Function at 0x140193640
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
push r12
push r13
sub rsp, 0x78
mov r13, r8
mov r9d, edx
mov r12, rcx
test r8, r8
jne 0x140193668
mov eax, 0xc0000001
add rsp, 0x78
pop r13
pop r12
ret
mov eax, r9d
mov qword [rsp + 0x50], r15
and al, 0x13
neg al
mov eax, 0x10c0000
sbb ecx, ecx
and ecx, 0x80000
mov r8d, ecx
bts r8d, 0x12
test r9d, 0xa0000024
cmove r8d, ecx
lea rcx, [rsp + 0x40]
mov edx, r8d
bts edx, 0x18
test r9d, 0x50000048
cmove edx, r8d
mov r8, qword [r13 + 0x78]
bt r9d, 0x10
cmovb edx, eax
mov rax, qword [r13 + 0x58]
call qword [case.0x14013dbaa.0]
mov r15d, eax
lfence
test eax, eax
js 0x1401939c8
mov qword ss:[rsp + 0x90], rbx
mov qword ss:[rsp + 0x70], rbp
mov qword [rsp + 0x68], rsi
mov rsi, qword [r13 + 0x50]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r14
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x1401937ba
mov rsi, qword ds:[rsi + 8]
lea r14, str.Service
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193756
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401937ab
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x140193730
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140193866
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x140193797
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401937ba
add rsi, 2
sub rdi, 1
jne 0x140193770
jmp 0x140193866
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019375f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x1401938e5
mov rsi, qword ds:[rsi + 8]
lea r14, str.SCManager
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14019381a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193892
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x1401937f0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140193866
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x14019385b
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401938e5
add rsi, 2
sub rdi, 1
jne 0x140193830
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
test eax, eax
je 0x1401938a5
mov rcx, qword [rsp + 0x40]
xor r15d, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1401939a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193823
cmp dword [0x1402c0f40], 0xffffffff
jae 0x1401938bc
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x1401938c6
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov rcx, qword [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x1401939a9
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 8
jne 0x1401939e8
mov rsi, qword [rsi + 8]
lea rbp, [0x14026e9c0]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14019393a
nop dword [rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401939d6
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193910
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140193986
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193978
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401939e8
add rsi, 2
sub rdi, 1
jne 0x140193950
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov r15d, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rsp + 0x58]
mov eax, r15d
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
add rsp, 0x78
pop r13
pop r12
ret
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193943
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140193a9a
mov rsi, qword [rsi + 8]
lea rbp, str.FileObject
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193a36
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193a8b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193a10
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140193986
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193a78
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193a9a
add rsi, 2
sub rdi, 1
jne 0x140193a50
jmp 0x140193986
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193a3f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140193b5a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaAccount
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193af6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193b4b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193ad0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140193d86
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193b38
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193b5a
add rsi, 2
sub rdi, 1
jne 0x140193b10
jmp 0x140193d86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193aff
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x140193c1a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaPolicy
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193bb6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193c0b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193b90
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140193d86
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193bf8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193c1a
add rsi, 2
sub rdi, 1
jne 0x140193bd0
jmp 0x140193d86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193bbf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x140193cda
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaSecret
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193c76
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193ccb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193c50
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140193d86
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193cb8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193cda
add rsi, 2
sub rdi, 1
jne 0x140193c90
jmp 0x140193d86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193c7f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140193dbd
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaTrusted
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193d3a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193dae
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193d10
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140193d86
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193d78
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193dbd
add rsi, 2
sub rdi, 1
jne 0x140193d50
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_LsaSetSecurityObject]
mov rcx, qword [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x1401939a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193d43
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x140193e7a
mov rsi, qword [rsi + 8]
lea rbp, str.SamAlias
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193e16
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193e6b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193df0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x1401939a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193e58
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193e7a
add rsi, 2
sub rdi, 1
jne 0x140193e30
jmp 0x1401939a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193e1f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x140193f3a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamDomain
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193ed6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193f2b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193eb0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x1401939a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193f18
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193f3a
add rsi, 2
sub rdi, 1
jne 0x140193ef0
jmp 0x1401939a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193edf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x140193ffa
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamGroup
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193f96
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193feb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193f70
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x1401939a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193fd8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193ffa
add rsi, 2
sub rdi, 1
jne 0x140193fb0
jmp 0x1401939a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193f9f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x1401940ba
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamServer
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140194056
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401940ab
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140194030
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x1401939a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140194098
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401940ba
add rsi, 2
sub rdi, 1
jne 0x140194070
jmp 0x1401939a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019405f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14019417a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamUser
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140194116
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019416b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x1401940f0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x1401939a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140194158
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019417a
add rsi, 2
sub rdi, 1
jne 0x140194130
jmp 0x1401939a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019411f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x1401942ba
mov rsi, qword ds:[rsi + 8]
lea rbp, str.TokenDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401941da
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019429d
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x1401941b0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140194226
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14019421c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401942ba
add rsi, 2
sub rdi, 1
jne 0x1401941f0
xor r15d, r15d
mov byte [rsp + 0xa8], 0
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x48]
mov byte [rsp + 0xa0], 0
lea rdx, [rsp + 0xa8]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
nop dword [rax]
test eax, eax
js 0x14019399b
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1401942af
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0xa0]
mov r9d, 8
mov qword [rsp + 0xa0], rax
mov edx, 6
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
jmp 0x14019399b
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401941e3
mov r15d, 0xc0000079
jmp 0x14019399e
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x140194405
mov rsi, qword ds:[rsi + 8]
lea rbp, str.PowerDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14019431a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401943f3
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x1401942f0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140194366
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14019435c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140194405
add rsi, 2
sub rdi, 1
jne 0x140194330
call fcn.14018a640
mov rdx, rax
mov r8b, 1
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
lea rdx, [0x1402464f0]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov edx, 0x1100
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetControlSecurityDescriptor]
mov rdx, r12
mov ecx, 0xf
call fcn.14013be00
mov rbx, rax
test rax, rax
je 0x1401939a9
mov rcx, rax
call fcn.140182540
mov r15d, eax
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401939a9
call fcn.140142200
jmp 0x1401939a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140194323
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140194599
mov rsi, qword [rsi + 8]
lea rbp, str.RdpDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14019445a
nop dword [rax]
movdqu xmm1, xmmword [rbp]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140194527
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140194430
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x1401944a6
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14019449c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140194599
add rsi, 2
sub rdi, 1
jne 0x140194470
mov rax, qword [0x1402cbb18]
xor r15d, r15d
test rax, rax
jne 0x140194565
call fcn.1401822a0
nop
test rax, rax
je 0x140194555
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140194539
mov edx, dword ds:[rax + 0x3c]
lea ecx, [rdx - 1]
cmp ecx, 0x7ffffffd
ja 0x140194539
cmp dword [rdx + rax], 0x4550
jne 0x140194539
add rdx, 0x88
add rdx, rax
mov ecx, dword [rdx]
test ecx, ecx
je 0x140194539
cmp dword [rdx + 4], r15d
je 0x140194539
lea r8, ds:[rax + rcx]
mov word [rsp + 0x20], r15w
mov rcx, rax
lea r9, str.WTSSetListenerSecurityW
call fcn.14017f180
jmp 0x14019453c
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140194463
mov rax, r15
mov qword [0x1402cbb18], rax
test rax, rax
jne 0x140194565
mov ecx, 0xc000007a
mov r15d, ecx
jmp 0x1401939a9
mov ecx, 0xc0000135
mov r15d, ecx
jmp 0x1401939a9
mov qword [rsp + 0x28], r12
lea r9, str.RDP_Tcp
xor r8d, r8d
mov dword [rsp + 0x20], 0xc
xor edx, edx
xor ecx, ecx
call qword [case.0x14013dbaa.0]
test eax, eax
mov ecx, 0xc0000079
cmovne ecx, r15d
mov r15d, ecx
jmp 0x1401939a9
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140193986
mov rsi, qword ds:[rsi + 8]
lea r14, str.WmiDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401945fa
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019467c
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x1401945d0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140194646
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x14019463b
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193986
add rsi, 2
sub rdi, 1
jne 0x140194610
call fcn.14018a640
mov r8b, 1
mov rdx, rax
mov rcx, r12
mov rbx, rax
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov rcx, r12
call fcn.140182ac0
mov r15d, eax
jmp 0x1401939a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140194603