Function at 0x14018d420
Capabilities:
Parse pe header

Disassembly:
mov dword ss:[rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push r13
lea rbp, [rsp - 0x4f]
sub rsp, 0xa8
mov r13, r8
mov r8d, edx
test r13, r13
jne 0x14018d455
mov eax, 0xc0000001
add rsp, 0xa8
pop r13
pop rbp
ret
mov eax, r8d
mov qword [rsp + 0x80], r14
and al, 0x77
neg al
mov eax, 0x1020000
sbb ecx, ecx
and ecx, 0x20000
mov edx, ecx
bts edx, 0x18
test r8b, 8
cmove edx, ecx
bt r8d, 0x10
mov r8, qword [r13 + 0x78]
lea rcx, [rbp - 9]
cmovb edx, eax
mov rax, qword [r13 + 0x58]
call qword [case.0x14013b5a0.0]
mov r14d, eax
lfence
test eax, eax
js 0x14018e821
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x98], rsi
mov rsi, qword [r13 + 0x50]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x78], r15
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14018d589
mov rsi, qword [rsi + 8]
lea r15, str.Service
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018d526
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018d57a
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018d500
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018d626
sub r15, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018d56b
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018d589
add rsi, 2
sub rdi, 1
jne 0x14018d540
jmp 0x14018d626
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018d52f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018d745
mov rsi, qword [rsi + 8]
lea r15, str.SCManager
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018d5db
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018d655
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018d5b1
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018d626
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018d61c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018d745
add rsi, 2
sub rdi, 1
jne 0x14018d5f0
mov rdi, qword [rbp - 9]
lea rax, [rbp + 0x77]
mov esi, dword [rbp + 0x6f]
mov rcx, rdi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
je 0x14018d664
xor edi, edi
mov r14d, edi
jmp 0x14018d724
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018d5e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov r14d, eax
cmp eax, 0xc0000023
jne 0x14018d71e
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x14018d731
mov rcx, qword [0x1402c5110]
mov r8d, eax
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0x77]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.140207110
mov r9d, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
je 0x14018d6dd
mov r8, qword [rbp + 0x67]
xor edi, edi
mov r14d, edi
mov qword [r8], rbx
jmp 0x14018d724
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov r14d, eax
test eax, eax
js 0x14018d6fd
mov r8, qword [rbp + 0x67]
mov qword [r8], rbx
jmp 0x14018d724
mov rcx, qword [0x1402c5110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14018e7f9
nop
test eax, eax
js 0x14018d731
cmp dword [rbp + 0x77], 0
mov eax, 0xc0000079
cmove r14d, eax
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x14018e7f9
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 8
jne 0x14018d7fa
mov rsi, qword [rsi + 8]
lea r15, [0x14026a2f0]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018d796
nop dword [rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018d7eb
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018d770
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018d8a6
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018d7d8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018d7fa
add rsi, 2
sub rdi, 1
jne 0x14018d7b0
jmp 0x14018d8a6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018d79f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018d9a5
mov rsi, qword ds:[rsi + 8]
lea r15, str.FileObject
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018d85a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018d985
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018d830
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018d8a6
sub r15, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018d89c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018d9a5
add rsi, 2
sub rdi, 1
jne 0x14018d870
mov rcx, qword [0x1402c5110]
mov edx, 4
mov rdi, qword [rbp - 9]
mov r8d, 0x100
mov dword [rbp + 0x77], 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0x77]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.140207110
mov esi, dword [rbp + 0x6f]
lea rax, [rbp + 0x77]
mov r9d, dword [rbp + 0x77]
mov r8, rbx
mov edx, esi
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.140183ab0
mov r14d, eax
cmp eax, 0xc0000023
jne 0x14018d962
mov rcx, qword [0x1402c5110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rbp + 0x77]
mov edx, 4
mov rcx, qword [0x1402c5110]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword ds:[rbp + 0x77]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.140207110
mov r9d, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rdi
call fcn.140183ab0
mov r14d, eax
test r14d, r14d
jns 0x14018d997
lfence
mov rcx, qword [0x1402c5110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax]
jmp 0x14018e7ef
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018d863
mov r8, qword ds:[rbp + 0x67]
mov qword [r8], rbx
jmp 0x14018e7ef
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018da5a
mov rsi, qword [rsi + 8]
lea r15, str.LsaAccount
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018d9f6
nop dword [rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018da4b
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018d9d0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018dc86
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018da38
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018da5a
add rsi, 2
sub rdi, 1
jne 0x14018da10
jmp 0x14018dc86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018d9ff
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018db1a
mov rsi, qword ds:[rsi + 8]
lea r15, str.LsaPolicy
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018dab6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018db0b
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018da90
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018dc86
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018daf8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018db1a
add rsi, 2
sub rdi, 1
jne 0x14018dad0
jmp 0x14018dc86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018dabf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018dbda
mov rsi, qword ds:[rsi + 8]
lea r15, str.LsaSecret
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018db76
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018dbcb
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018db50
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018dc86
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018dbb8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018dbda
add rsi, 2
sub rdi, 1
jne 0x14018db90
jmp 0x14018dc86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018db7f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018dd09
mov rsi, qword ds:[rsi + 8]
lea r15, str.LsaTrusted
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018dc3a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018dcf7
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018dc10
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018dc86
sub r15, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018dc7c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018dd09
add rsi, 2
sub rdi, 1
jne 0x14018dc50
mov edx, dword [rbp + 0x6f]
lea r8, [rbp + 0x77]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_LsaQuerySecurityObject]
mov r14d, eax
test eax, eax
js 0x14018dce8
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402c5110]
mov edx, 4
mov rsi, qword [rbp + 0x77]
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1402074d0
mov r8, qword [rbp + 0x67]
mov rcx, qword [rbp + 0x77]
mov qword [r8], rbx
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x14018e7f9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018dc43
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14018ddba
mov rsi, qword [rsi + 8]
lea r15, str.SamAlias
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018dd57
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018ddab
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018dd31
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018e7f9
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018dd98
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018ddba
add rsi, 2
sub rdi, 1
jne 0x14018dd70
jmp 0x14018e7f9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018dd60
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018de7a
mov rsi, qword ds:[rsi + 8]
lea r15, str.SamDomain
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018de16
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018de6b
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018ddf0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018e7f9
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018de58
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018de7a
add rsi, 2
sub rdi, 1
jne 0x14018de30
jmp 0x14018e7f9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018de1f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14018df3a
mov rsi, qword ds:[rsi + 8]
lea r15, str.SamGroup
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ded6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018df2b
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018deb0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018e7f9
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018df18
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018df3a
add rsi, 2
sub rdi, 1
jne 0x14018def0
jmp 0x14018e7f9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018dedf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018dffa
mov rsi, qword ds:[rsi + 8]
lea r15, str.SamServer
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018df96
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018dfeb
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018df70
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018e7f9
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018dfd8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018dffa
add rsi, 2
sub rdi, 1
jne 0x14018dfb0
jmp 0x14018e7f9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018df9f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14018e0ba
mov rsi, qword ds:[rsi + 8]
lea r15, str.SamUser
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018e056
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018e0ab
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018e030
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018e7f9
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018e098
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018e0ba
add rsi, 2
sub rdi, 1
jne 0x14018e070
jmp 0x14018e7f9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018e05f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14018e273
mov rsi, qword ds:[rsi + 8]
lea r14, str.TokenDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018e11a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018e24b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018e0f0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018e166
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14018e15c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018e273
add rsi, 2
sub rdi, 1
jne 0x14018e130
mov rcx, qword [rbp - 9]
lea r8, [rbp + 0x77]
mov edx, 6
call fcn.14015f760
mov r14d, eax
test eax, eax
js 0x14018e7ef
mov r15, qword [rbp + 0x77]
mov rcx, qword [0x1402c5110]
cmp qword [r15], 0
je 0x14018e25d
mov rax, qword [r15]
mov edx, 4
movzx ebx, word [rax + 2]
lea r8, [rbx + 0x28]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r8, ds:[rbx + 0x28]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.140207110
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov r8, qword ds:[r15]
xor r9d, r9d
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402c5110]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1402074d0
mov r8, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [0x1402c5110]
mov qword [r8], rbx
mov r8, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x1402c5110]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14018e7ef
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018e123
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r14d, 0xc0000079
jmp 0x14018e7ef
mov rsi, qword ds:[r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14018e45e
mov rsi, qword ds:[rsi + 8]
lea r14, str.PowerDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018e2da
nop word [rax + rax]
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018e34b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018e2b0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018e326
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14018e31c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018e45e
add rsi, 2
sub rdi, 1
jne 0x14018e2f0
lea rcx, [rbp + 7]
call fcn.14017d0a0
mov r14d, eax
test eax, eax
js 0x14018e7f9
mov r15, qword [rbp + 7]
xor edi, edi
test r15, r15
je 0x14018e35a
mov rbx, qword [r15 + 8]
jmp 0x14018e35d
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018e2e3
mov rbx, rdi
mov dword [rbp + 0x7f], edi
mov qword [rbp - 1], rdi
call fcn.14016fe60
test rax, rax
je 0x14018e437
call fcn.14016fe60
lea r9, [rbp + 0x7f]
mov edx, 1
lea r8, [rbp - 1]
mov rcx, rbx
call qword [case.0x14013b5a0.0]
test eax, eax
je 0x14018e437
mov rdi, qword ds:[rbp - 1]
test rdi, rdi
je 0x14018e437
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x14018e437
mov rcx, qword [0x1402c5110]
mov r8d, eax
mov edx, 4
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.1402074d0
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x14018e437
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402c5110]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1402074d0
mov r8, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [0x1402c5110]
mov qword [r8], rbx
mov r8, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14018e43d
mov r14d, 0xc0000079
lea rcx, [r15 - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14018e7f9
call fcn.14013fb00
jmp 0x14018e7f9
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018e6c5
mov rsi, qword [rsi + 8]
lea r14, str.RdpDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018e4ba
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018e587
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018e490
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018e506
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [r14 + rsi]
cmp cx, r15w
je 0x14018e4fc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018e6c5
add rsi, 2
sub rdi, 1
jne 0x14018e4d0
mov rax, qword [0x1402c5200]
xor edi, edi
mov dword [rbp + 0x77], edi
test rax, rax
jne 0x14018e5be
nop dword [rax + rax]
call fcn.14017cfe0
test rax, rax
je 0x14018e5b3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14018e599
mov edx, dword ds:[rax + 0x3c]
lea ecx, [rdx - 1]
cmp ecx, 0x7ffffffd
ja 0x14018e599
cmp dword [rdx + rax], 0x4550
jne 0x14018e599
add rdx, 0x88
add rdx, rax
mov ecx, dword [rdx]
test ecx, ecx
je 0x14018e599
cmp dword [rdx + 4], edi
je 0x14018e599
lea r8, ds:[rax + rcx]
mov word [rsp + 0x20], di
mov rcx, rax
lea r9, str.WTSGetListenerSecurityW
call fcn.140177a80
jmp 0x14018e59c
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018e4c3
mov rax, rdi
mov qword [0x1402c5200], rax
test rax, rax
jne 0x14018e5be
mov r14d, 0xc000007a
jmp 0x14018e7f9
mov r14d, 0xc0000135
jmp 0x14018e7f9
lea rcx, [rbp + 0x77]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
lea r9, str.Rdp_Tcp
mov dword [rsp + 0x30], edi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], 0xc
call qword [case.0x14013b5a0.0]
test eax, eax
jne 0x14018e6b6
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x14018e6b6
mov rcx, qword [0x1402c5110]
mov r8d, eax
mov edx, 4
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.140207110
mov ecx, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
lea r9, str.Rdp_Tcp
mov rax, qword [0x1402c5200]
xor r8d, r8d
mov dword [rsp + 0x30], ecx
xor edx, edx
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov dword [rsp + 0x20], 0xc
call qword [case.0x14013b5a0.0]
nop
test eax, eax
je 0x14018e6b6
mov rcx, rsi
mov r14d, edi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402c5110]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1402074d0
mov r8, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [0x1402c5110]
mov qword [r8], rbx
mov r8, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14018e7f9
mov r14d, 0xc0000079
jmp 0x14018e7f9
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018e7dc
mov rsi, qword [rsi + 8]
lea r14, str.WmiDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018e71a
nop dword [rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018e7ca
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018e6f0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018e766
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [r14 + rsi]
cmp cx, r15w
je 0x14018e75c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018e7dc
add rsi, 2
sub rdi, 1
jne 0x14018e730
lea rcx, [rbp + 0x77]
call fcn.14017d420
mov r14d, eax
test eax, eax
js 0x14018e7f9
mov rsi, qword [rbp + 0x77]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402c5110]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1402074d0
mov r8, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [0x1402c5110]
mov qword [r8], rbx
mov r8, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14018e7f9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018e723
mov r8, qword [rbp + 0x67]
mov edx, dword [rbp + 0x6f]
mov rcx, qword [rbp - 9]
call sym.SystemInformer.exe_QiGetObjectSecurity
mov r14d, eax
mov rcx, qword [rbp - 9]
call qword [sym.imp.ntdll.dll_NtClose]
mov r15, qword [rsp + 0x78]
mov eax, r14d
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x80]
add rsp, 0xa8
pop r13
pop rbp
ret