Function at 0x14018a220
Capabilities:
Parse pe header

Disassembly:
mov dword ss:[rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push r13
lea rbp, [rsp - 0x4f]
sub rsp, 0xa8
mov r13, r8
mov r8d, edx
test r13, r13
jne 0x14018a255
mov eax, 0xc0000001
add rsp, 0xa8
pop r13
pop rbp
ret
mov eax, r8d
mov qword [rsp + 0x80], r14
and al, 0x77
neg al
mov eax, 0x1020000
sbb ecx, ecx
and ecx, 0x20000
mov edx, ecx
bts edx, 0x18
test r8b, 8
cmove edx, ecx
bt r8d, 0x10
mov r8, qword [r13 + 0x78]
lea rcx, [rbp - 9]
cmovb edx, eax
mov rax, qword [r13 + 0x58]
call qword [str.PB__]
mov r14d, eax
lfence
test eax, eax
js 0x14018b641
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x98], rsi
mov rsi, qword [r13 + 0x50]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x78], r15
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14018a389
mov rsi, qword [rsi + 8]
lea r15, str.Service
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018a326
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018a37a
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018a300
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018a426
sub r15, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018a36b
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018a389
add rsi, 2
sub rdi, 1
jne 0x14018a340
jmp 0x14018a426
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018a32f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018a545
mov rsi, qword [rsi + 8]
lea r15, str.SCManager
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018a3db
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018a455
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018a3b1
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018a426
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018a41c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018a545
add rsi, 2
sub rdi, 1
jne 0x14018a3f0
mov rdi, qword [rbp - 9]
lea rax, [rbp + 0x77]
mov esi, dword [rbp + 0x6f]
mov rcx, rdi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
je 0x14018a464
xor edi, edi
mov r14d, edi
jmp 0x14018a524
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018a3e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov r14d, eax
cmp eax, 0xc0000023
jne 0x14018a51e
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x14018a531
mov rcx, qword [0x1402bfe50]
mov r8d, eax
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0x77]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1401dff50
mov r9d, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
je 0x14018a4dd
mov r8, qword [rbp + 0x67]
xor edi, edi
mov r14d, edi
mov qword [r8], rbx
jmp 0x14018a524
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov r14d, eax
test eax, eax
js 0x14018a4fd
mov r8, qword [rbp + 0x67]
mov qword [r8], rbx
jmp 0x14018a524
mov rcx, qword [0x1402bfe50]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14018b619
nop
test eax, eax
js 0x14018a531
cmp dword [rbp + 0x77], 0
mov eax, 0xc0000079
cmove r14d, eax
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x14018b619
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 8
jne 0x14018a5fa
mov rsi, qword [rsi + 8]
lea r15, [0x140266130]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018a596
nop dword [rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018a5eb
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018a570
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018a6a6
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018a5d8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018a5fa
add rsi, 2
sub rdi, 1
jne 0x14018a5b0
jmp 0x14018a6a6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018a59f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018a7a5
mov rsi, qword ds:[rsi + 8]
lea r15, str.FileObject
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018a65a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018a785
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018a630
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018a6a6
sub r15, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018a69c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018a7a5
add rsi, 2
sub rdi, 1
jne 0x14018a670
mov rcx, qword [0x1402bfe50]
mov edx, 4
mov rdi, qword [rbp - 9]
mov r8d, 0x100
mov dword [rbp + 0x77], 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0x77]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1401dff50
mov esi, dword [rbp + 0x6f]
lea rax, [rbp + 0x77]
mov r9d, dword [rbp + 0x77]
mov r8, rbx
mov edx, esi
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.140180950
mov r14d, eax
cmp eax, 0xc0000023
jne 0x14018a762
mov rcx, qword [0x1402bfe50]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rbp + 0x77]
mov edx, 4
mov rcx, qword [0x1402bfe50]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword ds:[rbp + 0x77]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1401dff50
mov r9d, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rdi
call fcn.140180950
mov r14d, eax
test r14d, r14d
jns 0x14018a797
lfence
mov rcx, qword [0x1402bfe50]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax]
jmp 0x14018b60f
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018a663
mov r8, qword ds:[rbp + 0x67]
mov qword [r8], rbx
jmp 0x14018b60f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018a85a
mov rsi, qword [rsi + 8]
lea r15, str.LsaAccount
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018a7f6
nop dword [rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018a84b
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018a7d0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018aa86
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018a838
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018a85a
add rsi, 2
sub rdi, 1
jne 0x14018a810
jmp 0x14018aa86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018a7ff
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018a91a
mov rsi, qword ds:[rsi + 8]
lea r15, str.LsaPolicy
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018a8b6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018a90b
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018a890
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018aa86
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018a8f8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018a91a
add rsi, 2
sub rdi, 1
jne 0x14018a8d0
jmp 0x14018aa86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018a8bf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018a9da
mov rsi, qword ds:[rsi + 8]
lea r15, str.LsaSecret
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018a976
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018a9cb
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018a950
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018aa86
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018a9b8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018a9da
add rsi, 2
sub rdi, 1
jne 0x14018a990
jmp 0x14018aa86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018a97f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018ab09
mov rsi, qword ds:[rsi + 8]
lea r15, str.LsaTrusted
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018aa3a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018aaf7
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018aa10
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018aa86
sub r15, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r12d, word [r15 + rsi]
cmp cx, r12w
je 0x14018aa7c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018ab09
add rsi, 2
sub rdi, 1
jne 0x14018aa50
mov edx, dword [rbp + 0x6f]
lea r8, [rbp + 0x77]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_LsaQuerySecurityObject]
mov r14d, eax
test eax, eax
js 0x14018aae8
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402bfe50]
mov edx, 4
mov rsi, qword [rbp + 0x77]
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1401e3aa0
mov r8, qword [rbp + 0x67]
mov rcx, qword [rbp + 0x77]
mov qword [r8], rbx
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x14018b619
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018aa43
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14018abba
mov rsi, qword [rsi + 8]
lea r15, str.SamAlias
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ab57
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018abab
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018ab31
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018b619
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018ab98
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018abba
add rsi, 2
sub rdi, 1
jne 0x14018ab70
jmp 0x14018b619
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ab60
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018ac7a
mov rsi, qword ds:[rsi + 8]
lea r15, str.SamDomain
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ac16
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018ac6b
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018abf0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b619
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018ac58
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018ac7a
add rsi, 2
sub rdi, 1
jne 0x14018ac30
jmp 0x14018b619
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ac1f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14018ad3a
mov rsi, qword ds:[rsi + 8]
lea r15, str.SamGroup
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018acd6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018ad2b
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018acb0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b619
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018ad18
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018ad3a
add rsi, 2
sub rdi, 1
jne 0x14018acf0
jmp 0x14018b619
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018acdf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018adfa
mov rsi, qword ds:[rsi + 8]
lea r15, str.SamServer
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ad96
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018adeb
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018ad70
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b619
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018add8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018adfa
add rsi, 2
sub rdi, 1
jne 0x14018adb0
jmp 0x14018b619
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ad9f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14018aeba
mov rsi, qword ds:[rsi + 8]
lea r15, str.SamUser
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ae56
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r15]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018aeab
add rsi, 0x10
add r15, 0x10
sub rdi, 1
jne 0x14018ae30
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b619
sub r15, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r12d, word [rsi + r15]
cmp cx, r12w
je 0x14018ae98
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018aeba
add rsi, 2
sub rdi, 1
jne 0x14018ae70
jmp 0x14018b619
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ae5f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14018b073
mov rsi, qword ds:[rsi + 8]
lea r14, str.TokenDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018af1a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018b04b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018aef0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018af66
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14018af5c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018b073
add rsi, 2
sub rdi, 1
jne 0x14018af30
mov rcx, qword [rbp - 9]
lea r8, [rbp + 0x77]
mov edx, 6
call fcn.140158bc0
mov r14d, eax
test eax, eax
js 0x14018b60f
mov r15, qword [rbp + 0x77]
mov rcx, qword [0x1402bfe50]
cmp qword [r15], 0
je 0x14018b05d
mov rax, qword [r15]
mov edx, 4
movzx ebx, word [rax + 2]
lea r8, [rbx + 0x28]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r8, ds:[rbx + 0x28]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1401dff50
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov r8, qword ds:[r15]
xor r9d, r9d
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402bfe50]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1401e3aa0
mov r8, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [0x1402bfe50]
mov qword [r8], rbx
mov r8, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x1402bfe50]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14018b60f
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018af23
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r14d, 0xc0000079
jmp 0x14018b60f
mov rsi, qword ds:[r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14018b25e
mov rsi, qword ds:[rsi + 8]
lea r14, str.PowerDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018b0da
nop word [rax + rax]
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018b14b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018b0b0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018b126
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14018b11c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018b25e
add rsi, 2
sub rdi, 1
jne 0x14018b0f0
lea rcx, [rbp + 7]
call fcn.140179ee0
mov r14d, eax
test eax, eax
js 0x14018b619
mov r15, qword [rbp + 7]
xor edi, edi
test r15, r15
je 0x14018b15a
mov rbx, qword [r15 + 8]
jmp 0x14018b15d
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018b0e3
mov rbx, rdi
mov dword [rbp + 0x7f], edi
mov qword [rbp - 1], rdi
call fcn.140168e60
test rax, rax
je 0x14018b237
call fcn.140168e60
lea r9, [rbp + 0x7f]
mov edx, 1
lea r8, [rbp - 1]
mov rcx, rbx
call qword [str.PB__]
test eax, eax
je 0x14018b237
mov rdi, qword ds:[rbp - 1]
test rdi, rdi
je 0x14018b237
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x14018b237
mov rcx, qword [0x1402bfe50]
mov r8d, eax
mov edx, 4
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.1401e3aa0
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x14018b237
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402bfe50]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1401e3aa0
mov r8, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [0x1402bfe50]
mov qword [r8], rbx
mov r8, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14018b23d
mov r14d, 0xc0000079
lea rcx, [r15 - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14018b619
call fcn.14013d2a0
jmp 0x14018b619
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018b4d3
mov rsi, qword [rsi + 8]
lea r14, str.RdpDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018b2b6
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018b325
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018b290
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b306
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [r14 + rsi]
cmp cx, r15w
je 0x14018b2fc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018b4d3
add rsi, 2
sub rdi, 1
jne 0x14018b2d0
xor edi, edi
mov dword [rbp + 0x77], edi
call fcn.140179e20
mov rcx, rax
test rax, rax
jne 0x14018b334
mov r14d, 0xc0000135
jmp 0x14018b619
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018b2bf
mov rax, qword [0x1402bff40]
nop dword [rax + rax]
test rax, rax
jne 0x14018b3ba
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14018b4b6
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14018b4b6
cmp dword [rdx + rcx], 0x4550
jne 0x14018b4b6
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14018b4b6
cmp dword [rdx + 4], edi
je 0x14018b4b6
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.WTSGetListenerSecurityW
call fcn.140174840
mov qword [0x1402bff40], rax
test rax, rax
je 0x14018b4bd
lea rcx, [rbp + 0x77]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
lea r9, str.Rdp_Tcp
mov dword [rsp + 0x30], edi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], 0xc
call qword [str.PB__]
test eax, eax
jne 0x14018b4c8
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x14018b4c8
mov rcx, qword [0x1402bfe50]
mov r8d, eax
mov edx, 4
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1401dff50
mov ecx, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
lea r9, str.Rdp_Tcp
mov rax, qword [0x1402bff40]
xor r8d, r8d
mov dword [rsp + 0x30], ecx
xor edx, edx
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov dword [rsp + 0x20], 0xc
call qword [str.PB__]
nop dword [rax]
test eax, eax
je 0x14018b4c8
mov rcx, rsi
mov r14d, edi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402bfe50]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1401e3aa0
mov r8, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [0x1402bfe50]
mov qword [r8], rbx
mov r8, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14018b619
mov qword [0x1402bff40], rdi
mov r14d, 0xc000007a
jmp 0x14018b619
mov r14d, 0xc0000079
jmp 0x14018b619
mov rsi, qword ds:[r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018b5fc
mov rsi, qword ds:[rsi + 8]
lea r14, str.WmiDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018b53a
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018b5ea
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018b510
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018b586
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [r14 + rsi]
cmp cx, r15w
je 0x14018b57c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018b5fc
add rsi, 2
sub rdi, 1
jne 0x14018b550
lea rcx, [rbp + 0x77]
call fcn.14017a240
mov r14d, eax
test eax, eax
js 0x14018b619
mov rsi, qword [rbp + 0x77]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov rcx, qword [0x1402bfe50]
mov edx, 4
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1401e3aa0
mov r8, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [0x1402bfe50]
mov qword [r8], rbx
mov r8, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14018b619
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018b543
mov r8, qword [rbp + 0x67]
mov edx, dword [rbp + 0x6f]
mov rcx, qword [rbp - 9]
call sym.SystemInformer.exe_PhGetObjectSecurity
mov r14d, eax
mov rcx, qword [rbp - 9]
call qword [sym.imp.ntdll.dll_NtClose]
mov r15, qword [rsp + 0x78]
mov eax, r14d
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x80]
add rsp, 0xa8
pop r13
pop rbp
ret