x140011315
test dl, 3
jne 0x1400112e7
call fcn.140018050
test r8, r8
je 0x140011315
xor cl, cl
mov byte [rax], cl
inc rax
dec r8
jne 0x14001130b
mov r11d, reloc.WLDAP32.dll_Ordinal_46
lea rax, [rsp + 0x3b70]
mov rcx, rax
and ecx, 0xf
and rax, 0xfffffffffffffff0
pxor xmm2, xmm2
movd xmm1, r11d
punpcklbw xmm1, xmm1
punpcklbw xmm1, xmm1
pshufd xmm1, xmm1, 0
movdqa xmm0, xmmword [rax]
pcmpeqb xmm2, xmm0
pcmpeqb xmm0, xmm1
pmovmskb r11d, xmm0
pmovmskb r10d, xmm2
shr r11d, cl
shr r10d, cl
test r11d, r11d
jne 0x14001136b
test r10d, r10d
je 0x140011386
jmp 0x140011382
bsf r11d, r11d
bsf r10d, r10d
je 0x14001137a
cmp r11d, r10d
jg 0x140011382
add rax, rcx
add rax, r11
jmp 0x14001138b
xor eax, eax
jmp 0x14001138b
call fcn.140017eb0
test rax, rax
je 0x140011393
mov byte [rax], 0
mov esi, 0x5c5c
lea rax, [rsp + 0x2c10]
mov dword [rax + 0xf40], 4
lea rdx, [rsp + 0x3b70]
mov word [rax], si
mov byte [rax + 2], 0
call fcn.140018200
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x2c10]
lea r8, [rsp + 0x3b40]
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
mov r14d, eax
test r14d, r14d
jne 0x140011499
mov r10, rsp
lea rdx, str.SystemCurrentControlSetServicesNTDSParameters
mov rcx, qword [rsp + 0x3b40]
xor r8d, r8d
mov r9d, 0x20019
lea rdi, [rsp + 0x3320]
mov qword [r10 + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r14d, eax
test r14d, r14d
jne 0x14001148b
mov r11, rsp
lea rdx, str.Schema_Update_Allowed
mov rcx, qword [rsp + 0x3320]
xor r8d, r8d
lea r9, [rsp + 0x267c]
lea rdi, [rsp + 0x2ba4]
mov qword [r11 + 0x20], rdi
lea r10, [rsp + 0x3b50]
mov qword [r11 + 0x28], r10
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r14d, eax
test r14d, r14d
jne 0x140011470
mov ebp, dword [rsp + 0x2ba4]
xor edx, edx
cmp ebp, 1
cmovne ebp, edx
jmp 0x14001147d
xor edx, edx
cmp r14d, 2
cmove r14d, edx
cmove ebp, edx
mov rcx, qword [rsp + 0x3320]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x3b40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
je 0x1400114b1
lea rdx, str.IsSchemaMasterWritable
mov qword [0x1400352b0], rdx
jmp 0x140012730
cmp dword [0x1400352c0], 0
je 0x1400114cf
test ebp, ebp
je 0x1400114d7
lea rcx, str.The_Schema_Master_is_writable.
call fcn.14001963c
jmp 0x1400115d0
test ebp, ebp
jne 0x1400115d0
mov dword [rsp + 0x333c], 1
lea rax, [rsp + 0x26a0]
mov word [rax], si
lea rdx, [rsp + 0x3b70]
mov byte [rax + 2], 0
call fcn.140018200
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x26a0]
lea r8, [rsp + 0x3330]
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
mov r14d, eax
test r14d, r14d
jne 0x1400115af
mov rsi, rsp
lea rdx, str.SystemCurrentControlSetServicesNTDSParameters
mov rcx, qword [rsp + 0x3330]
xor r8d, r8d
mov r9d, 0x2001f
lea rbp, [rsp + 0x3118]
mov qword [rsi + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r14d, eax
test r14d, r14d
jne 0x1400115a1
mov rsi, rsp
lea rdx, str.Schema_Update_Allowed
mov rcx, qword [rsp + 0x3118]
xor r8d, r8d
mov r9d, 4
lea rbp, [rsp + 0x333c]
mov qword [rsi + 0x20], rbp
mov dword [rsi + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r14d, eax
mov rcx, qword [rsp + 0x3118]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x3330]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
jne 0x140012722
mov r13b, 1
cmp dword [0x1400352c0], 0
je 0x1400115d0
lea rcx, str.Set_the_Schema_Master_to_writable.
call fcn.14001963c
mov edx, 0x185
lea rcx, [rsp + 0x3340]
call qword [sym.imp.WLDAP32.dll_Ordinal_25]
mov rbp, rax
test rbp, rbp
je 0x140012c4d
mov rdx, qword [0x1400352a0]
test rdx, rdx
je 0x140012c34
mov r8, qword [0x1400352a8]
mov rcx, rbp
call qword [sym.imp.WLDAP32.dll_Ordinal_60]
mov ebx, eax
test ebx, ebx
jne 0x14001161a
mov r15, rbp
jmp 0x140011623
mov rcx, rbp
call qword [sym.imp.WLDAP32.dll_Ordinal_46]
test ebx, ebx
je 0x14001163a
lea rdx, str.BindToSchemaMaster
mov qword [0x1400352b0], rdx
jmp 0x140012730
cmp dword [0x1400352c0], 0
je 0x14001164f
lea rcx, str.Bind_to_the_Schema_Master_successfully.
call fcn.14001963c
xor ebp, ebp
xor sil, sil
mov qword [rsp + 0x3308], 0
movaps xmmword [rsp + 0x3130], xmm7
mov r10, rsp
mov rcx, r15
lea rdx, [0x1400346a0]
xor r8d, r8d
lea r9, str._objectClass_
lea rdi, str.allowedChildClassesEffective
mov qword [rsp + 0x3130], rdi
lea rax, [rsp + 0x3130]
mov qword [r10 + 0x20], rax
lea rbx, [rsp + 0x3308]
mov dword [r10 + 0x28], 0
mov qword [r10 + 0x30], rbx
call qword [sym.imp.WLDAP32.dll_Ordinal_50]
mov rdx, qword [rsp + 0x3308]
test rdx, rdx
je 0x14001179b
mov rcx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
mov rbx, rax
test rbx, rbx
je 0x14001179b
mov rcx, r15
mov rdx, rbx
lea r8, [rsp + 0x3318]
call qword [sym.imp.WLDAP32.dll_Ordinal_32]
test rax, rax
je 0x140011780
mov dword [rsp + 0x1010], r14d
mov rcx, rax
mov qword [rsp + 0x1008], r12
mov r12b, sil
mov r14b, r13b
mov r13, rdi
mov rdi, rcx
mov rsi, r13
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x14001173b
test dl, dl
je 0x140011737
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x14001173b
add rdi, 2
add rsi, 2
test dl, dl
jne 0x140011719
xor eax, eax
jmp 0x140011740
sbb eax, eax
or eax, 1
test eax, eax
je 0x14001398e
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r8, qword [rsp + 0x3318]
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.WLDAP32.dll_Ordinal_33]
mov rcx, rax
test rcx, rcx
jne 0x140011713
mov sil, r12b
mov r13b, r14b
mov r14d, dword [rsp + 0x1010]
mov r12, qword [rsp + 0x1008]
mov rcx, qword [rsp + 0x3308]
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
test sil, sil
je 0x14001179b
test ebp, ebp
je 0x14001179b
mov al, 1
jmp 0x14001179d
xor al, al
cmp dword [0x1400352c0], 0
je 0x1400117bc
test al, al
je 0x14001270d
lea rcx, str.Have_rights_to_extend_the_schema.
call fcn.14001963c
jmp 0x1400117c4
test al, al
je 0x14001270d
cmp dword [0x1400352c8], 0
je 0x140011aca
mov byte [rsp + 0x710], r13b
mov bpl, 2
mov dword [rsp + 0x1010], r14d
mov edi, 0x1e0
mov qword [rsp + 0x1008], r12
lea rsi, [rsp + 0x3310]
xor r14d, r14d
lea r13, [0x140010000]
lea rcx, [rsp + 0x1408]
lea rdx, str._objectClass_s_
mov ebx, r14d
mov r8, qword [r13 + rdi + 0x22840]
mov qword [rcx + 0x1f08], 0
call fcn.1400197b8
mov r10, rsp
mov rcx, r15
lea rdx, [0x140034aa0]
mov r8d, 2
lea r9, [rsp + 0x1408]
mov qword [r10 + 0x20], 0
mov dword [r10 + 0x28], 0
mov qword [r10 + 0x30], rsi
call qword [sym.imp.WLDAP32.dll_Ordinal_50]
mov rdx, qword [rsp + 0x3310]
test rdx, rdx
je 0x140011923
mov rcx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
test rax, rax
je 0x140011911
mov rcx, r15
mov rdx, rax
call qword [sym.imp.WLDAP32.dll_Ordinal_30]
mov r12, rax
cmp dword [0x1400352c0], 0
je 0x1400118b4
lea rcx, str.Class__s_in_use_by_object__s_n
mov r8, r12
mov rdx, qword [r13 + rdi + 0x22840]
call fcn.140019590
cmp dword [0x1400352c4], 0
je 0x1400118e5
cmp dword [0x1400352c0], 0
je 0x1400118d5
lea rcx, str.Delete_object__s_n
mov rdx, r12
call fcn.140019590
mov rcx, r15
mov rdx, r12
call qword [sym.imp.WLDAP32.dll_Ordinal_47]
mov ebx, eax
jmp 0x1400118ea
mov ebx, 0x35
mov rcx, r12
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
test ebx, ebx
jne 0x140011911
mov rdx, qword [rsp + 0x3310]
mov rcx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_27]
test rax, rax
jne 0x140011885
mov rcx, qword [rsp + 0x3310]
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
test ebx, ebx
jne 0x140011959
lea rdx, str.CN_s__s
lea rcx, [rsp + 0x1408]
lea r9, [0x1400346a0]
mov r8, qword [r13 + rdi + 0x22840]
call fcn.1400197b8
mov rcx, r15
lea rdx, [rsp + 0x1408]
call qword [sym.imp.WLDAP32.dll_Ordinal_47]
mov ebx, eax
cmp dword [0x1400352c0], 0
je 0x140011980
test ebx, ebx
jne 0x14001297a
lea rcx, str.Delete_class__s_successful_n
mov rdx, qword [r13 + rdi + 0x22840]
call fcn.140019590
jmp 0x1400119d1
test ebx, ebx
je 0x1400119d1
cmp ebx, 0x20
je 0x1400119d1
mov r8, qword [r13 + rdi + 0x22840]
lea rdx, str.DeleteClass
mov qword [0x1400352b0], rdx
mov qword [0x1400352b8], r8
cmp dword [0x1400352c4], 0
je 0x14001299e
mov ecx, ebx
call qword [sym.imp.WLDAP32.dll_Ordinal_22]
lea rcx, str._s_:__s_n
mov r8, rax
mov rdx, qword [0x1400352b8]
call fcn.140019590
add rdi, 0xffffffffffffff10
add bpl, 0xff
jns 0x140011803
mov sil, Ordinal_22
mov r13b, byte [rsp + 0x710]
mov ebp, 0x7e0
mov r14d, dword [rsp + 0x1010]
xor edi, edi
lea r12, [0x140010000]
lea rcx, [rsp + 0x1c60]
lea rdx, str.CN_s__s
lea r9, [0x1400346a0]
mov r8, qword [r12 + rbp + 0x22000]
call fcn.1400197b8
mov rcx, r15
lea rdx, [rsp + 0x1c60]
call qword [sym.imp.WLDAP32.dll_Ordinal_47]
mov ebx, eax
cmp dword [0x1400352c0], 0
je 0x140011a60
test ebx, ebx
jne 0x1400129bb
lea rcx, str.Delete_attribute__s_successful_n
mov rdx, qword [r12 + rbp + 0x22000]
call fcn.140019590
jmp 0x140011aaf
test ebx, ebx
je 0x140011aaf
cmp ebx, 0x20
je 0x140011aad
mov r10, qword [r12 + rbp + 0x22000]
lea rdx, str.DeleteAttribute
mov qword [0x1400352b0], rdx
mov qword [0x1400352b8], r10
cmp dword [0x1400352c4], 0
je 0x140011abd
mov ecx, ebx
call qword [sym.imp.WLDAP32.dll_Ordinal_22]
lea rcx, str._s_:__s_n
mov r8, rax
mov rdx, qword [0x1400352b8]
call fcn.140019590
mov ebx, edi
add rbp, 0xffffffffffffffa0
add sil, 0xff
jns 0x140011a03
mov r12, qword [rsp + 0x1008]
jmp 0x140012730
xor al, al
xor ebp, ebp
mov byte [rsp + 0x710], r13b
lea rbx, [rsp + 0x3140]
mov dword [rbx - 0x2130], r14d
lea rdi, [rsp + 0x3158]
mov qword [rbx - 0x2138], r12
lea rsi, [rsp + 0x3170]
mov r12b, al
xor r13d, r13d
lea r14, [0x140010000]
movaps xmmword [rsp + 0x2bb0], xmm7
movaps xmmword [rsp + 0x2bc0], xmm7
movaps xmmword [rsp + 0x2bd0], xmm7
movaps xmmword [rsp + 0x2be0], xmm7
movaps xmmword [rsp + 0x2bf0], xmm7
movaps xmmword [rsp + 0x2c00], xmm7
lea r9, [0x1400346a0]
lea rdx, [rsp + 0x3258]
mov qword [rdx - 0xf0], rdx
lea rdx, str.attributeID
mov qword [rsp + 0x31a8], rdx
lea r8, [rsp + 0x31b8]
mov rdx, qword [r14 + rbp + 0x22018]
lea rcx, [rsp + 0x2060]
mov qword [rcx + 0x1208], rdx
lea rdx, [rsp + 0x3268]
mov qword [rdx - 0xb8], rdx
lea rdx, str.schemaIDGUID
mov qword [rcx + 0x1160], rdx
lea rdx, [r14 + rbp + 0x22020]
mov qword [rcx + 0x1220], rdx
lea rdx, [rsp + 0x3278]
mov qword [rdx + 0x10], rdx
lea rdx, [rsp + 0x3288]
mov qword [rdx - 0xc0], rdx
lea rdx, str.attributeSyntax
mov qword [rcx + 0x1178], rdx
lea r10, [rsp + 0x3188]
mov rdx, qword [r14 + rbp + 0x22030]
lea r11, [rsp + 0x31a0]
mov qword [rcx + 0x1238], rdx
lea rdx, [rsp + 0x3298]
mov qword [rdx - 0xb8], rdx
lea rdx, str.oMSyntax
mov qword [rcx + 0x1190], rdx
mov rdx, qword [r14 + rbp + 0x22038]
mov qword [rcx + 0x1248], rdx
lea rdx, [rsp + 0x32a8]
mov qword [rdx - 0xb0], rdx
lea rdx, str.rangeUpper
mov qword [rcx + 0x11a8], rdx
mov rdx, qword [r14 + rbp + 0x22040]
mov qword [rcx + 0x1258], rdx
lea rdx, [rsp + 0x32b8]
mov qword [rdx - 0xa8], rdx
lea rdx, str.lDAPDisplayName
mov qword [rcx + 0x1118], rdx
mov rdx, qword [r14 + rbp + 0x22008]
mov qword [rcx + 0x1268], rdx
lea rdx, [rsp + 0x32c8]
mov qword [rdx - 0x148], rdx
lea rdx, str.isSingleValued
mov qword [rcx + 0x11d8], rdx
mov rdx, qword [r14 + rbp + 0x22050]
mov qword [rcx + 0x1278], rdx
lea rdx, [rsp + 0x32d8]
mov qword [rdx - 0x98], rdx
lea rdx, str.adminDisplayName
mov qword [rcx + 0x1130], rdx
mov rdx, qword [r14 + rbp + 0x22010]
mov qword [rcx + 0xb78], r8
lea r8, [rsp + 0x31d0]
mov qword [rcx + 0xb80], r8
lea r8, [rsp + 0x31e8]
mov qword [rcx + 0x1288], rdx
lea rdx, [rsp + 0x32e8]
mov qword [rdx - 0x700], r8
lea r8, [rsp + 0x3200]
mov qword [rdx - 0x150], rdx
lea rdx, str.adminDescription
mov qword [rcx + 0xb90], r8
lea r8, [rsp + 0x3218]
mov qword [rcx + 0x11c0], rdx
mov qword [rcx + 0xb98], r8
lea r8, [rsp + 0x3230]
mov rdx, qword [r14 + rbp + 0x22048]
mov qword [rcx + 0xba0], r8
lea r8, str.objectClass
mov qword [rcx + 0x10e8], r8
lea r8, str.attributeSchema
mov qword [rcx + 0x11e8], r8
lea r8, [rsp + 0x3248]
mov qword [rcx + 0x10f0], r8
lea r8, [0x140028ac4]
mov qword [rcx + 0x1100], r8
mov qword [rcx + 0x1298], rdx
lea rdx, [rsp + 0x32f8]
mov r8, qword [r14 + rbp + 0x22000]
mov qword [rdx - 0xd0], rdx
lea rdx, str.CN_s__s
mov qword [rcx + 0xb50], rbx
mov qword [rcx + 0xb58], rdi
mov qword [rcx + 0xb60], rsi
mov qword [rcx + 0xb68], r10
mov qword [rcx + 0xb70], r11
mov dword [rcx + 0x10e0], r13d
mov qword [rcx + 0x11f0], 0
mov dword [rcx + 0x10f8], r13d
mov qword [rcx + 0x11f8], r8
mov qword [rcx + 0x1200], 0
mov dword [rcx + 0x1140], r13d
mov qword [rcx + 0x1210], 0
mov dword [rcx + 0x1158], 0x80
mov dword [rcx + 0x1218], 0x10
mov qword [rcx + 0x1230], 0
mov dword [rcx + 0x1170], r13d
mov qword [rcx + 0x1240], 0
mov dword [rcx + 0x1188], r13d
mov qword [rcx + 0x1250], 0
mov dword [rcx + 0x11a0], r13d
mov qword [rcx + 0x1260], 0
mov dword [rcx + 0x1110], r13d
mov qword [rcx + 0x1270], 0
mov dword [rcx + 0x11d0], r13d
mov qword [rcx + 0x1280], 0
mov dword [rcx + 0x1128], r13d
mov qword [rcx + 0x1290], 0
mov dword [rcx + 0x11b8], r13d
mov qword [rcx + 0x12a0], 0
call fcn.1400197b8
mov rcx, r15
lea rdx, [rsp + 0x2060]
lea r8, [rsp + 0x2bb0]
call qword [sym.imp.WLDAP32.dll_Ordinal_44]
mov r9d, eax
test r9d, r9d
jne 0x140011edc
mov dword [r14 + rbp + 0x22058], 1
cmp dword [0x1400352c0], 0
jne 0x140011eee
jmp 0x140011f13
cmp dword [0x1400352c0], 0
je 0x140011f04
test r9d, r9d
jne 0x1400129df
lea rcx, str.Create_attribute__s_successful_n
mov rdx, qword [r14 + rbp + 0x22000]
call fcn.140019590
jmp 0x140011f13
test r9d, r9d
je 0x140011f13
cmp r9d, 0x44
jne 0x140012a24
inc r12b
add rbp, 0x60
cmp r12b, 0x16
jl 0x140011b09
mov r13b, byte [rsp + 0x710]
mov r14d, dword [rsp + 0x1010]
mov r12, qword [rsp + 0x1008]
movaps xmmword [rsp + 0x2680], xmm7
lea rsi, [0x14002893c]
mov qword [rsp + 0x2680], rsi
movaps xmmword [rsp + 0x2690], xmm7
mov rcx, r15
lea rdx, [0x1400289f0]
mov dword [rsp + 0x2588], 0
lea r8, [rsp + 0x2690]
lea rdi, [rsp + 0x2588]
mov qword [rdi + 0x108], rdi
lea rdi, str.schemaUpdateNow
lea rax, [rsp + 0x2680]
mov qword [rax - 0xf0], rdi
mov qword [rax - 0xe8], rax
call qword [sym.imp.WLDAP32.dll_Ordinal_48]
mov ebx, eax
test ebx, ebx
je 0x1400121d1
lea rdx, str.UpdateSchemaNow
mov qword [0x1400352b0], rdx
mov dword [rsp + 0x1010], r14d
mov bpl, 2
mov qword [rsp + 0x1008], r12
mov esi, 0x1e0
xor edi, edi
lea r14, [0x140010000]
cmp dword [r14 + rsi + 0x22928], 0
je 0x140012154
lea rdx, str._objectClass_s_
lea rcx, [rsp + 0x6f0]
mov r8, qword [r14 + rsi + 0x22840]
mov r12d, edi
mov qword [rcx + 0x24b8], 0
call fcn.1400197b8
mov r11, rsp
mov rcx, r15
lea rdx, [0x140034aa0]
mov r8d, 2
lea r9, [rsp + 0x6f0]
lea r10, [rsp + 0x2ba8]
mov qword [r11 + 0x20], 0
mov dword [r11 + 0x28], 0
mov qword [r11 + 0x30], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_50]
mov rdx, qword [rsp + 0x2ba8]
test rdx, rdx
je 0x140012120
mov rcx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
test rax, rax
je 0x14001210d
mov rcx, r15
mov rdx, rax
call qword [sym.imp.WLDAP32.dll_Ordinal_30]
mov rdi, rax
cmp dword [0x1400352c0], 0
je 0x1400120ab
lea rcx, str.Class__s_in_use_by_object__s_n
mov r8, rdi
mov rdx, qword [r14 + rsi + 0x22840]
call fcn.140019590
cmp dword [0x1400352c4], 0
je 0x1400120dd
cmp dword [0x1400352c0], 0
je 0x1400120cc
lea rcx, str.Delete_object__s_n
mov rdx, rdi
call fcn.140019590
mov rcx, r15
mov rdx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_47]
mov r12d, eax
jmp 0x1400120e3
mov r12d, 0x35
mov rcx, rdi
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
test r12d, r12d
jne 0x14001210b
mov rdx, qword [rsp + 0x2ba8]
mov rcx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_27]
test rax, rax
jne 0x14001207c
xor edi, edi
mov rcx, qword [rsp + 0x2ba8]
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
test r12d, r12d
jne 0x140012154
lea rdx, str.CN_s__s
lea rcx, [rsp + 0x6f0]
lea r9, [0x1400346a0]
mov r8, qword [r14 + rsi + 0x22840]
call fcn.1400197b8
mov rcx, r15
lea rdx, [rsp + 0x6f0]
call qword [sym.imp.WLDAP32.dll_Ordinal_47]
add rsi, 0xffffffffffffff10
add bpl, 0xff
jns 0x140011fe3
mov r14d, dword [rsp + 0x1010]
mov sil, Ordinal_22
mov r12, qword [rsp + 0x1008]
mov ebp, 0x7e0
lea rdi, [0x140010000]
cmp dword [rdi + rbp + 0x22058], 0
je 0x1400121c2
lea rdx, str.CN_s__s
lea rcx, [rsp + 0x1008]
lea r9, [0x1400346a0]
mov r8, qword [rdi + rbp + 0x22000]
call fcn.1400197b8
mov rcx, r15
lea rdx, [rsp + 0x1008]
call qword [sym.imp.WLDAP32.dll_Ordinal_47]
add rbp, 0xffffffffffffffa0
add sil, 0xff
jns 0x140012184
jmp 0x140012730
mov byte [rsp + 0x710], r13b
xor bl, bl
mov dword [rsp + 0x1010], r14d
xor ebp, ebp
mov qword [rsp + 0x1008], r12
xor r13d, r13d
lea r14, [0x140010000]
lea r8, str.ibm_db2Node
mov edx, r13d
mov byte [rsp + 0x6f0], bl
mov ebx, edx
mov qword [rsp + 0x6f8], r15
lea r10, [r8 + rbp + 0x98]
mov qword [rsp + 0x708], r10
lea r9, [r8 + rbp + 0x28]
mov qword [rsp + 0x700], r9
lea rax, [r8 + rbp + 0x80]
mov r15, rax
lea r12, [r8 + rbp + 0x40]
xor esi, esi
movaps xmmword [rsp + 0x1bf0], xmm7
movaps xmmword [rsp + 0x1c00], xmm7
movaps xmmword [rsp + 0x1c10], xmm7
movaps xmmword [rsp + 0x1c20], xmm7
movaps xmmword [rsp + 0x1c30], xmm7
movaps xmmword [rsp + 0x1c40], xmm7
movaps xmmword [rsp + 0x1c50], xmm7
lea rdx, str.CN_s__s
lea rcx, [rsp + 0xaf0]
lea r9, [0x1400346a0]
mov r8, qword [r14 + rbp + 0x22840]
call fcn.1400197b8
test ebx, ebx
jne 0x140012603
lea rcx, str.objectClass
lea rsi, str.classSchema
mov qword [rsp + 0x24a0], rcx
lea rcx, [rsp + 0x24b0]
mov qword [rcx - 0x8b8], rcx
lea rcx, str.lDAPDisplayName
mov qword [rsp + 0x24d0], rcx
lea rdi, [rsp + 0x25b0]
mov rcx, qword [r14 + rbp + 0x22848]
lea r8, [rsp + 0x2498]
mov qword [rdi + 0x20], rcx
lea rcx, [rsp + 0x25d0]
mov qword [rcx - 0xf8], rcx
lea rcx, [rsp + 0x24c8]
mov qword [rcx - 0x8c8], rcx
lea rcx, str.adminDisplayName
mov qword [rdi - 0xc8], rcx
lea r9, [0x140028ac4]
mov rcx, qword [r14 + rbp + 0x22850]
lea r11, [rsp + 0x25c0]
mov qword [rdi + 0x30], rcx
lea rcx, [rsp + 0x25e0]
mov qword [rcx - 0xf0], rcx
lea rcx, [rsp + 0x24e0]
mov qword [rcx - 0x8d8], rcx
lea rcx, str.adminDescription
mov qword [rdi - 0xb0], rcx
test r12, r12
mov rcx, qword [r14 + rbp + 0x22858]
mov qword [rdi + 0x40], rcx
lea rcx, [rsp + 0x25f0]
mov qword [rcx - 0xe8], rcx
lea rcx, [rsp + 0x24f8]
mov qword [rcx - 0x8e8], rcx
lea rcx, str.governsID
mov qword [rdi - 0x98], rcx
mov rcx, qword [r14 + rbp + 0x22860]
mov qword [rdi + 0x50], rcx
lea rcx, [rsp + 0x2600]
mov qword [rcx - 0xe0], rcx
lea rcx, [rsp + 0x2510]
mov qword [rcx - 0x8f8], rcx
lea rcx, str.schemaIDGUID
mov qword [rdi - 0x80], rcx
mov rcx, qword [rdi - 0x1eb0]
mov qword [rdi + 0x68], rcx
lea rcx, [rsp + 0x2610]
mov qword [rcx + 0x10], rcx
lea rcx, [rsp + 0x2620]
mov qword [rcx - 0xe8], rcx
lea rcx, [rsp + 0x2528]
mov qword [rcx - 0x908], rcx
lea rcx, str.objectClassCategory
mov qword [rdi - 0x68], rcx
mov rcx, qword [r14 + rbp + 0x22878]
mov qword [rdi + 0x80], rcx
lea rcx, [rsp + 0x2630]
mov r10, qword [r14 + rbp + 0x22840]
mov qword [rcx - 0xe0], rcx
lea rcx, [rsp + 0x2540]
mov qword [rcx - 0x918], rcx
lea rcx, str.defaultObjectCategory
mov qword [rdi - 0x50], rcx
lea rcx, [rsp + 0xaf0]
mov qword [rcx + 0x1b50], rcx
lea rcx, [rsp + 0x2640]
mov qword [rcx - 0xd8], rcx
lea rcx, [rsp + 0x2558]
mov dword [rcx - 0xc0], r13d
mov qword [rcx + 0x58], rsi
mov qword [rcx + 0x60], 0
mov qword [rcx - 0xb0], rdi
mov qword [rcx - 0x968], r8
mov dword [rcx - 0xa8], r13d
mov qword [rcx - 0xa0], r9
mov r9d, 9
mov qword [rcx + 0x68], r10
mov qword [rcx + 0x70], 0
mov qword [rcx - 0x98], r11
mov dword [rcx - 0x90], r13d
mov qword [rcx + 0x80], 0
mov dword [rcx - 0x78], r13d
mov qword [rcx + 0x90], 0
mov dword [rcx - 0x60], r13d
mov qword [rcx + 0xa0], 0
mov dword [rcx - 0x48], r13d
mov qword [rcx + 0xb0], 0
mov dword [rcx - 0x30], 0x80
mov dword [rcx + 0xb8], reloc.WLDAP32.dll_Ordinal_16
mov qword [rcx + 0xd0], 0
mov dword [rcx - 0x18], r13d
mov qword [rcx + 0xe0], 0
mov dword [rcx], r13d
mov qword [rcx + 0xf0], 0
mov qword [rcx - 0x928], rcx
je 0x14001257b
cmp qword [r14 + rbp + 0x22880], 0
je 0x14001257b
lea rcx, str.possSuperiors
lea rsi, [rsp + 0x4c8]
mov dword [rsi], 0
mov r9d, 0xa
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x1770], rsi
mov rsi, qword [r14 + rbp + 0x228b8]
lea rcx, str.subClassOf
mov dword [rsp + 0x2570], 0
lea rdi, [rsp + 0x2650]
mov qword [rdi - 0xd8], rcx
lea r8, [rsp + 0x2570]
mov qword [rdi], rsi
lea rsi, [r9 + 1]
mov qword [rdi + 8], 0
test r15, r15
mov qword [rdi - 0xd0], rdi
mov qword [rsp + r9*8 + 0x1bf0], r8
je 0x140012603
cmp qword [r14 + rbp + 0x228c0], 0
je 0x140012603
lea rcx, str.mustContain
lea rdi, [rsp + 0x2460]
mov dword [rdi], 0
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r15
mov qword [rsp + rsi*8 + 0x1bf0], rdi
lea rsi, [r9 + 2]
cmp qword [r14 + rbp + 0x228d8], 0
je 0x14001263f
mov rdi, qword [rsp + 0x708]
lea rcx, str.mayContain
mov dword [rsp + 0x2660], ebx
lea r8, [rsp + 0x2660]
mov qword [r8 + 8], rcx
mov qword [r8 + 0x10], rdi
mov qword [rsp + rsi*8 + 0x1bf0], r8
inc rsi
test ebx, ebx
mov qword [rsp + rsi*8 + 0x1bf0], 0
jne 0x14001266f
mov rcx, qword [rsp + 0x6f8]
lea rdx, [rsp + 0xaf0]
lea r8, [rsp + 0x1bf0]
call qword [sym.imp.WLDAP32.dll_Ordinal_44]
jmp 0x14001268d
mov rcx, qword [rsp + 0x6f8]
lea rdx, [rsp + 0xaf0]
lea r8, [rsp + 0x1bf0]
call qword [sym.imp.WLDAP32.dll_Ordinal_48]
mov ecx, eax
test ecx, ecx
je 0x140012bf9
lea rsi, str.ibm_db2Database
mov rdi, qword [r14 + rbp + 0x22840]
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x1400126c8
test dl, dl
je 0x1400126c4
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x1400126c8
add rdi, 2
add rsi, 2
test dl, dl
jne 0x1400126a6
xor eax, eax
jmp 0x1400126cd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140012a70
test ebx, ebx
jne 0x140012a70
cmp dword [0x1400352c0], 0
je 0x140012703
call qword [sym.imp.WLDAP32.dll_Ordinal_22]
lea rcx, str.Create_class__s_failed___s.__Replacing..._n
mov r8, rax
mov rdx, qword [r14 + rbp + 0x22840]
call fcn.140019590
mov ebx, 2
jmp 0x14001223f
lea rdx, str.HasSchemaAdditionRights
mov ebx, reloc.WLDAP32.dll_Ordinal_50
mov qword [0x1400352b0], rdx
jmp 0x140012734
lea rdx, str.SetSchemaMasterWritable
mov qword [0x1400352b0], rdx
test ebx, ebx
je 0x140012778
cmp qword [0x1400352b8], 0
je 0x140012c5a
mov ecx, ebx
call qword [sym.imp.WLDAP32.dll_Ordinal_22]
lea rdx, str._s_:__s_n
lea rcx, [rsp + 0x2f18]
mov r9, rax
mov r8, qword [0x1400352b8]
call fcn.1400197b8
jmp 0x1400127ed
mov rcx, r10
call fcn.140013b70
mov r14d, eax
mov rbp, rsp
mov ecx, 0x1000
xor edx, edx
mov r8d, r14d
mov r9d, 0x400
lea rsi, [rsp + 0x2e18]
mov qword [rbp + 0x20], rsi
mov dword [rbp + 0x28], 0x100
mov qword [rbp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8, qword [0x1400352b8]
test r8, r8
je 0x1400127d6
test r14d, r14d
je 0x1400127d6
lea rdx, str._s_:__s_n
lea rcx, [rsp + 0x2f18]
mov r9, rsi
call fcn.1400197b8
jmp 0x1400127ed
lea rdx, [0x140029240]
lea rcx, [rsp + 0x2f18]
mov r8, rsi
call fcn.1400197b8
cmp dword [0x1400352c0], 0
je 0x14001281c
test r14d, r14d
jne 0x14001280d
test ebx, ebx
jne 0x14001280d
lea rcx, str.The_DB2_Schema_Extenstion_program_completed_successfully.
call fcn.14001963c
jmp 0x14001283d
lea rcx, [rsp + 0x2f18]
call fcn.14001963c
jmp 0x14001283d
cmp r14d, 0x57
je 0x140013a63
mov r8, qword [r12]
xor ecx, ecx
xor r9d, r9d
lea rdx, [rsp + 0x2f18]
call qword [sym.imp.USER32.dll_MessageBoxA]
test r15, r15
je 0x14001284b
mov rcx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_46]
test r13b, r13b
je 0x140012923
xor esi, esi
lea rax, [rsp + 0x2d14]
mov ebp, 0x5c5c
lea rdx, [rsp + 0x3b70]
mov dword [rax + 0xe40], esi
mov word [rax], bp
mov byte [rax + 2], sil
call fcn.140018200
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x2d14]
lea r8, [rsp + 0x3b48]
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
jne 0x140012923
mov rsi, rsp
lea rdx, str.SystemCurrentControlSetServicesNTDSParameters
mov rcx, qword [rsp + 0x3b48]
xor r8d, r8d
mov r9d, 0x2001f
lea rbp, [rsp + 0x3328]
mov qword [rsi + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140012915
mov rsi, rsp
lea rdx, str.Schema_Update_Allowed
mov rcx, qword [rsp + 0x3328]
xor r8d, r8d
mov r9d, 4
lea rbp, [rsp + 0x3b54]
mov qword [rsi + 0x20], rbp
mov dword [rsi + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x3328]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x3b48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
movaps xmm7, xmmword [rsp + 0x3b60]
cmove ebx, r14d
mov eax, ebx
add rsp, 0x3b88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rdx, qword [rsp + 0x60]
movzx ecx, byte [rdx + 1]
call fcn.140019558
cmp eax, 0x4e
jne 0x14001114a
mov rdx, qword [rsp + 0x60]
movzx ecx, byte [rdx + 2]
call fcn.140019558
cmp eax, 0x3d
je 0x140011272
jmp 0x14001114a
mov ecx, ebx
call qword [sym.imp.WLDAP32.dll_Ordinal_22]
lea rcx, str.Delete_class__s_failed___s_n
mov r8, rax
mov rdx, qword [r13 + rdi + 0x22840]
call fcn.140019590
jmp 0x140011984
mov r13b, byte [rsp + 0x710]
mov r14d, dword [rsp + 0x1010]
mov r12, qword [rsp + 0x1008]
jmp 0x140012730
mov ecx, ebx
call qword [sym.imp.WLDAP32.dll_Ordinal_22]
lea rcx, str.Delete_attribute__s_failed___s_n
mov r8, rax
mov rdx, qword [r12 + rbp + 0x22000]
call fcn.140019590
jmp 0x140011a64
mov dword [rsp + 0x4c8], r9d
mov ecx, r9d
call qword [sym.imp.WLDAP32.dll_Ordinal_22]
mov r9d, dword [rsp + 0x4c8]
lea rcx, str.Create_attribute__s_failed___s_n
mov r8, rax
mov rdx, qword [r14 + rbp + 0x22000]
mov dword [rsp + 0x4c8], r9d
call fcn.140019590
mov r9d, dword [rsp + 0x4c8]
jmp 0x140011f09
lea rsi, [0x140010000]
lea rdx, str.AddNewAttribute
mov r13b, byte [rsp + 0x710]
mov ebx, r9d
mov r14d, dword [rsp + 0x1010]
mov r12, qword [rsp + 0x1008]
mov rbp, qword [rsi + rbp + 0x22000]
mov qword [0x1400352b0], rdx
mov qword [0x1400352b8], rbp
test ebx, ebx
jne 0x140011fc2
jmp 0x140012730
mov bl, byte [rsp + 0x6f0]
mov r12d, ecx
mov r15, qword [rsp + 0x6f8]
lea rdi, str.schemaUpdateNow
lea rsi, [0x14002893c]
cmp dword [0x1400352c0], 0
je 0x140012ab8
test r12d, r12d
jne 0x140012b62
lea rcx, str.Create_class__s_successful_n
mov rdx, qword [r14 + rbp + 0x22840]
call fcn.140019590
jmp 0x140012ac7
test r12d, r12d
je 0x140012ac7
cmp r12d, 0x44
jne 0x140012b87
movaps xmmword [rsp + 0x4e0], xmm7
mov qword [rsp + 0x4e0], rsi
movaps xmmword [rsp + 0x25a0], xmm7
mov rcx, r15
lea rdx, [0x1400289f0]
mov dword [rsp + 0x2478], 0
lea r8, [rsp + 0x25a0]
mov qword [r8 - 0x120], rdi
lea rax, [rsp + 0x2478]
mov qword [rax + 0x128], rax
lea r9, [rsp + 0x4e0]
mov qword [rax + 0x10], r9
call qword [sym.imp.WLDAP32.dll_Ordinal_48]
mov r12d, eax
test r12d, r12d
jne 0x140012bcb
inc bl
add rbp, 0xf0
cmp bl, 3
jl 0x1400121f7
mov r13b, byte [rsp + 0x710]
mov ebx, r12d
mov r14d, dword [rsp + 0x1010]
mov r12, qword [rsp + 0x1008]
jmp 0x140012730
mov ecx, r12d
call qword [sym.imp.WLDAP32.dll_Ordinal_22]
lea rcx, str.Create_class__s_failed___s_n
mov r8, rax
mov rdx, qword [r14 + rbp + 0x22840]
call fcn.140019590
jmp 0x140012abd
lea rsi, [0x140010000]
lea rdx, str.AddNewClass
mov r13b, byte [rsp + 0x710]
mov ebx, r12d
mov r14d, dword [rsp + 0x1010]
mov r12, qword [rsp + 0x1008]
mov rbp, qword [rsi + rbp + 0x22840]
mov qword [0x1400352b0], rdx
mov qword [0x1400352b8], rbp
jmp 0x140012a63
lea rdx, str.UpdateSchemaNow
mov ebx, r12d
mov r13b, byte [rsp + 0x710]
mov r14d, dword [rsp + 0x1010]
mov r12, qword [rsp + 0x1008]
mov qword [0x1400352b0], rdx
jmp 0x140011fc2
mov bl, byte [rsp + 0x6f0]
lea rdi, str.schemaUpdateNow
mov r15, qword [rsp + 0x6f8]
lea rsi, [0x14002893c]
mov dword [r14 + rbp + 0x22928], 1
cmp dword [0x1400352c0], 0
jne 0x140012aa2
jmp 0x140012ac7
xor edx, edx
mov rcx, rbp
xor r8d, r8d
mov r9d, 0x486
call qword [sym.imp.WLDAP32.dll_Ordinal_45]
jmp 0x14001160f
call qword [sym.imp.WLDAP32.dll_Ordinal_16]
mov ebx, eax
jmp 0x140011623
mov ecx, ebx
call qword [sym.imp.WLDAP32.dll_Ordinal_22]
lea rdx, [0x140029240]
lea rcx, [rsp + 0x2f18]
mov r8, rax
call fcn.1400197b8
jmp 0x1400127ed
mov rdx, qword [0x1400352a0]
test rdx, rdx
je 0x140013599
mov r8, qword [0x1400352a8]
mov rcx, r10
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_60]
mov r10, qword [rsp + 0x4d0]
mov ebx, eax
test ebx, ebx
jne 0x140012d40
mov rax, rsp
lea rdi, [rsp + 0x458]
mov byte [rsp + 0x40], 0
lea r11, [rdi - 0x10]
lea rdx, [0x1400289f0]
lea r9, str._objectClass_
mov rcx, r10
xor r8d, r8d
mov qword [rax + 0x20], rdi
lea rsi, str.schemaNamingContext
mov dword [rax + 0x28], 0
mov qword [rax + 0x30], r11
mov qword [rdi + 0x78], r10
mov qword [rdi - 0x10], 0
mov qword [rdi], rsi
mov qword [rdi + 8], 0
call qword [sym.imp.WLDAP32.dll_Ordinal_50]
mov rdx, qword [rsp + 0x448]
test rdx, rdx
mov r10, qword [rsp + 0x4d0]
jne 0x140012d4e
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_16]
mov r10, qword [rsp + 0x4d0]
mov ebx, eax
mov rcx, r10
call qword [sym.imp.WLDAP32.dll_Ordinal_46]
jmp 0x140011293
mov qword [rsp + 0x4d0], r10
mov rcx, r10
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
mov r10, qword [rsp + 0x4d0]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140012d28
mov rdx, rax
lea r8, [rsp + 0x450]
mov qword [r8 + 0x80], r10
mov rcx, r10
call qword [sym.imp.WLDAP32.dll_Ordinal_32]
mov r10, qword [rsp + 0x4d0]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140012e3e
mov qword [rsp + 0x6f8], r15
mov dword [rsp + 0x4c8], ebp
mov rbp, rsi
mov qword [rsp + 0x1008], r12
mov r12, r10
mov rcx, rax
mov r15, qword [rsp + 0x48]
mov rdi, rcx
mov rsi, rbp
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x140012df5
test dl, dl
je 0x140012df1
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x140012df5
add rdi, 2
add rsi, 2
test dl, dl
jne 0x140012dd3
xor eax, eax
jmp 0x140012dfa
sbb eax, eax
or eax, 1
test eax, eax
je 0x140013511
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r8, qword [rsp + 0x450]
mov rcx, r12
mov rdx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_33]
mov rcx, rax
test rcx, rcx
jne 0x140012dcd
mov r15, qword [rsp + 0x6f8]
mov r10, r12
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
mov rcx, qword [rsp + 0x448]
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
mov dl, byte [rsp + 0x40]
test dl, dl
mov r10, qword [rsp + 0x4d0]
je 0x140012d28
mov rdx, rsp
lea rdi, [rsp + 0x478]
mov byte [rsp + 0x40], 0
lea r11, [rdi - 0x10]
mov rcx, r10
xor r8d, r8d
lea r9, str._objectClass_
lea rsi, str.rootDomainNamingContext
mov qword [rdx + 0x20], rdi
mov dword [rdx + 0x28], 0
mov qword [rdx + 0x30], r11
lea rdx, [0x1400289f0]
mov qword [rdi + 0x58], r10
mov qword [rdi - 0x10], 0
mov qword [rdi], rsi
mov qword [rdi + 8], 0
call qword [sym.imp.WLDAP32.dll_Ordinal_50]
mov rdx, qword [rsp + 0x468]
test rdx, rdx
mov r10, qword [rsp + 0x4d0]
je 0x140012d28
mov qword [rsp + 0x4d0], r10
mov rcx, r10
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
mov r10, qword [rsp + 0x4d0]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140012d28
mov rdx, rax
lea r8, [rsp + 0x470]
mov qword [r8 + 0x60], r10
mov rcx, r10
call qword [sym.imp.WLDAP32.dll_Ordinal_32]
mov r10, qword [rsp + 0x4d0]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140012fd1
mov qword [rsp + 0x6f8], r15
mov dword [rsp + 0x4c8], ebp
mov rbp, r10
mov qword [rsp + 0x1008], r12
lea r12, str.rootDomainNamingContext
mov rcx, rax
mov r15, qword [rsp + 0x48]
mov rdi, rcx
mov rsi, r12
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x140012f88
test dl, dl
je 0x140012f84
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x140012f88
add rdi, 2
add rsi, 2
test dl, dl
jne 0x140012f66
xor eax, eax
jmp 0x140012f8d
sbb eax, eax
or eax, 1
test eax, eax
je 0x140013489
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r8, qword [rsp + 0x470]
mov rcx, rbp
mov rdx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_33]
mov rcx, rax
test rcx, rcx
jne 0x140012f60
mov r15, qword [rsp + 0x6f8]
mov r10, rbp
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
mov rcx, qword [rsp + 0x468]
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
mov dl, byte [rsp + 0x40]
test dl, dl
mov r10, qword [rsp + 0x4d0]
je 0x140012d28
lea rsi, str.fSMORoleOwner
lea rdi, [rsp + 0x498]
mov qword [rdi], rsi
mov rsi, rsp
mov byte [rdi + 0x10], 0
lea r11, [rdi - 0x10]
lea rdx, [0x1400346a0]
mov rcx, r10
xor r8d, r8d
lea r9, str._objectClass_
mov qword [rsi + 0x20], rdi
mov dword [rsi + 0x28], 0
mov qword [rsi + 0x30], r11
mov qword [rdi + 0x38], r10
mov qword [rdi - 0x10], 0
mov qword [rdi + 8], 0
call qword [sym.imp.WLDAP32.dll_Ordinal_50]
mov rdx, qword [rsp + 0x488]
test rdx, rdx
mov r10, qword [rsp + 0x4d0]
je 0x140012d28
mov qword [rsp + 0x4d0], r10
mov rcx, r10
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
mov r10, qword [rsp + 0x4d0]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140012d28
mov rdx, rax
lea r8, [rsp + 0x490]
mov qword [r8 + 0x40], r10
mov rcx, r10
call qword [sym.imp.WLDAP32.dll_Ordinal_32]
mov r10, qword [rsp + 0x4d0]
mov qword [rsp + 0x4b0], rax
cmp qword [rsp + 0x4b0], 0
je 0x140013169
mov qword [rsp + 0x6f8], r15
mov dword [rsp + 0x4c8], ebp
mov rbp, r10
mov qword [rsp + 0x1008], r12
lea r12, str.fSMORoleOwner
mov rcx, rax
mov r15, qword [rsp + 0x40]
mov rdi, rcx
mov rsi, r12
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x140013120
test dl, dl
je 0x14001311c
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x140013120
add rdi, 2
add rsi, 2
test dl, dl
jne 0x1400130fe
xor eax, eax
jmp 0x140013125
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400133f9
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r8, qword [rsp + 0x490]
mov rcx, rbp
mov rdx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_33]
mov rcx, rax
test rcx, rcx
jne 0x1400130f8
mov r15, qword [rsp + 0x6f8]
mov r10, rbp
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
mov rcx, qword [rsp + 0x488]
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
mov dl, byte [rsp + 0x4a8]
test dl, dl
mov r10, qword [rsp + 0x4d0]
je 0x140012d28
mov edx, reloc.WLDAP32.dll_Ordinal_44
lea rcx, [rsp + 0x40]
mov qword [rcx + 0x490], r10
call fcn.140019858
mov r10, qword [rsp + 0x4d0]
inc rax
jne 0x1400131c2
xor ebx, ebx
inc ebx
jmp 0x140012d40
lea rsi, str.dNSHostName
lea rdi, [rsp + 0x4b8]
mov qword [rdi], rsi
mov rsi, rsp
mov byte [rdi + 0x20], 0
lea r11, [rdi - 0x10]
mov rcx, r10
mov rdx, rax
xor r8d, r8d
lea r9, str._objectClass_
mov qword [rsi + 0x20], rdi
mov dword [rsi + 0x28], 0
mov qword [rsi + 0x30], r11
mov qword [rdi + 0x18], r10
mov qword [rdi - 0x10], 0
mov qword [rdi + 8], 0
call qword [sym.imp.WLDAP32.dll_Ordinal_50]
mov rdx, qword [rsp + 0x4a8]
test rdx, rdx
mov r10, qword [rsp + 0x4d0]
je 0x140012d28
mov qword [rsp + 0x4d0], r10
mov rcx, r10
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
mov r10, qword [rsp + 0x4d0]
mov qword [rsp + 0x4e0], rax
cmp qword [rsp + 0x4e0], 0
je 0x140012d28
mov rdx, rax
lea r8, [rsp + 0x4b0]
mov qword [r8 + 0x20], r10
mov rcx, r10
call qword [sym.imp.WLDAP32.dll_Ordinal_32]
mov r10, qword [rsp + 0x4d0]
mov qword [rsp + 0x4e8], rax
cmp qword [rsp + 0x4e8], 0
je 0x140013331
mov qword [rsp + 0x6f8], r15
mov dword [rsp + 0x4c8], ebp
mov rbp, r10
mov qword [rsp + 0x1008], r12
lea r12, str.dNSHostName
mov rcx, rax
mov r15, qword [rsp + 0x4e0]
mov rdi, rcx
mov rsi, r12
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x1400132ec
test dl, dl
je 0x1400132e8
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x1400132ec
add rdi, 2
add rsi, 2
test dl, dl
jne 0x1400132ca
xor eax, eax
jmp 0x1400132f1
sbb eax, eax
or eax, 1
test eax, eax
je 0x140013363
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r8, qword [rsp + 0x4b0]
mov rcx, rbp
mov rdx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_33]
mov rcx, rax
test rcx, rcx
jne 0x1400132c4
mov r15, qword [rsp + 0x6f8]
mov r10, rbp
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
mov rcx, qword [rsp + 0x4a8]
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
mov dl, byte [rsp + 0x4d8]
test dl, dl
mov r10, qword [rsp + 0x4d0]
je 0x140012d28
jmp 0x140012d40
lea rax, [rsp + 0x4e8]
mov qword [rax], rcx
mov r10, rbp
mov rdx, qword [rsp + 0x4e0]
mov rcx, r10
mov r8, qword [rax]
mov qword [rsp + 0x4d0], r10
mov r15, qword [rsp + 0x6f8]
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
call qword [sym.imp.WLDAP32.dll_Ordinal_34]
mov r10, qword [rsp + 0x4d0]
mov rcx, rax
mov rdi, qword [rcx]
lea rsi, [rsp + 0x3340]
mov dl, byte [rdi]
inc rdi
mov byte [rsi], dl
inc rsi
test dl, dl
jne 0x1400133ba
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_38]
mov byte [rsp + 0x4d8], 1
mov rcx, qword [rsp + 0x4e8]
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r10, qword [rsp + 0x4d0]
jmp 0x140013331
lea rax, [rsp + 0x4b0]
mov qword [rax], rcx
mov r10, rbp
mov rdx, qword [rsp + 0x40]
mov rcx, r10
mov r8, qword [rax]
mov qword [rsp + 0x4d0], r10
mov r15, qword [rsp + 0x6f8]
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
call qword [sym.imp.WLDAP32.dll_Ordinal_34]
mov r10, qword [rsp + 0x4d0]
mov rcx, rax
mov rdi, qword [rcx]
lea rsi, [rsp + 0x40]
mov dl, byte [rdi]
inc rdi
mov byte [rsi], dl
inc rsi
test dl, dl
jne 0x14001344a
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_38]
mov byte [rsp + 0x4a8], 1
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r10, qword [rsp + 0x4d0]
jmp 0x140013169
mov qword [rsp + 0x50], rcx
mov r10, rbp
mov rdx, qword [rsp + 0x48]
mov rcx, r10
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x4d0], r10
mov r15, qword [rsp + 0x6f8]
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
call qword [sym.imp.WLDAP32.dll_Ordinal_34]
mov r10, qword [rsp + 0x4d0]
mov rcx, rax
lea rsi, [0x140034aa0]
mov rdi, qword [rcx]
mov dl, byte [rdi]
inc rdi
mov byte [rsi], dl
inc rsi
test dl, dl
jne 0x1400134d8
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_38]
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r10, qword [rsp + 0x4d0]
jmp 0x140012fd1
mov qword [rsp + 0x50], rcx
mov r10, r12
mov rdx, qword [rsp + 0x48]
mov rcx, r10
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x4d0], r10
mov r15, qword [rsp + 0x6f8]
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
call qword [sym.imp.WLDAP32.dll_Ordinal_34]
mov r10, qword [rsp + 0x4d0]
mov rcx, rax
lea rsi, [0x1400346a0]
mov rdi, qword [rcx]
mov dl, byte [rdi]
inc rdi
mov byte [rsi], dl
inc rsi
test dl, dl
jne 0x140013560
mov qword [rsp + 0x4d0], r10
call qword [sym.imp.WLDAP32.dll_Ordinal_38]
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r10, qword [rsp + 0x4d0]
jmp 0x140012e3e
xor edx, edx
mov rcx, r10
mov qword [rsp + 0x4d0], r10
xor r8d, r8d
mov r9d, 0x486
call qword [sym.imp.WLDAP32.dll_Ordinal_45]
jmp 0x140012ca6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x14001124b
mov r11, rsp
lea rsi, [rsp + 0x3120]
xor ecx, ecx
lea rdi, [rsp + 0x3b80]
lea r10, [rsp + 0x3338]
lea r8, [rsp + 0x1808]
mov qword [r11 + 0x20], rsi
lea r9, [rsp + 0x3b5c]
mov qword [r11 + 0x28], rdi
mov qword [r11 + 0x30], r10
mov rdx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x14001361b
mov r14d, 0x89a
jmp 0x14001124b
lea rcx, [rsp + 0x1808]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140013610
cmp dword [rsp + 0x3338], 1
jne 0x140013676
mov rdi, rsp
lea rcx, [rsp + 0xf00]
mov rsi, qword [rsp + 0x60]
mov edx, 0x100
lea r8, str._s_s
lea r9, [rsp + 0x3120]
mov qword [rdi + 0x20], rsi
call fcn.1400198e4
lea rdx, [rsp + 0xf00]
mov qword [rsp + 0x60], rdx
jmp 0x1400111ea
xor ecx, ecx
mov edx, 0x185
mov dword [rsp + 0x2678], 1
mov r14d, 0x89a
mov qword [rsp + 0x2490], 0
call qword [sym.imp.WLDAP32.dll_Ordinal_143]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14001124b
xor edx, edx
mov r9d, 0x486
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.WLDAP32.dll_Ordinal_45]
test eax, eax
jne 0x14001124b
mov rdx, rsp
lea r10, [rsp + 0xef0]
xor r8d, r8d
lea r11, [rsp + 0x1000]
lea r9, str._objectClass_
lea rsi, str.rootDomainNamingContext
mov qword [r10 + 0x110], 0
xor dil, dil
mov qword [rdx + 0x20], r10
mov dword [rdx + 0x28], 0
mov qword [rdx + 0x30], r11
lea rdx, [0x1400289f0]
mov rcx, qword [rsp + 0x58]
mov qword [r10], rsi
mov qword [r10 + 8], 0
call qword [sym.imp.WLDAP32.dll_Ordinal_50]
mov rdx, qword [rsp + 0x1000]
test rdx, rdx
jne 0x140013748
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WLDAP32.dll_Ordinal_46]
jmp 0x14001124b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140013738
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x440]
mov rdx, rax
call qword [sym.imp.WLDAP32.dll_Ordinal_32]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140013826
mov qword [rsp + 0x6f8], r15
mov qword [rsp + 0x1008], r12
mov byte [rsp + 0x40], dil
mov dword [rsp + 0x4c8], ebp
mov rbp, rsi
mov rcx, rax
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rdi, rcx
mov rsi, rbp
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x1400137db
test dl, dl
je 0x1400137d7
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x1400137db
add rdi, 2
add rsi, 2
test dl, dl
jne 0x1400137b9
xor eax, eax
jmp 0x1400137e0
sbb eax, eax
or eax, 1
test eax, eax
je 0x140013929
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
mov r8, qword [rsp + 0x440]
mov rcx, r12
mov rdx, r15
call qword [sym.imp.WLDAP32.dll_Ordinal_33]
mov rcx, rax
test rcx, rcx
jne 0x1400137b3
mov dil, byte [rsp + 0x40]
mov r15, qword [rsp + 0x6f8]
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
mov rcx, qword [rsp + 0x1000]
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
test dil, dil
je 0x140013738
mov rcx, qword [rsp + 0x58]
mov edx, 8
lea r8, [rsp + 0x2678]
call qword [sym.imp.WLDAP32.dll_Ordinal_211]
mov edx, 0x200
lea rcx, [rsp + 0x4f0]
lea r8, str.__objectClassuser__objectCategoryperson__sAMAccountName_s__
mov r9, qword [rsp + 0x60]
call fcn.1400198e4
mov rdi, rsp
lea rsi, [rsp + 0x2490]
lea rdx, [0x140034aa0]
mov r8d, 2
lea r9, [rsp + 0x4f0]
mov qword [rdi + 0x20], 0
mov dword [rdi + 0x28], 0
mov qword [rdi + 0x30], rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WLDAP32.dll_Ordinal_50]
mov rdx, qword [rsp + 0x2490]
test rdx, rdx
je 0x140013738
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WLDAP32.dll_Ordinal_26]
test rax, rax
je 0x140013738
mov rcx, qword [rsp + 0x58]
mov rdx, rax
call qword [sym.imp.WLDAP32.dll_Ordinal_30]
mov rsi, rax
test rsi, rsi
je 0x140013738
mov rcx, rsi
lea rdx, [rsp + 0x3740]
test cl, 3
je 0x140013913
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x140013918
inc rdx
test cl, 3
jne 0x140013900
call fcn.140017ef0
mov rcx, rsi
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
xor r14d, r14d
jmp 0x140013738
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov r15, qword [rsp + 0x6f8]
mov ebp, dword [rsp + 0x4c8]
mov r12, qword [rsp + 0x1008]
call qword [sym.imp.WLDAP32.dll_Ordinal_34]
mov rcx, rax
lea rsi, [0x140034aa0]
mov rdi, qword [rcx]
mov dl, byte [rdi]
inc rdi
mov byte [rsi], dl
inc rsi
test dl, dl
jne 0x140013967
call qword [sym.imp.WLDAP32.dll_Ordinal_38]
mov rcx, qword [rsp + 0x48]
mov dil, 1
call qword [sym.imp.WLDAP32.dll_Ordinal_200]
jmp 0x140013826
mov rax, rcx
mov rcx, r15
mov rdx, rbx
mov r8, rax
mov sil, r12b
mov r13b, r14b
mov r14d, dword [rsp + 0x1010]
mov r12, qword [rsp + 0x1008]
call qword [sym.imp.WLDAP32.dll_Ordinal_34]
mov rcx, rax
xor ebx, ebx
cmp qword [rcx], 0
je 0x140013a58
mov r8, r12
mov r12b, sil
lea rsi, str.attributeSchema
mov r9, qword [rcx + rbx*8]
mov rdi, r9
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x1400139fb
test dl, dl
je 0x1400139f7
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x1400139fb
add rdi, 2
add rsi, 2
test dl, dl
jne 0x1400139d9
xor eax, eax
jmp 0x140013a00
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140013a09
mov r12b, 1
jmp 0x140013a44
mov rdi, r9
lea rsi, str.classSchema
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x140013a35
test dl, dl
je 0x140013a31
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x140013a35
add rdi, 2
add rsi, 2
test dl, dl
jne 0x140013a13
xor eax, eax
jmp 0x140013a3a
sbb eax, eax
or eax, 1
mov edx, 1
test eax, eax
cmove ebp, edx
inc rbx
cmp qword [rcx + rbx*8], 0
jne 0x1400139cb
mov sil, r12b
mov r12, r8
call qword [sym.imp.WLDAP32.dll_Ordinal_38]
jmp 0x140011780
mov r8, qword [r12]
xor ecx, ecx
lea rdx, str.db2schex___b_bindDN__w_password____k____u____x_filename_
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14001283d
lea rdx, [rdi + 1]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140013aaa
mov rax, rdx
add rdx, rcx
call fcn.140017e80
cmp rax, 1
ja case.default.0x140013adb
movzx edx, byte [rdi + 1]
add edx, 0xffffffbe
cmp edx, 0x36
ja case.default.0x140013adb
lea rdi, [0x140010000]
movzx eax, byte [rdi + rdx + 0x184fe]
lea rax, [rdi + rax + 0x3add]
jmp rax
mov r14d, 0x57
jmp 0x140012778