Function at 0x14007d290
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rbp + 0x340], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x38], rcx
mov edx, 0x100
lea rcx, [rbp + 0x130]
mov qword [rsp + 0x68], rax
mov ebx, eax
mov qword [rsp + 0x50], rax
mov r13d, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov edi, eax
mov dword [rsp + 0x30], eax
mov esi, eax
mov dword [rsp + 0x40], eax
call fcn.140150800
lea rcx, str.netapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14007d325
lea rcx, str.radmin32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007e8bf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xorps xmm0, xmm0
mov dword [rbp - 0x80], __WSAFDIsSet
lea rcx, [rbp - 0x80]
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x14007e8bf
cmp dword [rbp - 0x70], 2
jne 0x14007d395
mov ecx, dword [rbp - 0x7c]
cmp ecx, 4
jne 0x14007d386
mov dword [rsp + 0x30], 1
jmp 0x14007d395
cmp ecx, 5
mov eax, 1
cmovae esi, eax
mov dword [rsp + 0x40], esi
mov r8d, 0x104
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14007d3d9
mov edx, 0x5c
lea rcx, [rbp + 0x20]
call fcn.140149b38
test rax, rax
je 0x14007e8bf
lea r8, str._authadmin.dll
mov byte [rax], bl
mov edx, 0x104
lea rcx, [rbp + 0x20]
call fcn.140150860
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14007d405
lea rdx, str.CUGP
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rsp + 0x68], rax
mov r8d, 0x104
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14007d44a
mov edx, 0x5c
lea rcx, [rbp + 0x20]
call fcn.140149b38
test rax, rax
je 0x14007e8bf
lea r8, str.workgrpdomnt4.dll
mov byte [rax], dil
mov edx, 0x104
lea rcx, [rbp + 0x20]
call fcn.140150860
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14007d471
lea rdx, str.CUGP
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov r8d, 0x104
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14007d4b6
mov edx, 0x5c
lea rcx, [rbp + 0x20]
call fcn.140149b38
test rax, rax
je 0x14007e8bf
lea r8, str.ldapauth.dll
mov byte [rax], dil
mov edx, 0x104
lea rcx, [rbp + 0x20]
call fcn.140150860
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
test rax, rax
je 0x14007d4dd
lea rdx, str.CUGP
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
mov r8d, 0x104
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14007d522
mov edx, 0x5c
lea rcx, [rbp + 0x20]
call fcn.140149b38
test rax, rax
je 0x14007e8bf
lea r8, str.ldapauthnt4.dll
mov byte [rax], dil
mov edx, 0x104
lea rcx, [rbp + 0x20]
call fcn.140150860
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x14007d549
lea rdx, str.CUGP
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
mov r8d, 0x104
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14007d58e
mov edx, 0x5c
lea rcx, [rbp + 0x20]
call fcn.140149b38
test rax, rax
je 0x14007e8bf
lea r8, str.ldapauth9x.dll
mov byte [rax], dil
mov edx, 0x104
lea rcx, [rbp + 0x20]
call fcn.140150860
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x4a8], r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x14007d5bd
lea rdx, str.CUGP
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
mov rcx, qword [0x14022a710]
cmp byte [rcx + 0xe69], dil
jne 0x14007d6da
cmp byte [rcx + 0xeff], dil
jne 0x14007d6da
cmp byte [rcx + 0xf95], dil
jne 0x14007d6da
cmp dword [rsp + 0x30], edi
jne 0x14007d5f9
test esi, esi
je 0x14007d6da
test rbx, rbx
je 0x14007d647
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xe69]
mov eax, dword [rax + 0x102c]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007df44
jmp 0x14007d6d3
cmp dword [rcx + 0xe20], edi
je 0x14007d6b8
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rbx, rbx
je 0x14007d6d1
test rax, rax
je 0x14007d6d1
cmp rax, rbx
je 0x14007d6d1
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.authadmin.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14007d6d1
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.authadmin.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
mov rcx, qword [0x14022a710]
cmp byte [rcx + 0xe69], 0
je 0x14007db81
test r13, r13
je 0x14007d739
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
lea r9, [rax + 0xe69]
mov eax, dword [rax + 0x102c]
mov dword [rsp + 0x20], eax
call r13
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007df44
jmp 0x14007d7cb
cmp dword [rcx + 0xe20], 0
je 0x14007d7ab
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007d7c4
test rax, rax
je 0x14007d7c4
cmp rax, rdi
je 0x14007d7c4
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.workgrpdomnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14007d7c4
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.workgrpdomnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rbx, qword [rsp + 0x38]
xor edi, edi
lea rcx, str.Activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007d84f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x14007d846
mov rcx, qword [0x14022a710]
mov eax, dword [rcx + 0x102c]
sub eax, 2
cmp eax, 1
ja 0x14007d846
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14007d9b7
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
lea r9, [rax + 0xe69]
mov eax, dword [rax + 0x102c]
mov dword [rsp + 0x20], eax
call rdi
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007df44
lea rcx, str.Activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007d916
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x30], 0
je 0x14007d90d
lea rcx, str.netapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14007d90d
lea rdx, str.DsGetDcNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x14007d90d
mov rcx, qword [0x14022a710]
mov eax, dword [rcx + 0x102c]
sub eax, 2
cmp eax, 1
ja 0x14007d90d
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14007da4e
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xe69]
mov eax, dword [rax + 0x102c]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007df44
lea rcx, str.Activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007db76
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x30], 0
mov esi, dword [rsp + 0x40]
jne 0x14007d9a2
test esi, esi
jne 0x14007d9a2
mov rcx, qword [0x14022a710]
mov eax, dword [rcx + 0x102c]
sub eax, 2
cmp eax, 1
ja 0x14007d9a9
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14007dae5
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xe69]
mov eax, dword [rax + 0x102c]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [0x14022a710]
cmp edi, 1
je 0x14007df44
jmp 0x14007db81
cmp dword [rcx + 0xe20], 0
je 0x14007da2e
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007da47
test rax, rax
je 0x14007da47
cmp rax, rdi
je 0x14007da47
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edi, edi
jmp 0x14007d84f
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
jmp 0x14007d84f
cmp dword [rcx + 0xe20], 0
je 0x14007dac5
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007dade
test rax, rax
je 0x14007dade
cmp rax, rdi
je 0x14007dade
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauthnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edi, edi
jmp 0x14007d916
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauthnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
jmp 0x14007d916
cmp dword [rcx + 0xe20], 0
je 0x14007db59
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007db72
test rax, rax
je 0x14007db72
cmp rax, rdi
je 0x14007db72
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth9x.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edi, edi
jmp 0x14007db7a
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth9x.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
jmp 0x14007db7a
mov esi, dword [rsp + 0x40]
mov rcx, qword [0x14022a710]
cmp byte [rcx + 0xeff], 0
je 0x14007e172
test r13, r13
je 0x14007dbdd
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xeff]
mov eax, dword [rax + 0x1030]
mov dword [rsp + 0x20], eax
call r13
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007df44
jmp 0x14007dc6a
cmp dword [rcx + 0xe20], 0
je 0x14007dc4f
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007dc68
test rax, rax
je 0x14007dc68
cmp rax, rdi
je 0x14007dc68
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.workgrpdomnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14007dc68
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.workgrpdomnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
cmp dword [rsp + 0x30], 0
jne 0x14007dc75
test esi, esi
je 0x14007dcba
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14007dcc8
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xeff]
mov eax, dword [rax + 0x1030]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007df44
jmp 0x14007dd5c
mov rax, qword [0x14022a710]
cmp dword [rax + 0xe20], 0
je 0x14007dd41
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007dd5a
test rax, rax
je 0x14007dd5a
cmp rax, rdi
je 0x14007dd5a
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.authadmin.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14007dd5a
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.authadmin.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
lea rcx, str.Activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007dde2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x14007ddd9
mov rcx, qword [0x14022a710]
mov eax, dword [rcx + 0x1030]
sub eax, 2
cmp eax, 1
ja 0x14007ddd9
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14007dfae
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xeff]
mov eax, dword [rax + 0x1030]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007df44
lea rcx, str.Activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007dea9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x30], 0
je 0x14007dea0
lea rcx, str.netapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14007dea0
lea rdx, str.DsGetDcNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x14007dea0
mov rcx, qword [0x14022a710]
mov eax, dword [rcx + 0x1030]
sub eax, 2
cmp eax, 1
ja 0x14007dea0
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14007e045
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xeff]
mov eax, dword [rax + 0x1030]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007df44
lea rcx, str.Activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007e16b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x30], 0
jne 0x14007df34
cmp dword [rsp + 0x40], 0
jne 0x14007df34
mov rcx, qword [0x14022a710]
mov eax, dword [rcx + 0x1030]
sub eax, 2
cmp eax, 1
ja 0x14007df3b
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14007e0dc
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xeff]
mov eax, dword [rax + 0x1030]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [0x14022a710]
cmp edi, 1
jne 0x14007e172
mov r8d, 0x104
lea rdx, [rbp + 0x230]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14007df89
mov edx, 0x5c
lea rcx, [rbp + 0x230]
call fcn.140149b38
lea r8, str.logging.dll
mov edx, 0x104
lea rcx, [rbp + 0x230]
mov byte [rax], 0
call fcn.140150860
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14007e86e
lea rdx, str.LOGLOGONUSER
jmp 0x14007e84e
cmp dword [rcx + 0xe20], 0
je 0x14007e025
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007e03e
test rax, rax
je 0x14007e03e
cmp rax, rdi
je 0x14007e03e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edi, edi
jmp 0x14007dde2
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
jmp 0x14007dde2
cmp dword [rcx + 0xe20], 0
je 0x14007e0bc
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007e0d5
test rax, rax
je 0x14007e0d5
cmp rax, rdi
je 0x14007e0d5
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauthnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edi, edi
jmp 0x14007dea9
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauthnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
jmp 0x14007dea9
cmp dword [rcx + 0xe20], 0
je 0x14007e150
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007e169
test rax, rax
je 0x14007e169
cmp rax, rdi
je 0x14007e169
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth9x.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edi, edi
jmp 0x14007e16b
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth9x.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
mov rcx, qword [0x14022a710]
cmp byte [rcx + 0xf95], 0
je 0x14007e7ed
test r13, r13
je 0x14007e1d1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rsi, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
lea r9, [rax + 0xf95]
mov eax, dword [rax + 0x1034]
mov dword [rsp + 0x20], eax
call r13
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007e537
jmp 0x14007e263
cmp dword [rcx + 0xe20], 0
je 0x14007e243
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007e25c
test rax, rax
je 0x14007e25c
cmp rax, rdi
je 0x14007e25c
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.workgrpdomnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14007e25c
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.workgrpdomnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rsi, qword [rsp + 0x38]
xor edi, edi
cmp dword [rsp + 0x30], 0
mov r13d, dword [rsp + 0x40]
jne 0x14007e274
test r13d, r13d
je 0x14007e2b7
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14007e2c5
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
lea r9, [rax + 0xf95]
mov eax, dword [rax + 0x1034]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007e537
jmp 0x14007e359
mov rax, qword [0x14022a710]
cmp dword [rax + 0xe20], 0
je 0x14007e33e
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rbx, rax
test rdi, rdi
je 0x14007e357
test rax, rax
je 0x14007e357
cmp rax, rdi
je 0x14007e357
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.authadmin.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14007e357
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.authadmin.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
lea rcx, str.Activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007e3de
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r13d, r13d
je 0x14007e3d5
mov rcx, qword [0x14022a710]
mov eax, dword [rcx + 0x1034]
sub eax, 2
cmp eax, 1
ja 0x14007e3d5
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14007e630
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
lea r9, [rax + 0xf95]
mov eax, dword [rax + 0x1034]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007e537
lea rcx, str.Activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007e4a5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x30], 0
je 0x14007e49c
lea rcx, str.netapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14007e49c
lea rdx, str.DsGetDcNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x14007e49c
mov rcx, qword [0x14022a710]
mov eax, dword [rcx + 0x1034]
sub eax, 2
cmp eax, 1
ja 0x14007e49c
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14007e6c7
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xf95]
mov eax, dword [rax + 0x1034]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
je 0x14007e537
lea rcx, str.Activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14007e7ed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x30], 0
jne 0x14007e52e
test r13d, r13d
jne 0x14007e52e
mov rcx, qword [0x14022a710]
mov eax, dword [rcx + 0x1034]
sub eax, 2
cmp eax, 1
ja 0x14007e52e
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14007e75e
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [0x14022a710]
lea r8, [rbp + 0x130]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rax + 0xf95]
mov eax, dword [rax + 0x1034]
mov dword [rsp + 0x20], eax
call rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
jne 0x14007e7ed
mov r8d, 0x104
lea rdx, [rbp + 0x230]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14007e57c
mov edx, 0x5c
lea rcx, [rbp + 0x230]
call fcn.140149b38
lea r8, str.logging.dll
mov edx, 0x104
lea rcx, [rbp + 0x230]
mov byte [rax], 0
call fcn.140150860
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14007e5b8
lea rdx, str.LOGLOGONUSER
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x38]
lea rcx, [rbp + 0x130]
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14007e5c8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14007e5d8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
je 0x14007e5e6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x14007e5f4
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x14007e602
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 2
mov r14, qword [rsp + 0x4a8]
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x450
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [rcx + 0xe20], 0
je 0x14007e6a7
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rbx, rbx
je 0x14007e6c0
test rax, rax
je 0x14007e6c0
cmp rax, rbx
je 0x14007e6c0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edi, edi
jmp 0x14007e3de
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
jmp 0x14007e3de
cmp dword [rcx + 0xe20], 0
je 0x14007e73e
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rbx, rbx
je 0x14007e757
test rax, rax
je 0x14007e757
cmp rax, rbx
je 0x14007e757
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauthnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edi, edi
jmp 0x14007e4a5
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauthnt4.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
jmp 0x14007e4a5
cmp dword [rcx + 0xe20], 0
je 0x14007e7d2
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rbx, rbx
je 0x14007e7eb
test rax, rax
je 0x14007e7eb
cmp rax, rbx
je 0x14007e7eb
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth9x.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edi, edi
jmp 0x14007e7ed
xor r9d, r9d
lea r8, [0x140228280]
lea rdx, str.ldapauth9x.dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
mov r8d, 0x104
lea rdx, [rbp + 0x230]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14007e832
mov edx, 0x5c
lea rcx, [rbp + 0x230]
call fcn.140149b38
lea r8, str.logging.dll
mov edx, 0x104
lea rcx, [rbp + 0x230]
mov byte [rax], 0
call fcn.140150860
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14007e86e
lea rdx, str.LOGFAILEDUSER
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x38]
lea rcx, [rbp + 0x130]
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14007e87e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14007e88e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
je 0x14007e89c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15, r15
je 0x14007e8aa
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x14007e8b8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
jmp 0x14007e607
xor eax, eax
jmp 0x14007e60f