Function at 0x140001a20
Capabilities:
Enumerate pe sections
Extract resource via kernel32 functions

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x448]
sub rsp, 0x548
mov rax, rdx
xor edx, edx
cmp ecx, 2
jl 0x140001a4d
mov rcx, qword [rax + 8]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x140001a60
mov r8d, 0x801
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
test rax, rax
jne 0x140001a78
lea eax, [r12 - 1]
add rsp, 0x548
pop r12
pop rbp
ret
mov qword [rsp + 0x568], rbx
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x540], rsi
mov qword [rsp + 0x538], rdi
mov qword [rsp + 0x530], r13
mov qword [rsp + 0x528], r14
xor r14d, r14d
mov qword [rsp + 0x520], r15
mov ebx, r14d
movsxd r15, dword [r12 + 0x3c]
add r15, r12
mov qword [rbp - 0x68], rcx
movzx eax, word [r15 + 0x14]
lea rdi, [r15 + 0x18]
add rdi, rax
mov qword [rbp + 0x478], rdi
cmp r14w, word [r15 + 6]
jae 0x140001b2b
lea rsi, str..rdata
mov dword [rsp + 0x28], ecx
xor edx, edx
mov r9d, ecx
mov qword [rsp + 0x20], rsi
mov r8, rdi
lea ecx, [rdx + 0x7f]
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x140001b22
movzx eax, word [r15 + 6]
add rdi, 0x28
inc rbx
mov qword [rbp + 0x478], rdi
mov rcx, 0xffffffffffffffff
cmp rbx, rax
jb 0x140001ae2
jmp 0x140001b2b
test rdi, rdi
jne 0x140001b98
lea rcx, [rdi - 1]
movzx edi, word [r15 + 0x14]
mov rbx, r14
add rdi, 0x18
add rdi, r15
mov qword [rbp + 0x478], rdi
cmp r14w, word [r15 + 6]
jae 0x140001b8e
lea rsi, str..text
nop
mov dword [rsp + 0x28], ecx
xor edx, edx
mov r9d, ecx
mov qword [rsp + 0x20], rsi
mov r8, rdi
lea ecx, [rdx + 0x7f]
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x140001b98
movzx eax, word [r15 + 6]
add rdi, 0x28
inc rbx
mov qword [rbp + 0x478], rdi
mov rcx, 0xffffffffffffffff
cmp rbx, rax
jb 0x140001b50
mov rdi, r14
mov qword [rbp + 0x478], r14
mov r9d, dword [rdi + 0xc]
mov rax, r14
mov edi, dword [rdi + 0x10]
mov qword [rbp + 0x470], r9
lea rsi, [r9 + r12]
test rdi, rdi
je 0x140001be7
movzx ecx, byte [0x140004980]
mov rdx, qword [0x140004978]
mov r8, qword [str.CDefPolicy::Query]
cmp qword [rax + rsi], r8
jne 0x140001bde
cmp qword [rax + rsi + 8], rdx
jne 0x140001bde
cmp byte [rax + rsi + 0x10], cl
je 0x140001dc5
add rax, 4
cmp rax, rdi
jb 0x140001bc7
mov rax, 0xffffffffffffffff
mov rbx, r14
mov qword [rbp - 0x60], rax
mov r13, rsi
mov r14, rdi
test rdi, rdi
je 0x140001c2e
lea rcx, [rbx + r13]
mov r8d, 0x29
lea rdx, str.CEnforcementCore::GetInstanceOfTSLicense
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001ddb
add rbx, 4
cmp rbx, r14
jb 0x140001c00
mov rax, 0xffffffffffffffff
xor ebx, ebx
mov qword [rbp - 0x58], rax
mov r13, rsi
mov r14, rdi
test rdi, rdi
je 0x140001c6e
nop
lea rcx, [rbx + r13]
mov r8d, 0x38
lea rdx, str.CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001df6
add rbx, 4
cmp rbx, r14
jb 0x140001c40
mov rax, 0xffffffffffffffff
xor ebx, ebx
mov qword [rsp + 0x50], rax
mov r13, rsi
mov r14, rdi
test rdi, rdi
je 0x140001cae
lea rcx, [rbx + r13]
mov r8d, 0x17
lea rdx, str.IsSingleSessionPerUser
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001e12
add rbx, 4
cmp rbx, r14
jb 0x140001c80
mov rax, 0xffffffffffffffff
mov r14, qword [rbp + 0x470]
movabs rcx, 0x3a3a736c69745543
mov qword [rsp + 0x60], rax
cmp qword [rax + r12 - 8], rcx
jne 0x140001cd4
sub rax, 8
mov qword [rsp + 0x60], rax
xor r13d, r13d
mov ebx, r13d
test rdi, rdi
je 0x140001d07
nop
lea rcx, [rbx + rsi]
mov r8d, 0x21
lea rdx, str.CSLQuery::IsTerminalTypeLocalOnly
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001e22
add rbx, 4
cmp rbx, rdi
jb 0x140001ce0
mov rbx, r13
mov r13, 0xffffffffffffffff
mov qword [rsp + 0x58], r13
test rdi, rdi
je 0x140001d47
nop dword [rax + rax]
lea rcx, [rbx + rsi]
mov r8d, 0x80
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowRemoteConnections
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001e3a
add rbx, 4
cmp rbx, rdi
jb 0x140001d20
mov qword [rbp - 0x70], r13
mov ebx, dword [r15 + 0x90]
add rbx, r12
cmp dword [rbx + 0xc], 0
je 0x140001d85
nop dword [rax + rax]
mov ecx, dword [rbx + 0xc]
lea rdx, str.msvcrt.dll
add rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001e47
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140001d60
mov eax, 0xfffffffe
mov r14, qword [rsp + 0x528]
mov r13, qword [rsp + 0x530]
mov rdi, qword [rsp + 0x538]
mov rsi, qword [rsp + 0x540]
mov rbx, qword [rsp + 0x568]
mov r15, qword [rsp + 0x520]
add rsp, 0x548
pop r12
pop rbp
ret
lea rcx, [rax + r9]
mov rbx, r14
mov qword [rbp - 0x60], rcx
mov r13, rsi
mov r14, rdi
jmp 0x140001c00
mov rcx, qword [rbp + 0x470]
mov r13, rsi
add rcx, rbx
mov r14, rdi
mov qword [rbp - 0x58], rcx
xor ebx, ebx
jmp 0x140001c40
mov rax, qword [rbp + 0x470]
mov r13, rsi
add rax, rbx
mov r14, rdi
mov qword [rsp + 0x50], rax
xor ebx, ebx
jmp 0x140001c80
mov r14, qword [rbp + 0x470]
lea rax, [rbx + r14]
jmp 0x140001cb5
lea rax, [rbx + r14]
mov rbx, r13
mov qword [rsp + 0x58], rax
mov r13, 0xffffffffffffffff
jmp 0x140001d20
lea rax, [rbx + r14]
mov qword [rbp - 0x70], rax
jmp 0x140001d4b
mov edi, dword [rbx]
add rdi, r12
mov rax, qword [rdi]
test rax, rax
je 0x140001e85
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rax + 2]
add rcx, r12
lea rdx, [0x140004494]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001ebc
mov rax, qword [rdi + 8]
add rdi, 8
test rax, rax
jne 0x140001e60
mov qword [rsp + 0x68], r13
mov eax, dword [r15 + 0xa0]
add rax, r12
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaab
mul dword [r15 + 0xa4]
mov ebx, edx
shr ebx, 3
mov dword [rbp + 0x470], ebx
test ebx, ebx
jne 0x140001ed1
lea eax, [rbx - 3]
jmp 0x140001d8a
mov ecx, dword [rbx + 0x10]
mov eax, dword [rbx]
sub rcx, rax
sub rcx, r12
add rcx, rdi
mov qword [rsp + 0x68], rcx
jmp 0x140001e8a
xor r15d, r15d
lea rcx, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x30], r15
mov edi, r15d
mov qword [rsp + 0x38], r15
mov r14d, r15d
mov qword [rsp + 0x40], r15
lea r8d, [r15 + 2]
mov r13d, r15d
mov esi, r15d
call qword [sym.imp.Zydis.dll_ZydisDecoderInit]
mov rax, qword [rbp + 0x470]
mov edx, r15d
mov dword [rbp + 0x460], edx
mov qword [rsp + 0x70], rax
test ebx, ebx
je 0x140002243
mov rcx, qword [rsp + 0x48]
mov eax, edx
mov rdi, rcx
mov ebx, edx
test rax, rax
jne 0x140001f9f
mov r9, qword [rbp - 0x60]
lea rax, [rbx + rbx*2]
lea r8, [rcx + rax*4]
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140001070
test rax, rax
je 0x140001f9a
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x140001f5f
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x140001f8e
nop word [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x140001f70
mov eax, dword [rax]
mov qword [rsp + 0x30], rax
jmp 0x1400021f3
mov rcx, qword [rsp + 0x48]
lea rbx, [rbx + rbx*2]
shl rbx, 2
cmp qword [rsp + 0x38], r15
jne 0x14000201f
mov r9, qword [rbp - 0x58]
lea r8, [rbx + rcx]
lea rcx, [rsp + 0x78]
mov rdx, r12
call fcn.140001070
test rax, rax
je 0x14000201f
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x140001fdb
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x14000200e
nop word [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x140001ff0
mov ecx, dword [rax]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rcx
jmp 0x1400021f8
test r14, r14
jne 0x140002087
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x78]
mov r9, qword [rsp + 0x50]
add r8, rbx
mov rdx, r12
call fcn.140001070
test rax, rax
je 0x140002087
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x140002056
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x14000207f
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x140002061
mov r14d, dword [rax]
jmp 0x1400021ee
test r13, r13
jne 0x1400020f6
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x78]
mov r9, qword [rsp + 0x60]
add r8, rbx
mov rdx, r12
call fcn.140001070
test rax, rax
je 0x1400020f6
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x1400020be
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x1400020ee
nop dword [rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x1400020d0
mov r13d, dword [rax]
jmp 0x1400021ee
cmp qword [rsp + 0x40], r15
jne 0x140002174
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x78]
mov r9, qword [rsp + 0x58]
add r8, rbx
mov rdx, r12
call fcn.140001070
test rax, rax
je 0x140002174
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x14000212f
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x14000215e
nop word [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x140002140
mov ebx, dword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rbx
jmp 0x1400021fd
test rsi, rsi
jne 0x1400021ee
mov eax, dword [rbp + 0x460]
mov rdx, r12
mov r9, qword [rbp - 0x70]
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x48]
lea r8, [rax + rcx*4]
lea rcx, [rsp + 0x78]
call fcn.140001070
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400021ee
mov ecx, dword [rdi + 8]
mov rsi, rdi
test cl, 1
je 0x1400021ba
lea rsi, [r12 + rcx]
and rsi, 0xfffffffffffffffc
mov ecx, dword [rsi + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x1400021ee
nop word [rax + rax]
movzx esi, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rsi
and rsi, 0xfffffffffffffffe
lea rsi, [rcx + rsi*2]
mov ecx, dword [rsi + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x1400021d0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
test rax, rax
je 0x14000221b
test rcx, rcx
je 0x14000221b
test r14, r14
je 0x14000221b
test r13, r13
je 0x14000221b
test rbx, rbx
je 0x14000221b
test rsi, rsi
jne 0x14000223e
mov edx, dword [rbp + 0x460]
add rdi, 0xc
mov rcx, qword [rsp + 0x48]
inc edx
mov dword [rbp + 0x460], edx
cmp edx, dword [rbp + 0x470]
jb 0x140001f27
mov rdi, qword [rsp + 0x30]
mov edx, 1
mov rcx, r12
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x140002264
mov eax, 0xfffffffc
jmp 0x140001d8a
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x140002280
lea eax, [rbx - 5]
jmp 0x140001d8a
movzx eax, word [rax + 0x34]
lea rcx, str.__hu._hu._hu._hu__n
movzx r9d, word [rbx + 0x36]
movzx r8d, word [rbx + 0x30]
movzx edx, word [rbx + 0x32]
mov dword [rsp + 0x20], eax
call fcn.140001010
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400022f6
test r14, r14
je 0x1400022cd
mov r9, rax
lea rcx, [rsp + 0x78]
mov r8, r12
mov rdx, r14
call fcn.140001780
test eax, eax
jne 0x1400022f6
mov rax, qword [rsp + 0x68]
test r13, r13
je 0x1400022f6
mov r9, rax
lea rcx, [rsp + 0x78]
mov r8, r12
mov rdx, r13
call fcn.140001780
test eax, eax
jne 0x1400022f6
lea rcx, str.ERROR:_SingleUserPatch_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
test rdi, rdi
je 0x14000230d
mov r8, r12
lea rcx, [rsp + 0x78]
mov rdx, rdi
call fcn.140001440
jmp 0x14000231a
lea rcx, str.ERROR:_CDefPolicy_Query_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov ecx, dword [rbx + 0x30]
cmp ecx, 0x60001
jbe 0x140002bad
test rsi, rsi
jne 0x140002342
lea rcx, str.ERROR:_CSLQuery_Initialize_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
jmp 0x140001d8a
mov eax, dword [rsi]
mov edi, dword [rsi + 4]
sub rdi, rax
mov qword [rsp + 0x68], rdi
lea r13, [rax + r12]
cmp ecx, 0x60002
jne 0x140002417
mov rbx, qword [rsp + 0x70]
lea rax, [rbp - 0x50]
add rbx, r12
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea r9, [rbp + 0x2d0]
mov r8, rdi
lea rcx, [rsp + 0x78]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x1400023e6
nop dword [rax]
movzx eax, byte [rbp + 0x2d8]
add rbx, rax
sub rdi, rax
cmp dword [rbp + 0x2d4], 0x47
jne 0x1400023c1
cmp dword [rbp - 0x30], 4
jne 0x1400023c1
cmp byte [rbp - 0x27], 1
jne 0x1400023c1
cmp dword [rbp + 0x20], 1
jne 0x1400023c1
cmp dword [rbp + 0x28], 0xc5
je 0x1400023fa
lea rax, [rbp - 0x50]
mov r8, rdi
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x78]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140002390
lea rcx, str.ERROR:_SLGetWindowsInformationDWORDWrapper_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
jmp 0x140001d8a
mov rdx, qword [rbp - 0x20]
lea rcx, str.SLPolicyInternal.x641_nSLPolicyOffset.x64_llX_nSLPolicyFunc.x64New_Win8SL_n
sub rdx, r12
add rdx, rbx
call fcn.140001010
xor eax, eax
jmp 0x140001d8a
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002446
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14000243d
mov r9, rax
lea rcx, [rsp + 0x78]
mov r8, r12
call fcn.140001170
jmp 0x140002453
lea rcx, str.ERROR:_IsLicenseTypeLocalOnly_not_found
jmp 0x14000244d
lea rcx, str.ERROR:_GetInstanceOfTSLicense_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov edx, dword [rsi]
lea rcx, str.SLInitHook.x641_nSLInitOffset.x64_lX_nSLInitFunc.x64New_CSLQuery_Initialize_n
call fcn.140001010
movzx eax, word [rbx + 0x34]
lea rcx, str._n__hu._hu._hu._hu_SLInit__n
movzx r9d, word [rbx + 0x36]
movzx r8d, word [rbx + 0x30]
movzx edx, word [rbx + 0x32]
mov dword [rsp + 0x20], eax
call fcn.140001010
mov rdx, qword [rbp + 0x478]
mov rbx, r15
mov esi, dword [rdx + 0xc]
mov edi, dword [rdx + 0x10]
add rsi, r12
test rdi, rdi
je 0x1400024ce
nop dword [rax + rax]
lea rcx, [rbx + rsi]
mov r8d, 0x7e
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowMultipleSessions
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000262d
add rbx, 4
cmp rbx, rdi
jb 0x1400024a0
mov rdx, qword [rbp + 0x478]
mov edi, dword [rdx + 0xc]
mov r9, 0xffffffffffffffff
mov esi, dword [rdx + 0x10]
add rdi, r12
mov rbx, r15
mov r14, r9
test rsi, rsi
je 0x140002525
nop dword [rax]
lea rcx, [rbx + rdi]
mov r8d, 0x78
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowAppServerMode
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000264c
add rbx, 4
cmp rbx, rsi
jb 0x1400024f0
mov rdx, qword [rbp + 0x478]
mov r9, 0xffffffffffffffff
mov edi, dword [rdx + 0xc]
mov rbx, r15
mov r15d, dword [rdx + 0x10]
add rdi, r12
mov rsi, r9
test r15, r15
je 0x140002575
nop word [rax + rax]
lea rcx, [rbx + rdi]
mov r8d, 0x6e
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowMultimon
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000266b
add rbx, 4
cmp rbx, r15
jb 0x140002540
mov rdx, qword [rbp + 0x478]
mov r9, 0xffffffffffffffff
mov ebx, dword [rdx + 0xc]
xor r15d, r15d
mov eax, dword [rdx + 0x10]
add rbx, r12
mov rdi, r9
test rax, rax
je 0x1400025c8
nop dword [rax]
lea rcx, [r15 + rbx]
mov r8d, 0x72
lea rdx, str.TerminalServices_RemoteConnectionManager_MaxUserSessions
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140002686
mov rdx, qword [rbp + 0x478]
add r15, 4
mov eax, dword [rdx + 0x10]
cmp r15, rax
jb 0x140002590
mov r9, 0xffffffffffffffff
mov eax, dword [rdx + 0xc]
xor r15d, r15d
mov ecx, dword [rdx + 0x10]
add rax, r12
mov qword [rbp + 0x470], rax
mov rbx, r9
test rcx, rcx
je 0x1400026ba
nop word [rax + rax]
lea rcx, [r15 + rax]
mov r8d, 0xb4
lea rdx, str.TerminalServices_RemoteConnectionManager_ce0ad219_4670_4988_98fb_89b14c2f072b_MaxSessions
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400026a8
mov rcx, qword [rbp + 0x478]
add r15, 4
mov eax, dword [rcx + 0x10]
cmp r15, rax
mov rax, qword [rbp + 0x470]
jb 0x1400025f0
jmp 0x1400026ba
mov rdx, qword [rbp + 0x478]
mov r14d, dword [rdx + 0xc]
mov edi, dword [rdx + 0xc]
add r14, rbx
mov esi, dword [rdx + 0x10]
add rdi, r12
mov rbx, r15
jmp 0x1400024f0
mov rax, qword [rbp + 0x478]
mov esi, dword [rax + 0xc]
mov edi, dword [rax + 0xc]
add rsi, rbx
mov rbx, r15
add rdi, r12
mov r15d, dword [rax + 0x10]
jmp 0x140002540
mov rax, qword [rbp + 0x478]
mov edi, dword [rax + 0xc]
add rdi, rbx
mov ebx, dword [rax + 0xc]
add rbx, r12
xor r15d, r15d
jmp 0x140002590
mov rcx, qword [rbp + 0x478]
mov ebx, dword [rcx + 0xc]
mov eax, dword [rcx + 0xc]
add rbx, r15
add rax, r12
mov qword [rbp + 0x470], rax
xor r15d, r15d
jmp 0x1400025f0
mov rax, qword [rbp + 0x478]
mov r9d, dword [rax + 0xc]
add r9, r15
mov qword [rbp - 0x68], r9
mov r8, qword [rsp + 0x68]
lea r15, [rsp + 0x58]
xor eax, eax
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x58], rax
mov rdx, r13
mov qword [rbp + 0x470], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
cmp r8, 0x64
jbe 0x1400028a7
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140002a95
movzx eax, byte [rbp + 0x2d8]
mov r11, qword [rsp + 0x68]
add r13, rax
mov r10d, dword [rbp + 0x20]
sub r11, rax
cmp qword [r15], 0
mov eax, dword [rbp + 0x2d4]
mov qword [rsp + 0x68], r11
jne 0x140002795
cmp eax, 0x1b4
jne 0x140002795
cmp dword [rbp - 0x30], 2
jne 0x140002865
cmp dword [rbp - 0x20], 0xc5
jne 0x140002865
cmp byte [rbp - 0x10], 1
jne 0x140002865
cmp r10d, 1
jne 0x140002858
cmp dword [rbp + 0x28], 0x25
jne 0x140002865
mov rax, qword [rbp - 8]
sub rax, r12
add rax, r13
mov qword [r15], rax
jmp 0x140002865
mov rcx, r14
mov rdx, rsi
mov r8, rdi
mov r9, rbx
cmp eax, 0x18c
jne 0x14000283c
cmp r10d, 2
jne 0x140002865
cmp dword [rbp + 0x30], 0xc5
jne 0x140002865
cmp byte [rbp + 0x40], 1
jne 0x140002865
cmp dword [rbp - 0x30], 1
jne 0x140002865
cmp dword [rbp - 0x28], 0x36
jne 0x140002865
mov r10, qword [rbp + 0x48]
sub r10, r12
add r10, r13
cmp r10, qword [rbp - 0x70]
jne 0x1400027fa
lea r15, [rbp + 0x470]
jmp 0x140002865
cmp r10, rcx
jne 0x140002806
lea r15, [rsp + 0x70]
jmp 0x140002865
cmp r10, rdx
jne 0x140002812
lea r15, [rsp + 0x60]
jmp 0x140002865
cmp r10, r8
jne 0x14000281e
lea r15, [rsp + 0x48]
jmp 0x140002865
cmp r10, r9
jne 0x14000282a
lea r15, [rsp + 0x40]
jmp 0x140002865
cmp r10, qword [rbp - 0x68]
lea rax, [rsp + 0x38]
cmovne rax, r15
mov r15, rax
jmp 0x140002865
cmp eax, 0x1b4
jne 0x140002865
cmp dword [rbp - 0x30], 2
jne 0x140002865
cmp dword [rbp - 0x20], 0xc5
jne 0x140002865
cmp byte [rbp - 0x10], 1
jne 0x140002865
cmp r10d, 4
jne 0x140002865
cmp qword [rbp + 0x30], 1
je 0x140002893
lea rax, [rbp - 0x50]
mov r8, r11
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
mov rdx, r13
lea rcx, [rsp + 0x78]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140002720
jmp 0x140002a6d
mov rax, qword [rbp - 8]
sub rax, r12
add rax, r13
mov qword [rsp + 0x30], rax
jmp 0x140002a6d
mov r8d, 0x11000
mov qword [rbp + 0x478], r8
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140002a95
movzx eax, byte [rbp + 0x2d8]
sub qword [rbp + 0x478], rax
add r13, rax
mov eax, dword [rbp + 0x2d4]
mov r11d, dword [rbp + 0x20]
mov r10d, dword [rbp - 0x30]
cmp eax, 0x137
jne 0x14000290c
cmp r10d, 4
jne 0x14000290c
cmp byte [rbp - 0x27], 1
jne 0x14000290c
cmp r11d, 1
jne 0x14000290c
cmp dword [rbp + 0x28], 0xc5
jne 0x14000290c
add r13, qword [rbp - 0x20]
jmp 0x140002a40
cmp qword [r15], 0
jne 0x140002956
cmp eax, 0x1b4
jne 0x140002956
cmp r10d, 2
jne 0x140002a40
cmp dword [rbp - 0x20], 0xc5
jne 0x140002a40
cmp byte [rbp - 0x10], 1
jne 0x140002a40
cmp r11d, 1
jne 0x140002a40
mov rax, qword [rbp - 8]
sub rax, r12
add rax, r13
mov qword [r15], rax
jmp 0x140002a40
mov rcx, r14
mov rdx, rsi
mov r8, rdi
mov r9, rbx
cmp eax, 0x18c
jne 0x140002a00
cmp r11d, 2
jne 0x140002a40
cmp dword [rbp + 0x30], 0xc5
jne 0x140002a40
cmp byte [rbp + 0x40], 1
jne 0x140002a40
cmp r10d, 1
jne 0x140002a40
cmp dword [rbp - 0x28], 0x37
jne 0x140002a40
mov r10, qword [rbp + 0x48]
sub r10, r12
add r10, r13
cmp r10, qword [rbp - 0x70]
jne 0x1400029be
lea r15, [rbp + 0x470]
jmp 0x140002a40
cmp r10, rcx
jne 0x1400029ca
lea r15, [rsp + 0x70]
jmp 0x140002a40
cmp r10, rdx
jne 0x1400029d6
lea r15, [rsp + 0x60]
jmp 0x140002a40
cmp r10, r8
jne 0x1400029e2
lea r15, [rsp + 0x48]
jmp 0x140002a40
cmp r10, r9
jne 0x1400029ee
lea r15, [rsp + 0x40]
jmp 0x140002a40
cmp r10, qword [rbp - 0x68]
lea rax, [rsp + 0x38]
cmovne rax, r15
mov r15, rax
jmp 0x140002a40
cmp eax, 0x1b4
jne 0x140002a39
cmp r10d, 2
jne 0x140002a40
cmp dword [rbp - 0x20], 0xc5
jne 0x140002a40
cmp byte [rbp - 0x10], 1
jne 0x140002a40
cmp r11d, 1
jne 0x140002a40
cmp dword [rbp + 0x28], 0x25
jne 0x140002a40
mov rax, qword [rbp - 8]
sub rax, r12
add rax, r13
mov qword [rsp + 0x30], rax
jmp 0x140002a40
cmp eax, 0x2b2
je 0x140002a6d
mov r8, qword [rbp + 0x478]
lea rax, [rbp - 0x50]
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
mov rdx, r13
lea rcx, [rsp + 0x78]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x1400028c2
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140002a8c
lea rcx, str.bServerSku.x64_llX_n
call fcn.140001010
mov rbx, qword [rbp + 0x470]
jmp 0x140002aa4
mov rbx, qword [rbp + 0x470]
jmp 0x140002a97
xor ebx, ebx
lea rcx, str.ERROR:_bServerSku_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
test rbx, rbx
je 0x140002aba
mov rdx, rbx
lea rcx, str.bRemoteConnAllowed.x64_llX_n
call fcn.140001010
jmp 0x140002ac7
lea rcx, str.ERROR:_bRemoteConnAllowed_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140002adf
lea rcx, str.bFUSEnabled.x64_llX_n
call fcn.140001010
jmp 0x140002aec
lea rcx, str.ERROR:_bFUSEnabled_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140002b04
lea rcx, str.bAppServerAllowed.x64_llX_n
call fcn.140001010
jmp 0x140002b11
lea rcx, str.ERROR:_bAppServerAllowed_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140002b29
lea rcx, str.bMultimonAllowed.x64_llX_n
call fcn.140001010
jmp 0x140002b36
lea rcx, str.ERROR:_bMultimonAllowed_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140002b4e
lea rcx, str.lMaxUserSessions.x64_llX_n
call fcn.140001010
jmp 0x140002b5b
lea rcx, str.ERROR:_lMaxUserSessions_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002b73
lea rcx, str.ulMaxDebugSessions.x64_llX_n
call fcn.140001010
jmp 0x140002b80
lea rcx, str.ERROR:_ulMaxDebugSessions_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140002ba0
mov rdx, rax
lea rcx, str.bInitialized.x64_llX_n
call fcn.140001010
xor eax, eax
jmp 0x140001d8a
lea rcx, str.ERROR:_bInitialized_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
jmp 0x140001d8a