Function at 0x1800287ec
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov esi, edx
mov dword [rbp - 0x11], 1
xor edx, edx
mov rdi, r8
mov dword [rbp - 0x71], edx
mov r14d, edx
mov qword [rbp - 0x69], rdx
mov r12d, edx
mov qword [rbp + 0xf], rdx
mov r13, rcx
mov qword [rbp + 7], rdx
mov qword [rsp + 0x50], rdx
mov dword [rbp - 0x75], edx
mov dword [rbp - 0x7d], edx
mov qword [rbp - 0x59], rdx
mov qword [rbp - 0x51], rdx
mov qword [rbp - 1], rdx
mov qword [rbp + 0x17], rdx
mov dword [rsp + 0x58], edx
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x180028886
test byte [rcx + 0x1c], 8
je 0x180028886
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x17]
lea r8, [0x180073228]
call fcn.18001171c
xor edx, edx
mov eax, esi
and eax, 0x10000
mov dword [rbp + 0x6f], eax
je 0x1800288a4
cmp dword [0x18008ba38], edx
je 0x1800288a4
mov eax, 0xe
jmp 0x18002a477
lea rax, [rbp + 0x17]
mov edx, 0x2000002
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x69]
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0xf]
lea rax, [rbp + 7]
lea ecx, [rdx - 2]
mov qword [rsp + 0x20], rax
call fcn.18003df00
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov r15d, eax
xor eax, eax
test ebx, ebx
jns 0x18002897c
bt esi, 0x13
jae 0x18002890f
test rdi, rdi
je 0x18002890f
mov r8d, 0x1c52
mov rdx, rdi
mov ecx, r15d
call fcn.18000dc90
jmp 0x180028922
mov r8d, 0x1c52
mov edx, r15d
mov ecx, 1
call fcn.180038d90
bt esi, 0x19
jae 0x180028943
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, r15d
mov dword [rsp + 0x20], eax
lea ecx, [rax + 0x1f]
call fcn.1800578e8
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x180028974
test byte [rcx + 0x1c], 8
je 0x180028974
mov rcx, qword [rcx + 0x10]
lea r8, [0x180073228]
mov edx, 0x18
mov r9d, r15d
call fcn.180011748
mov ecx, r15d
jmp 0x18002a472
mov ebx, 0xc
mov qword [rbp - 0x61], rbx
cmp dword [rbp + 0x6f], eax
je 0x180028a08
mov ecx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov rcx, qword [rax + rcx*8]
cmp dword [rcx + rbx], 2
je 0x1800289c0
mov eax, 0x10
lea r9, [rbp - 0x51]
lea r8, [rbp - 0x59]
lea rdx, [0x180073260]
mov rcx, qword [rax + rcx]
call fcn.180045460
test byte [rbp + 0x7f], 1
je 0x180028a0c
xor edx, edx
xor ecx, ecx
mov r8d, 0x1d06
call fcn.180038d90
mov r12d, 0x3e5
mov edi, r12d
bt esi, 0x19
jae 0x180029da0
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, r12d
mov dword [rsp + 0x20], eax
lea ecx, [rax + 7]
call fcn.1800578e8
jmp 0x180029da0
mov qword [rbp - 0x61], rbx
mov rcx, qword [rbp - 0x69]
lea r8, [rsp + 0x50]
mov edx, 1
call qword [sym.imp.SAMLIB.dll_SamQueryInformationDomain]
nop dword [rax + rax]
mov ecx, eax
mov dword [rbp - 0x79], eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov edi, eax
xor eax, eax
cmp dword [rbp - 0x79], eax
jl 0x180029312
xor edi, edi
cmp dword [rbp + 0x6f], edi
je 0x180028a91
mov ecx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov rcx, qword [rax + rcx*8]
cmp dword [rbx + rcx], 2
je 0x180028a91
mov edx, 0x100
lea ecx, [rdi + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r12, rax
test rax, rax
jne 0x180028a91
lea edx, [rdi + 8]
mov r8d, 0x1cf0
lea ecx, [rdi + 1]
call fcn.180038d90
cmp dword [r13 + 0xc], 0xfffffffe
je 0x180028aee
mov ecx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov rcx, qword [rax + rcx*8]
cmp dword [rbx + rcx], 2
jne 0x180028ab5
xor eax, eax
jmp 0x180028abd
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov r9d, esi
mov dword [rsp + 0x20], eax
lea r8, str.MinimumPasswordLength
mov rcx, r12
lea rdx, [rbp - 0x7d]
call fcn.180044ae0
mov rax, qword [rsp + 0x50]
movzx edx, word [r13 + 0xc]
cmp dx, word [rax]
je 0x180028aee
mov word [rax], dx
mov edi, 1
cmp dword [r13 + 0x14], 0xfffffffe
je 0x180028b51
mov ecx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov rcx, qword [rax + rcx*8]
cmp dword [rbx + rcx], 2
jne 0x180028b15
mov eax, 1
jmp 0x180028b1e
mov rax, qword [rsp + 0x50]
movzx eax, word [rax + 2]
mov r9d, esi
mov dword [rsp + 0x20], eax
lea r8, str.PasswordHistorySize
mov rcx, r12
lea rdx, [rbp - 0x7d]
call fcn.180044ae0
mov rdx, qword [rsp + 0x50]
movzx eax, word [r13 + 0x14]
cmp ax, word [rdx + 2]
je 0x180028b51
mov word [rdx + 2], ax
mov edi, 1
or r10d, 0xffffffff
movabs rdx, 0x29406b2a1a85bd43
movabs rax, 0xffffff36d5964000
mov r8d, 0x91a2b3c5
mov r9d, 0xaaaaaaab
cmp dword [r13 + 8], r10d
jne 0x180028c1d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
mov rax, rdx
imul rcx
sub rdx, rcx
mov rcx, qword gs:[0x58]
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, r8d
mul edx
mov eax, r9d
mov r9d, esi
shr edx, 0xb
mul edx
mov eax, dword [0x18008b2a0]
mov r14d, edx
lea rdx, [rbp - 0x7d]
shr r14d, 4
mov r8, qword [rcx + rax*8]
mov eax, r14d
mov ecx, 0x2a
cmp dword [rbx + r8], 2
lea r8, str.MaximumPasswordAge
cmove eax, ecx
mov rcx, r12
mov dword [rsp + 0x20], eax
call fcn.180044ae0
mov rax, qword [rsp + 0x50]
xor ecx, ecx
cmp dword [rax + 0xc], 0x80000000
jne 0x180028c09
cmp dword [rax + 8], ecx
je 0x180028cd1
mov dword [rax + 0xc], 0x80000000
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], ecx
jmp 0x180028ccc
cmp dword [r13 + 8], 0xfffffffe
je 0x180028cd1
mov ebx, dword [r13 + 8]
imul rbx, rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
movabs rax, 0x8000000000000000
mov qword [rbp - 9], rcx
cmp rcx, rax
jne 0x180028c51
mov r14d, r10d
jmp 0x180028c7c
mov rax, rdx
imul rcx
sub rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, r8d
mul edx
mov eax, r9d
shr edx, 0xb
mul edx
mov r14d, edx
shr r14d, 4
mov rcx, qword gs:[0x58]
mov r9d, esi
mov eax, dword [0x18008b2a0]
mov r8, qword [rbp - 0x61]
mov rdx, qword [rcx + rax*8]
mov eax, r14d
mov ecx, 0x2a
cmp dword [r8 + rdx], 2
lea r8, str.MaximumPasswordAge
lea rdx, [rbp - 0x7d]
cmove eax, ecx
mov rcx, r12
mov dword [rsp + 0x20], eax
call fcn.180044ae0
cmp rbx, qword [rbp - 9]
je 0x180028cd1
mov rax, qword [rsp + 0x50]
mov qword [rax + 8], rbx
mov edi, 1
mov eax, dword [r13 + 4]
cmp eax, 0xfffffffe
je 0x180028ded
xorps xmm0, xmm0
lea r9, [rsp + 0x58]
movups xmmword [rbp - 0x41], xmm0
lea r8, [rbp - 0x41]
mov dword [rbp - 0x39], 1
movups xmmword [rbp - 0x21], xmm0
lea rdx, str.MinimumPasswordAge
mov dword [rbp - 0x21], eax
lea rcx, str.Policy_Config_DeviceLock
mov dword [rbp - 0x41], 1
mov dword [rbp - 0x3d], 1
movups xmmword [rbp - 0x31], xmm0
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x58]
xor r8d, r8d
test eax, eax
cmovs ecx, r8d
mov dword [rsp + 0x58], ecx
test ecx, ecx
jne 0x180028df0
mov eax, dword [r13 + 4]
movabs rcx, 0xffffff36d5964000
imul rax, rcx
mov rcx, qword [rsp + 0x50]
mov r9d, esi
mov qword [rbp - 9], rax
movabs rax, 0x29406b2a1a85bd43
mov rbx, qword [rcx + 0x10]
imul rbx
mov eax, 0x91a2b3c5
sub rdx, rbx
sar rdx, 0x17
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov ecx, dword [0x18008b2a0]
mul edx
mov eax, 0xaaaaaaab
shr edx, 0xb
mul edx
mov rax, qword gs:[0x58]
mov r14d, edx
shr r14d, 4
mov rdx, qword [rax + rcx*8]
mov eax, r8d
mov rcx, qword [rbp - 0x61]
lea r8, str.MinimumPasswordAge
cmp dword [rcx + rdx], 2
lea rdx, [rbp - 0x7d]
mov rcx, r12
cmovne eax, r14d
mov dword [rsp + 0x20], eax
call fcn.180044ae0
mov rdx, qword [rbp - 9]
xor r8d, r8d
cmp rdx, rbx
je 0x180028df0
mov rax, qword [rsp + 0x50]
lea edi, [r8 + 1]
mov qword [rax + 0x10], rdx
jmp 0x180028df0
xor r8d, r8d
cmp dword [r13 + 0x10], 0xfffffffe
je 0x180028e64
mov rax, qword [rsp + 0x50]
mov r9d, esi
mov ecx, dword [0x18008b2a0]
mov r14d, dword [rax + 4]
mov rax, qword gs:[0x58]
and r14d, 1
mov rdx, qword [rax + rcx*8]
mov eax, r8d
mov rcx, qword [rbp - 0x61]
lea r8, str.PasswordComplexity
cmp dword [rcx + rdx], 2
lea rdx, [rbp - 0x7d]
mov rcx, r12
cmovne eax, r14d
mov dword [rsp + 0x20], eax
call fcn.180044ae0
xor r8d, r8d
cmp dword [r13 + 0x10], r14d
je 0x180028e67
mov rax, qword [rsp + 0x50]
test r14d, r14d
jne 0x180028e59
or dword [rax + 4], 1
jmp 0x180028e5d
and dword [rax + 4], 0xfffffffe
mov edi, 1
jmp 0x180028e67
xor r8d, r8d
cmp dword [r13 + 0x28], 0xfffffffe
je 0x180028edf
mov rax, qword [rsp + 0x50]
mov r14d, r8d
mov ecx, dword [0x18008b2a0]
mov r9d, esi
mov ebx, dword [rax + 4]
mov rax, qword gs:[0x58]
and ebx, 2
setne r14b
mov rdx, qword [rax + rcx*8]
mov eax, r8d
mov rcx, qword [rbp - 0x61]
lea r8, str.RequireLogonToChangePassword
cmp dword [rcx + rdx], 2
lea rdx, [rbp - 0x7d]
mov rcx, r12
cmovne eax, r14d
mov dword [rsp + 0x20], eax
call fcn.180044ae0
xor r9d, r9d
cmp dword [r13 + 0x28], r14d
je 0x180028ee2
mov rax, qword [rsp + 0x50]
test ebx, ebx
jne 0x180028ed4
or dword [rax + 4], 2
jmp 0x180028ed8
and dword [rax + 4], 0xfffffffd
mov edi, 1
jmp 0x180028ee2
xor r9d, r9d
cmp dword [r13 + 0x44], 0xfffffffe
je 0x180028f5d
mov rax, qword [rsp + 0x50]
mov r14d, r9d
mov ecx, dword [0x18008b2a0]
mov r8d, 0xc
mov ebx, dword [rax + 4]
mov rax, qword gs:[0x58]
and ebx, 0x10
setne r14b
mov rdx, qword [rax + rcx*8]
mov eax, r9d
mov r9d, esi
mov rcx, r12
cmp dword [r8 + rdx], 2
lea r8, str.ClearTextPassword
lea rdx, [rbp - 0x7d]
cmovne eax, r14d
mov dword [rsp + 0x20], eax
call fcn.180044ae0
xor r9d, r9d
cmp dword [r13 + 0x44], r14d
je 0x180028f60
mov rax, qword [rsp + 0x50]
test ebx, ebx
jne 0x180028f52
or dword [rax + 4], 0x10
jmp 0x180028f56
and dword [rax + 4], 0xffffffef
mov edi, 1
jmp 0x180028f60
xor r9d, r9d
cmp dword [r13 + 0x24], 0xfffffffe
je 0x180028fd6
mov rax, qword [rsp + 0x50]
mov r14d, r9d
mov ecx, dword [0x18008b2a0]
mov r8d, 0xc
mov ebx, dword [rax + 4]
mov rax, qword gs:[0x58]
and ebx, 8
setne r14b
mov rdx, qword [rax + rcx*8]
mov eax, r9d
mov r9d, esi
mov rcx, r12
cmp dword [r8 + rdx], 2
lea r8, str.AllowAdministratorLockout
lea rdx, [rbp - 0x7d]
cmovne eax, r14d
mov dword [rsp + 0x20], eax
call fcn.180044ae0
cmp dword [r13 + 0x24], r14d
je 0x180028fd6
mov rax, qword [rsp + 0x50]
test ebx, ebx
jne 0x180028fcd
or dword [rax + 4], 8
jmp 0x180028fd1
and dword [rax + 4], 0xfffffff7
mov edi, 1
mov ebx, dword [rbp + 0x6f]
xor r9d, r9d
test edi, edi
je 0x18002923d
test ebx, ebx
je 0x18002915b
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, 0xc
mov rax, qword [rax + rdx*8]
cmp dword [rcx + rax], 2
jne 0x18002915b
mov rcx, qword [0x18008b8a8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
nop dword [rax + rax]
test eax, eax
jne 0x180029075
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r8d, 0x1d5d
mov ecx, 1
mov edx, eax
mov edi, eax
mov r15d, eax
call fcn.180038d90
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov r8d, r15d
lea rcx, str._nTid__d_PP_could_not_Lock_event_due_to__d_n
mov edx, eax
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
mov r12d, dword [rbp - 0x71]
jmp 0x180029da3
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, eax
lea rcx, str._nTid_d_Policy_Propagation_Locked_event__n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
mov eax, dword [rbp + 0x7f]
test al, 1
jne 0x1800290b3
xor edx, edx
lea rcx, [rbp + 0x7f]
call fcn.180047804
mov eax, dword [rbp + 0x7f]
test al, 1
je 0x18002915b
xor edx, edx
xor ecx, ecx
mov r8d, 0x1d5a
call fcn.180038d90
mov rcx, qword [0x18008b8a8]
mov r12d, 0x3e5
mov edi, r12d
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
test eax, eax
jne 0x180029135
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x75], 1
mov ecx, 1
mov edi, eax
mov r15d, eax
mov edx, eax
mov r8d, 0x1d5e
call fcn.180038d90
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov r8d, edi
lea rcx, str._nTid__d_PP_could_not_Unlock_event_due_to__d_n
mov edx, eax
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
jmp 0x180029da3
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, eax
lea rcx, str._nTid__d_PP_Unlocked_event__n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
jmp 0x180029da3
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.SAMLIB.dll_SamSetInformationDomain]
nop dword [rax + rax]
mov ecx, eax
mov dword [rbp - 0x79], eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov r8d, 0xc
mov edi, eax
test ebx, ebx
je 0x18002929e
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
cmp dword [r8 + rax], 2
jne 0x180029246
mov rcx, qword [0x18008b8a8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
test eax, eax
jne 0x18002921a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r15d, eax
mov edi, eax
mov eax, 1
mov r8d, 0x1d5e
mov ecx, eax
mov dword [rbp - 0x75], eax
mov edx, r15d
call fcn.180038d90
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov r8d, r15d
lea rcx, str._nTid__d_PP_could_not_Unlock_event_due_to__d_n
mov edx, eax
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
jmp 0x180029240
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, eax
lea rcx, str._nTid__d_PP_Unlocked_event__n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
jmp 0x180029240
mov edi, r9d
mov r8d, 0xc
test ebx, ebx
je 0x18002929e
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, r8d
mov rax, qword [rax + rdx*8]
cmp dword [rcx + rax], 2
je 0x18002929e
xor ebx, ebx
test r12, r12
je 0x1800292b7
mov ebx, dword [rbp - 0x7d]
test ebx, ebx
je 0x18002929e
xor edx, edx
mov r9d, ebx
mov r8d, 0x1cf9
lea ecx, [rdx + 3]
call fcn.180038d90
mov rdx, qword [rbp - 0x51]
mov r9d, ebx
mov rcx, qword [rbp - 0x59]
mov r8, r12
mov dword [rsp + 0x20], edi
call fcn.180045084
xor ebx, ebx
test r12, r12
je 0x1800292b7
mov rcx, r12
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov r12d, ebx
mov rcx, qword [rsp + 0x50]
mov dword [rbp - 0x7d], ebx
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
mov qword [rsp + 0x50], rbx
cmp dword [rbp - 0x79], ebx
jge 0x18002930a
bt esi, 0x13
jae 0x1800292f3
mov rdx, qword [rbp + 0x77]
test rdx, rdx
je 0x1800292f3
mov r8d, 0x1bf2
mov ecx, edi
call fcn.18000dc90
jmp 0x180029305
mov r8d, 0x1bf2
mov edx, edi
mov ecx, 1
call fcn.180038d90
mov r15d, edi
jmp 0x180029344
mov r8d, 0x1bfd
jmp 0x180029338
xor ebx, ebx
bt esi, 0x13
jae 0x180029332
mov rdx, qword [rbp + 0x77]
test rdx, rdx
je 0x180029332
mov r8d, 0x1c71
mov ecx, edi
call fcn.18000dc90
jmp 0x180029344
mov r8d, 0x1c71
mov edx, edi
mov ecx, 1
call fcn.180038d90
mov eax, esi
and eax, 0x2000000
mov dword [rbp - 9], eax
je 0x180029392
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x180029374
mov dword [rsp + 0x28], ebx
lea ecx, [rax + 1]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov edx, edi
call fcn.1800578e8
mov eax, dword [rsp + 0x58]
mov ecx, 1
cmp eax, ecx
jne 0x180029392
mov dword [rsp + 0x28], ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov edx, edi
call fcn.1800578e8
mov rcx, qword [rbp - 0x69]
lea r8, [rsp + 0x50]
mov edx, 0xc
mov qword [rsp + 0x50], rbx
call qword [sym.imp.SAMLIB.dll_SamQueryInformationDomain]
nop dword [rax + rax]
mov ecx, eax
mov dword [rbp - 0x49], eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
xor r8d, r8d
mov edi, eax
test ebx, ebx
js 0x1800299c3
mov edi, r8d
cmp dword [rbp + 0x6f], r8d
je 0x18002942c
mov rdx, qword gs:[0x58]
mov r9d, dword [0x18008b2a0]
mov r9, qword [rdx + r9*8]
mov rdx, qword [rbp - 0x61]
cmp dword [rdx + r9], 2
je 0x180029430
mov edx, 0x80
lea ecx, [rdx - 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
xor r8d, r8d
mov r12, rax
test rax, rax
jne 0x18002942c
lea edx, [rax + 8]
mov r8d, 0x1cf0
lea ecx, [rax + 1]
call fcn.180038d90
xor r8d, r8d
mov rdx, qword [rbp - 0x61]
cmp dword [r13 + 0x18], 0xfffffffe
mov ebx, r8d
mov dword [rbp - 0x79], ebx
je 0x18002949c
mov ecx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov rcx, qword [rax + rcx*8]
cmp dword [rdx + rcx], 2
jne 0x18002945b
mov eax, r8d
jmp 0x180029464
mov rax, qword [rsp + 0x50]
movzx eax, word [rax + 0x10]
mov r9d, esi
mov dword [rsp + 0x20], eax
lea r8, str.LockoutBadCount
mov rcx, r12
lea rdx, [rbp - 0x7d]
call fcn.180044ae0
mov rdx, qword [rsp + 0x50]
xor r8d, r8d
movzx eax, word [r13 + 0x18]
cmp word [rdx + 0x10], ax
je 0x18002949c
lea ebx, [r8 + 1]
mov word [rdx + 0x10], ax
mov dword [rbp - 0x79], ebx
cmp dword [r13 + 0x1c], 0xfffffffe
movabs rax, 0xe35dec27bf45082b
mov r9d, 0x1e
je 0x180029549
mov rcx, qword [rsp + 0x50]
cmp word [rcx + 0x10], r8w
jbe 0x180029549
imul qword [rcx + 8]
mov rcx, qword gs:[0x58]
lea r8, str.ResetLockoutCount
mov r14, rdx
sar r14, 0x1a
mov rax, r14
shr rax, 0x3f
add r14, rax
mov eax, dword [0x18008b2a0]
mov rdx, qword [rcx + rax*8]
mov eax, r14d
mov rcx, qword [rbp - 0x61]
cmp dword [rcx + rdx], 2
lea rdx, [rbp - 0x7d]
mov rcx, r12
cmove eax, r9d
mov r9d, esi
mov dword [rsp + 0x20], eax
call fcn.180044ae0
mov r9d, 0x1e
cmp r14d, dword [r13 + 0x1c]
je 0x18002953f
mov eax, dword [r13 + 0x1c]
lea ebx, [r9 - 0x1d]
imul rcx, rax, 0xffffffffdc3cba00
mov rax, qword [rsp + 0x50]
mov dword [rbp - 0x79], ebx
mov qword [rax + 8], rcx
movabs rax, 0xe35dec27bf45082b
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
cmp word [rcx + 0x10], r8w
jbe 0x180029622
mov edx, dword [r13 + 0x20]
cmp edx, 0xfffffffe
je 0x1800295ba
imul qword [rcx]
mov rcx, qword gs:[0x58]
lea r8, str.LockoutDuration
mov eax, dword [0x18008b2a0]
sar rdx, 0x1a
mov r14, rdx
shr r14, 0x3f
add r14, rdx
mov rdx, qword [rcx + rax*8]
mov eax, 0xc
mov ecx, r14d
cmp dword [rax + rdx], 2
lea rdx, [rbp - 0x7d]
cmove ecx, r9d
mov r9d, esi
mov dword [rsp + 0x20], ecx
mov rcx, r12
call fcn.180044ae0
mov edx, dword [r13 + 0x20]
xor r8d, r8d
cmp edx, 0xffffffff
jne 0x1800295f2
cmp dword [rsp + 0x58], r8d
jne 0x18002967c
mov rcx, qword [rsp + 0x50]
cmp dword [rcx + 4], 0x80000000
jne 0x1800295e1
cmp dword [rcx], r8d
je 0x18002967c
mov dword [rcx + 4], 0x80000000
mov rax, qword [rsp + 0x50]
mov dword [rax], r8d
jmp 0x180029618
cmp edx, 0xfffffffe
je 0x18002967c
cmp dword [rsp + 0x58], r8d
jne 0x18002967c
cmp r14d, edx
je 0x18002967c
mov eax, edx
imul rcx, rax, 0xffffffffdc3cba00
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov ebx, 1
mov dword [rbp - 0x79], ebx
jmp 0x18002967c
mov r9d, esi
mov dword [rsp + 0x20], 0xfffffffe
lea r8, str.ResetLockoutCount
mov rcx, r12
lea rdx, [rbp - 0x7d]
call fcn.180044ae0
mov r14d, 0xfffffffe
lea r8, str.LockoutDuration
mov r9d, esi
mov dword [rsp + 0x20], r14d
mov rcx, r12
lea rdx, [rbp - 0x7d]
call fcn.180044ae0
mov r9d, esi
mov dword [rsp + 0x20], r14d
mov rcx, r12
lea r8, str.AllowAdministratorLockout
lea rdx, [rbp - 0x7d]
call fcn.180044ae0
xor r14d, r14d
test ebx, ebx
je 0x1800298e6
cmp dword [rbp + 0x6f], r14d
je 0x1800297ff
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, 0xc
mov rax, qword [rax + rdx*8]
cmp dword [rcx + rax], 2
jne 0x1800297ff
mov rcx, qword [0x18008b8a8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
nop dword [rax + rax]
test eax, eax
jne 0x180029718
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r8d, 0x1d5d
lea ecx, [r14 + 1]
mov edx, eax
mov edi, eax
mov r15d, eax
call fcn.180038d90
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov r8d, r15d
lea rcx, str._nTid__d_PP_could_not_Lock_event_due_to__d_n
mov edx, eax
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
mov r12d, r14d
jmp 0x180029da0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, eax
lea rcx, str._nTid_d_Policy_Propagation_Locked_event__n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
mov eax, dword [rbp + 0x7f]
test al, 1
jne 0x180029756
xor edx, edx
lea rcx, [rbp + 0x7f]
call fcn.180047804
mov eax, dword [rbp + 0x7f]
test al, 1
je 0x1800297ff
xor edx, edx
xor ecx, ecx
mov r8d, 0x1d5a
call fcn.180038d90
mov rcx, qword [0x18008b8a8]
mov r12d, 0x3e5
mov edi, r12d
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
test eax, eax
jne 0x1800297d9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r14d, 1
mov r8d, 0x1d5e
mov edx, eax
mov dword [rbp - 0x75], r14d
mov ecx, r14d
mov edi, eax
mov r15d, eax
call fcn.180038d90
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov r8d, r15d
lea rcx, str._nTid__d_PP_could_not_Unlock_event_due_to__d_n
mov edx, eax
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
jmp 0x180029da0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, eax
lea rcx, str._nTid__d_PP_Unlocked_event__n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
jmp 0x180029da0
mov r8, qword [rsp + 0x50]
mov edx, 0xc
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.SAMLIB.dll_SamSetInformationDomain]
nop dword [rax + rax]
mov ecx, eax
mov r14d, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
xor r8d, r8d
mov edi, eax
cmp dword [rbp + 0x6f], r8d
je 0x18002994e
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov r9d, 0xc
mov rax, qword [rax + rdx*8]
cmp dword [r9 + rax], 2
jne 0x1800298f3
mov rcx, qword [0x18008b8a8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
test eax, eax
jne 0x1800298c3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r15d, eax
mov edi, eax
mov eax, 1
mov r8d, 0x1d5e
mov ecx, eax
mov dword [rbp - 0x75], eax
mov edx, r15d
call fcn.180038d90
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov r8d, r15d
lea rcx, str._nTid__d_PP_could_not_Unlock_event_due_to__d_n
mov edx, eax
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
jmp 0x1800298ea
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, eax
lea rcx, str._nTid__d_PP_Unlocked_event__n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
jmp 0x1800298ea
mov r14d, dword [rbp - 0x49]
xor r8d, r8d
mov r9d, 0xc
cmp dword [rbp + 0x6f], r8d
je 0x18002994e
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, r9d
mov rax, qword [rax + rdx*8]
cmp dword [rcx + rax], 2
je 0x18002994e
test r12, r12
je 0x180029962
mov ebx, dword [rbp - 0x7d]
test ebx, ebx
je 0x18002994b
xor edx, edx
mov r9d, ebx
mov r8d, 0x1cf9
lea ecx, [rdx + 3]
call fcn.180038d90
mov rdx, qword [rbp - 0x51]
mov r9d, ebx
mov rcx, qword [rbp - 0x59]
mov r8, r12
mov dword [rsp + 0x20], edi
call fcn.180045084
mov ebx, dword [rbp - 0x79]
test r12, r12
je 0x180029962
mov rcx, r12
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
xor ecx, ecx
mov qword [rsp + 0x50], rcx
test r14d, r14d
jns 0x1800299b7
bt esi, 0x13
jae 0x1800299a0
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x1800299a0
mov r8d, 0x1bf2
mov rdx, rax
mov ecx, edi
call fcn.18000dc90
jmp 0x1800299b2
mov r8d, 0x1bf0
mov edx, edi
mov ecx, 1
call fcn.180038d90
mov r15d, edi
jmp 0x1800299f6
test ebx, ebx
je 0x1800299f6
mov r8d, 0x1bf8
jmp 0x1800299ea
bt esi, 0x13
jae 0x1800299e4
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x1800299e4
mov r8d, 0x1c6e
mov rdx, rax
mov ecx, edi
call fcn.18000dc90
jmp 0x1800299f6
mov r8d, 0x1c6e
mov edx, edi
mov ecx, 1
call fcn.180038d90
mov r12d, dword [rbp - 9]
xor ebx, ebx
test r12d, r12d
je 0x180029a42
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x180029a25
mov dword [rsp + 0x28], ebx
lea ecx, [rbx + 2]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov edx, edi
call fcn.1800578e8
mov eax, dword [rsp + 0x58]
cmp eax, 1
jne 0x180029a42
mov dword [rsp + 0x28], eax
lea ecx, [rax + 1]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov edx, edi
call fcn.1800578e8
cmp dword [r13 + 0x2c], 0xfffffffe
je 0x180029d98
mov rcx, qword [rbp - 0x69]
lea r8, [rsp + 0x50]
mov edx, 3
mov qword [rsp + 0x50], rbx
call qword [sym.imp.SAMLIB.dll_SamQueryInformationDomain]
nop dword [rax + rax]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
xor r8d, r8d
mov edi, eax
test ebx, ebx
js 0x180029d3f
mov r14d, dword [r13 + 0x2c]
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x50]
mov edi, r8d
mov eax, r8d
cmp r14d, edx
jne 0x180029ab5
cmp dword [rcx + 4], r8d
jne 0x180029aac
cmp dword [rcx], r8d
je 0x180029ad7
mov r14d, r8d
mov dword [rcx + 4], r8d
jmp 0x180029acd
cmp dword [rcx + 4], 0x80000000
jne 0x180029ac3
cmp dword [rcx], r8d
je 0x180029ad7
mov r14d, edx
mov dword [rcx + 4], 0x80000000
mov rax, qword [rsp + 0x50]
mov dword [rax], r8d
mov eax, edx
test eax, eax
je 0x180029c9b
mov ebx, dword [rbp + 0x6f]
test ebx, ebx
je 0x180029bb7
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, 0xc
mov rax, qword [rax + rdx*8]
cmp dword [rcx + rax], 2
jne 0x180029bb7
mov rcx, qword [0x18008b8a8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
nop dword [rax + rax]
test eax, eax
je 0x180029025
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, eax
lea rcx, str._nTid_d_Policy_Propagation_Locked_event__n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
mov eax, dword [rbp + 0x7f]
test al, 1
jne 0x180029b61
xor edx, edx
lea rcx, [rbp + 0x7f]
call fcn.180047804
mov eax, dword [rbp + 0x7f]
test al, 1
je 0x180029bb7
xor edx, edx
xor ecx, ecx
mov r8d, 0x1d5a
call fcn.180038d90
mov rcx, qword [0x18008b8a8]
mov r12d, 0x3e5
mov edi, r12d
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
test eax, eax
jne 0x180029135
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r15d, eax
mov edi, eax
mov eax, 1
mov edx, r15d
mov dword [rbp - 0x75], eax
mov ecx, eax
jmp 0x180029101
mov r8, qword [rsp + 0x50]
mov edx, 3
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.SAMLIB.dll_SamSetInformationDomain]
nop dword [rax + rax]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov r8d, dword [rbp + 0x6f]
mov edi, eax
mov r10d, 0xc
test r8d, r8d
je 0x180029ce3
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
cmp dword [r10 + rax], 2
jne 0x180029ca5
mov rcx, qword [0x18008b8a8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
test eax, eax
jne 0x180029c7a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r15d, eax
mov edi, eax
mov eax, 1
mov r8d, 0x1d5e
mov ecx, eax
mov dword [rbp - 0x75], eax
mov edx, r15d
call fcn.180038d90
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov r8d, r15d
lea rcx, str._nTid__d_PP_could_not_Unlock_event_due_to__d_n
mov edx, eax
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
jmp 0x180029c9b
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, eax
lea rcx, str._nTid__d_PP_Unlocked_event__n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
mov r8d, dword [rbp + 0x6f]
mov r10d, 0xc
test r8d, r8d
je 0x180029ce3
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, r10d
mov rax, qword [rax + rdx*8]
cmp dword [rcx + rax], 2
je 0x180029ce3
mov rdx, qword [rbp - 0x51]
lea r8, str.ForceLogoffWhenHourExpire
mov rcx, qword [rbp - 0x59]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
call fcn.180044c30
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
xor ecx, ecx
mov qword [rsp + 0x50], rcx
test ebx, ebx
jns 0x180029d37
bt esi, 0x13
jae 0x180029d20
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x180029d20
mov r8d, 0x1bf1
mov rdx, rax
mov ecx, edi
call fcn.18000dc90
jmp 0x180029d32
mov r8d, 0x1bf1
mov edx, edi
mov ecx, 1
call fcn.180038d90
mov r15d, edi
jmp 0x180029d72
mov r8d, 0x1bf9
jmp 0x180029d66
bt esi, 0x13
jae 0x180029d60
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x180029d60
mov r8d, 0x1c6f
mov rdx, rax
mov ecx, edi
call fcn.18000dc90
jmp 0x180029d72
mov r8d, 0x1c6f
mov edx, edi
mov ecx, 1
call fcn.180038d90
xor ecx, ecx
test r12d, r12d
je 0x180029d9d
mov dword [rsp + 0x28], ecx
xor r9d, r9d
mov dword [rsp + 0x20], ecx
xor r8d, r8d
mov edx, edi
lea ecx, [r9 + 4]
call fcn.1800578e8
mov r12d, dword [rbp - 0x71]
jmp 0x180029da0
mov r12d, ebx
jmp 0x180029da0
mov r12d, ecx
mov ebx, dword [rbp + 0x6f]
mov rcx, qword [rsp + 0x50]
xor eax, eax
test rcx, rcx
je 0x180029dc2
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
xor eax, eax
mov qword [rsp + 0x50], rax
mov r14, qword [rbp + 7]
test ebx, ebx
je 0x180029ddd
cmp dword [0x18008ba38], eax
je 0x180029ddd
mov r15d, 0xe
jmp 0x18002a392
mov rcx, qword [r13 + 0x30]
xor ebx, ebx
test rcx, rcx
je 0x180029f2d
xorps xmm0, xmm0
mov dword [rsp + 0x58], ebx
movdqu xmmword [rbp - 0x35], xmm0
mov dword [rbp - 0x25], ebx
mov dword [rbp - 0x15], ebx
mov dword [rbp - 0x39], 2
mov qword [rbp - 0x21], rcx
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x41]
lea rdx, str.Accounts_RenameAdministratorAccount
lea eax, [rax*2 + 2]
mov dword [rbp - 0x19], eax
lea rcx, str.Policy_Config_LocalPoliciesSecurityOptions
lea eax, [rbx + 1]
mov dword [rbp - 0x41], eax
mov dword [rbp - 0x3d], eax
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x58]
test eax, eax
cmovs ecx, ebx
mov dword [rsp + 0x58], ecx
test ecx, ecx
jne 0x180029f09
mov rax, qword [rbp - 0x51]
xor r8d, r8d
mov r9, qword [r13 + 0x30]
mov rdx, r14
mov rcx, qword [rbp - 0x69]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x59]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebx
call fcn.18002baa8
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
xor ecx, ecx
mov edi, eax
test ebx, ebx
js 0x180029ec5
mov r9, qword [r13 + 0x30]
xor edx, edx
mov r8d, 0x1bff
call fcn.180038d90
jmp 0x180029efb
bt esi, 0x13
jae 0x180029ee6
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x180029ee6
mov r8d, 0x1bea
mov rdx, rax
mov ecx, edi
call fcn.18000dc90
jmp 0x180029ef8
mov r8d, 0x1bea
mov edx, edi
mov ecx, 1
call fcn.180038d90
mov r15d, edi
xor ebx, ebx
bt esi, 0x19
jae 0x180029f2d
mov dword [rsp + 0x28], ebx
jmp 0x180029f18
bt esi, 0x19
jae 0x180029f2d
cmp ecx, 1
jne 0x180029f2d
mov dword [rsp + 0x28], ecx
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov edx, edi
lea ecx, [r9 + 8]
call fcn.1800578e8
mov rcx, qword [r13 + 0x38]
test rcx, rcx
je 0x18002a07c
xorps xmm0, xmm0
mov dword [rsp + 0x58], ebx
movdqu xmmword [rbp - 0x35], xmm0
mov dword [rbp - 0x25], ebx
mov dword [rbp - 0x15], ebx
mov dword [rbp - 0x39], 2
mov qword [rbp - 0x21], rcx
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x41]
lea rdx, str.Accounts_RenameGuestAccount
lea eax, [rax*2 + 2]
mov dword [rbp - 0x19], eax
lea rcx, str.Policy_Config_LocalPoliciesSecurityOptions
mov eax, 1
mov dword [rbp - 0x41], eax
mov dword [rbp - 0x3d], eax
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x58]
test eax, eax
cmovs ecx, ebx
mov dword [rsp + 0x58], ecx
test ecx, ecx
jne 0x18002a059
mov rax, qword [rbp - 0x51]
xor r8d, r8d
mov r9, qword [r13 + 0x38]
mov rdx, r14
mov rcx, qword [rbp - 0x69]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x59]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ebx
call fcn.18002baa8
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
xor ecx, ecx
mov edi, eax
test ebx, ebx
js 0x18002a015
mov r9, qword [r13 + 0x38]
xor edx, edx
mov r8d, 0x1c00
call fcn.180038d90
jmp 0x18002a04b
bt esi, 0x13
jae 0x18002a036
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x18002a036
mov r8d, 0x1bed
mov rdx, rax
mov ecx, edi
call fcn.18000dc90
jmp 0x18002a048
mov r8d, 0x1bed
mov edx, edi
mov ecx, 1
call fcn.180038d90
mov r15d, edi
xor ebx, ebx
bt esi, 0x19
jae 0x18002a07c
mov dword [rsp + 0x28], ebx
jmp 0x18002a067
bt esi, 0x19
jae 0x18002a07c
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov edx, edi
lea ecx, [r9 + 0x10]
call fcn.1800578e8
mov ecx, dword [r13 + 0xf8]
cmp ecx, 0xfffffffe
je 0x18002a1fd
xorps xmm0, xmm0
lea r9, [rsp + 0x58]
mov edx, 1
lea r8, [rbp - 0x41]
movups xmmword [rbp - 0x41], xmm0
test ecx, ecx
mov dword [rbp - 0x39], edx
mov eax, ebx
mov dword [rbp - 0x41], edx
setne al
mov dword [rbp - 0x3d], edx
movups xmmword [rbp - 0x21], xmm0
lea rdx, str.Accounts_EnableAdministratorAccountStatus
mov dword [rbp - 0x21], eax
lea rcx, str.Policy_Config_LocalPoliciesSecurityOptions
movups xmmword [rbp - 0x31], xmm0
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x58]
test eax, eax
cmovs ecx, ebx
mov dword [rsp + 0x58], ecx
test ecx, ecx
jne 0x18002a1d8
cmp dword [r13 + 0xf8], ebx
lea rcx, [rbp - 0x11]
mov r8, qword [rbp - 1]
mov eax, ebx
mov qword [rsp + 0x48], rcx
setbe al
mov rcx, qword [rbp - 0x51]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
mov rdx, r14
mov rcx, qword [rbp - 0x59]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbp - 0x69]
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], eax
call fcn.18002baa8
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
xor ecx, ecx
mov edi, eax
test ebx, ebx
js 0x18002a179
cmp dword [rbp - 0x11], ecx
je 0x18002a16a
mov eax, dword [r13 + 0xf8]
neg eax
sbb r8d, r8d
neg r8d
add r8d, 0x1c09
jmp 0x18002a170
mov r8d, 0x1be2
xor edx, edx
call fcn.180038d90
jmp 0x18002a1c6
bt esi, 0x13
jae 0x18002a19a
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x18002a19a
mov r8d, 0x1d4c
mov rdx, rax
mov ecx, edi
call fcn.18000dc90
jmp 0x18002a1c3
cmp ebx, 0xc0000124
jne 0x18002a1b1
xor edx, edx
mov r8d, 0x1be2
call fcn.180038d90
jmp 0x18002a1c3
mov r8d, 0x1d4c
mov edx, edi
mov ecx, 1
call fcn.180038d90
mov r15d, edi
bt esi, 0x19
jae 0x18002a1fd
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
jmp 0x18002a1eb
bt esi, 0x19
jae 0x18002a1fd
cmp ecx, 1
jne 0x18002a1fd
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov ecx, 0x80000
call fcn.1800578e8
mov edx, dword [r13 + 0xfc]
cmp edx, 0xfffffffe
je 0x18002a38f
xorps xmm0, xmm0
lea r9, [rsp + 0x58]
movups xmmword [rbp - 0x41], xmm0
xor ebx, ebx
mov dword [rbp - 0x39], 1
test edx, edx
mov dword [rsp + 0x58], ebx
mov eax, ebx
mov dword [rbp - 0x41], 1
setne al
mov dword [rbp - 0x3d], 1
movups xmmword [rbp - 0x21], xmm0
lea r8, [rbp - 0x41]
mov dword [rbp - 0x21], eax
lea rdx, str.Accounts_EnableGuestAccountStatus
lea rcx, str.Policy_Config_LocalPoliciesSecurityOptions
movups xmmword [rbp - 0x31], xmm0
call qword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_2.dll_MDMWinsOverGP_IsGPPolicySetByMDMEx]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x58]
test eax, eax
cmovs ecx, ebx
mov dword [rsp + 0x58], ecx
test ecx, ecx
jne 0x18002a36b
mov rcx, qword [rbp - 0x51]
mov eax, ebx
cmp dword [r13 + 0xfc], ebx
mov rdx, r14
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rcx
setbe al
mov rcx, qword [rbp - 0x59]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov rcx, qword [rbp - 0x69]
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], eax
call fcn.18002baa8
mov ecx, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
xor ecx, ecx
mov ebx, eax
test edi, edi
js 0x18002a2f7
mov ecx, dword [r13 + 0xfc]
neg ecx
sbb r8d, r8d
xor edx, edx
neg r8d
xor ecx, ecx
add r8d, 0x1c0b
call fcn.180038d90
jmp 0x18002a344
bt esi, 0x13
jae 0x18002a318
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x18002a318
mov r8d, 0x1d4d
mov rdx, rax
mov ecx, ebx
call fcn.18000dc90
jmp 0x18002a341
cmp edi, 0xc0000124
jne 0x18002a32f
xor edx, edx
mov r8d, 0x1be3
call fcn.180038d90
jmp 0x18002a341
mov r8d, 0x1d4d
mov edx, ebx
mov ecx, 1
call fcn.180038d90
mov r15d, ebx
xor edi, edi
bt esi, 0x19
jae 0x18002a366
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov edx, ebx
mov ecx, 0x100000
call fcn.1800578e8
mov ebx, dword [rbp + 0x6f]
jmp 0x18002a394
bt esi, 0x19
jae 0x18002a38f
mov dword [rsp + 0x28], 1
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov edx, edi
mov ecx, 0x100000
call fcn.1800578e8
mov ebx, dword [rbp + 0x6f]
xor edi, edi
cmp qword [rbp - 0x59], rdi
je 0x18002a3a8
mov edx, 1
lea rcx, [rbp - 0x59]
call fcn.18004cd24
cmp qword [rbp - 0x51], rdi
je 0x18002a3bc
mov edx, 1
lea rcx, [rbp - 0x51]
call fcn.18004cd24
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.SAMLIB.dll_SamCloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.SAMLIB.dll_SamCloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x18002a3f1
call qword [sym.imp.SAMLIB.dll_SamCloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x18002a406
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
test r14, r14
je 0x18002a41a
mov rcx, r14
call qword [sym.imp.SAMLIB.dll_SamFreeMemory]
nop dword [rax + rax]
test r15d, r15d
cmovne r12d, r15d
test ebx, ebx
je 0x18002a43e
cmp dword [rbp - 0x75], 1
jne 0x18002a43e
mov rcx, qword [0x18008b8a8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x18002a46f
test byte [rcx + 0x1c], 8
je 0x18002a46f
mov rcx, qword [rcx + 0x10]
lea r8, [0x180073228]
mov edx, 0x19
mov r9d, r12d
call fcn.180011748
mov ecx, r12d
call fcn.18000ec90
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret