Function at 0x140001f50
Capabilities:
Enumerate pe sections
Extract resource via kernel32 functions
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5b0]
sub rsp, 0x6b0
cmp ecx, 2
lea rcx, [rbp + 0x4a0]
jl 0x140001f81
mov rdx, qword [rdx + 8]
jmp 0x140001f9f
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, eax
lea rcx, [rbp + 0x4a0]
add rcx, rax
lea rdx, str._termsrv.dll
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbp + 0x28], rax
test rax, rax
jne 0x140001fcb
mov eax, 0xffffffff
jmp 0x14000210a
mov r14, rax
and r14, 0xfffffffffffffffc
movsxd r12, dword [r14 + 0x3c]
add r12, r14
mov qword [rsp + 0x30], r12
movzx edi, word [r12 + 0x14]
add rdi, 0x18
add rdi, r12
mov qword [rbp - 0x68], rdi
xor ebx, ebx
mov ecx, 0x20b
mov eax, 0x80
mov r15d, 0x90
cmp word [r12 + 0x18], cx
cmovne r15d, eax
add r15, r12
mov qword [rbp + 0x600], r15
mov edx, dword [r12 + 0x50]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
mov qword [rsp + 0x38], rax
mov esi, ebx
mov qword [rbp - 8], 0xffffffffffffffff
cmp bx, word [r12 + 6]
jae 0x1400020c4
add rdi, 0x14
mov r15d, ebx
mov r8d, dword [rdi - 0xc]
mov edx, dword [rdi]
add rdx, r14
mov ecx, dword [rdi - 8]
add rcx, r13
call sub.VCRUNTIME140.dll_memcpy
test r15, r15
jne 0x14000209d
lea rbx, [rdi - 0x14]
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x28], eax
lea rcx, str..rdata
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov r8, rbx
xor edx, edx
lea ecx, [rdx + 0x7f]
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
cmove r15, rbx
inc rsi
add rdi, 0x28
movzx eax, word [r12 + 6]
cmp rsi, rax
jb 0x140002051
mov qword [rsp + 0x48], r15
test r15, r15
mov r15, qword [rbp + 0x600]
jne 0x1400020ce
mov rdi, qword [rbp - 0x68]
mov rsi, rdi
mov qword [rsp + 0x48], rdi
jmp 0x1400020d3
mov rsi, qword [rsp + 0x48]
mov edi, dword [r15]
add rdi, r13
mov r15, rdi
cmp dword [rdi + 0xc], 0
je 0x140002105
mov ecx, dword [r15 + 0xc]
add rcx, r13
lea rdx, str.msvcrt.dll
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140002125
add r15, 0x14
cmp dword [r15 + 0xc], 0
jne 0x1400020e2
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x6f8]
add rsp, 0x6b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x60], 0xffffffffffffffff
mov rbx, rdi
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x140002168
nop word [rax + rax]
mov ecx, dword [rbx + 0xc]
add rcx, r13
lea rdx, str.api_ms_win_core_kernel32_legacy_l1_1_1.dll
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140002361
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140002140
mov eax, dword [rdi + 0xc]
mov rbx, rdi
test eax, eax
je 0x140002195
nop
mov ecx, dword [rbx + 0xc]
add rcx, r13
lea rdx, [0x140005b30]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140002361
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140002170
xor r10d, r10d
mov ebx, r10d
mov r9d, dword [rsi + 0xc]
mov qword [rbp + 0x600], r9
lea r14, [r9 + r13]
mov rax, r10
mov esi, dword [rsi + 0x10]
test rsi, rsi
je 0x1400021f1
movzx ecx, byte [0x1400057b0]
mov rdx, qword [0x1400057a8]
mov r8, qword [str.CDefPolicy::Query]
nop word [rax + rax]
cmp qword [rax + r14], r8
jne 0x1400021e8
cmp qword [rax + r14 + 8], rdx
jne 0x1400021e8
cmp byte [rax + r14 + 0x10], cl
je 0x140002369
add rax, 4
cmp rax, rsi
jb 0x1400021d0
mov r13, r14
mov rdi, r10
mov r12, rsi
mov rax, 0xffffffffffffffff
mov qword [rbp - 0x18], rax
test rsi, rsi
je 0x140002241
nop word [rax + rax]
lea rcx, [rdi + r13]
mov r8d, 0x29
lea rdx, str.CEnforcementCore::GetInstanceOfTSLicense
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000237e
add rdi, 4
cmp rdi, r12
jb 0x140002210
xor r10d, r10d
mov rax, 0xffffffffffffffff
mov r13, r14
mov rdi, r10
mov r12, rsi
mov qword [rbp - 0x78], rax
test rsi, rsi
je 0x140002284
lea rcx, [rdi + r13]
mov r8d, 0x38
lea rdx, str.CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140002399
add rdi, 4
cmp rdi, r12
jb 0x140002253
xor r10d, r10d
mov rax, 0xffffffffffffffff
mov r13, r14
mov rdi, r10
mov r12, rsi
mov qword [rbp - 0x30], rax
test rsi, rsi
je 0x1400022c4
lea rcx, [rdi + r13]
mov r8d, 0x17
lea rdx, str.IsSingleSessionPerUser
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400023b4
add rdi, 4
cmp rdi, r12
jb 0x140002296
mov rax, 0xffffffffffffffff
mov r12, qword [rbp + 0x600]
mov qword [rbp - 0x48], rax
movabs rcx, 0x3a3a736c69745543
mov r13, qword [rsp + 0x38]
cmp qword [rax + r13 - 8], rcx
jne 0x1400022ed
sub rax, 8
mov qword [rbp - 0x48], rax
xor edi, edi
test rsi, rsi
je 0x14000231b
lea rcx, [rdi + r14]
mov r8d, 0x21
lea rdx, str.CSLQuery::IsTerminalTypeLocalOnly
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400023c4
add rdi, 4
cmp rdi, rsi
jb 0x1400022f4
xor edi, edi
mov rax, 0xffffffffffffffff
mov qword [rbp - 0x38], rax
test rsi, rsi
je 0x1400023d7
lea rcx, [rdi + r14]
mov r8d, 0x80
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowRemoteConnections
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400023d3
add rdi, 4
cmp rdi, rsi
jb 0x140002331
mov rax, 0xffffffffffffffff
jmp 0x1400023d7
xor r10d, r10d
jmp 0x14000219b
add rax, r9
mov qword [rbp - 0x18], rax
mov r13, r14
mov rdi, r10
mov r12, rsi
jmp 0x140002210
mov rax, qword [rbp + 0x600]
add rax, rdi
mov qword [rbp - 0x78], rax
mov r13, r14
xor edi, edi
mov r12, rsi
jmp 0x140002253
mov rax, qword [rbp + 0x600]
add rax, rdi
mov qword [rbp - 0x30], rax
mov r13, r14
xor edi, edi
mov r12, rsi
jmp 0x140002296
mov r12, qword [rbp + 0x600]
lea rax, [rdi + r12]
jmp 0x1400022cb
lea rax, [rdi + r12]
mov qword [rbp - 0x38], rax
xor edi, edi
jmp 0x140002331
lea rax, [rdi + r12]
mov qword [rbp - 0x20], rax
xor r14d, r14d
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x68], r14
mov qword [rbp + 0x608], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov r12d, r14d
mov dword [rbp + 0x5f0], r12d
mov eax, 0x11000
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x600], eax
lea rax, [0x140005b58]
mov qword [rbp - 0x10], rax
mov rsi, qword [rsp + 0x30]
mov eax, 0x20b
mov edi, dword [r15]
add rdi, r13
cmp word [rsi + 0x18], ax
jne 0x1400028ae
mov rax, qword [rdi]
test rax, rax
je 0x140002464
nop
lea rcx, [r13 + 2]
add rcx, rax
lea rdx, [0x140005b5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400024d2
add rdi, 8
mov rax, qword [rdi]
test rax, rax
jne 0x140002440
mov qword [rbp - 0x40], r14
test rbx, rbx
je 0x1400024a8
mov edi, dword [rbx]
add rdi, r13
mov rax, qword [rdi]
test rax, rax
je 0x1400024a4
nop word [rax + rax]
lea rcx, [r13 + 2]
add rcx, rax
lea rdx, str.VerifyVersionInfoW
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400024e8
add rdi, 8
mov rax, qword [rdi]
test rax, rax
jne 0x140002480
mov qword [rbp - 0x60], r14
mov r14d, dword [rsi + 0xa0]
add r14, r13
mov eax, 0xaaaaaaab
mul dword [rsi + 0xa4]
mov r15d, edx
shr r15d, 3
test r15d, r15d
jne 0x1400024fc
lea eax, [r15 - 3]
jmp 0x14000210a
mov ecx, dword [r15 + 0x10]
mov eax, dword [r15]
sub rcx, rax
sub rcx, r13
add rcx, rdi
mov qword [rbp - 0x40], rcx
jmp 0x140002468
mov ecx, dword [rbx + 0x10]
mov eax, dword [rbx]
sub rcx, rax
sub rcx, r13
add rcx, rdi
mov qword [rbp - 0x60], rcx
jmp 0x1400024a8
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Zydis.dll_ZydisDecoderInit]
xor esi, esi
mov rax, qword [rbp + 0x600]
test r15d, r15d
je 0x14000289e
mov rdi, r14
mov qword [rbp - 0x28], rax
cmp qword [rsp + 0x78], 0
jne 0x1400025a0
lea rax, [rsi + rsi*2]
lea r8, [r14 + rax*4]
mov r9, qword [rbp - 0x18]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140001e50
test rax, rax
je 0x1400025a0
mov rax, rdi
mov ecx, dword [rdi + 8]
test cl, 1
je 0x14000255f
lea rax, [rcx + r13]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
je 0x14000258e
nop word [rax + rax]
movzx eax, byte [rcx + 2]
inc rax
and rax, 0xfffffffffffffffe
lea rcx, [rcx + 4]
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
jne 0x140002570
mov eax, dword [rax]
mov qword [rsp + 0x78], rax
mov ebx, dword [rbp + 0x5f0]
jmp 0x140002831
lea rbx, [rsi + rsi*2]
cmp qword [rsp + 0x68], 0
jne 0x140002621
lea r8, [r14 + rbx*4]
mov r9, qword [rbp - 0x78]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140001e50
test rax, rax
je 0x140002621
mov rax, rdi
mov ecx, dword [rdi + 8]
test cl, 1
je 0x1400025d9
lea rax, [rcx + r13]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
je 0x14000260e
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 2]
inc rax
and rax, 0xfffffffffffffffe
lea rcx, [rcx + 4]
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
jne 0x1400025f0
mov r8d, dword [rax]
mov qword [rsp + 0x68], r8
mov ebx, dword [rbp + 0x5f0]
jmp 0x140002836
cmp qword [rbp + 0x608], 0
jne 0x1400026a7
lea r8, [r14 + rbx*4]
mov r9, qword [rbp - 0x30]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140001e50
test rax, rax
je 0x1400026a7
mov rax, rdi
mov ecx, dword [rdi + 8]
test cl, 1
je 0x140002658
lea rax, [rcx + r13]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
je 0x14000268e
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 2]
inc rax
and rax, 0xfffffffffffffffe
lea rcx, [rcx + 4]
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
jne 0x140002670
mov eax, dword [rax]
mov qword [rbp + 0x608], rax
mov ebx, dword [rbp + 0x5f0]
mov r8, qword [rsp + 0x68]
jmp 0x14000283d
cmp qword [rsp + 0x60], 0
jne 0x14000272c
lea r8, [r14 + rbx*4]
mov r9, qword [rbp - 0x48]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140001e50
test rax, rax
je 0x14000272c
mov rax, rdi
mov ecx, dword [rdi + 8]
test cl, 1
je 0x1400026dc
lea rax, [rcx + r13]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
je 0x14000270e
nop word [rax + rax]
movzx eax, byte [rcx + 2]
inc rax
and rax, 0xfffffffffffffffe
lea rcx, [rcx + 4]
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
jne 0x1400026f0
mov ecx, dword [rax]
mov qword [rsp + 0x60], rcx
mov ebx, dword [rbp + 0x5f0]
mov rax, qword [rbp + 0x608]
mov r8, qword [rsp + 0x68]
jmp 0x140002842
cmp qword [rsp + 0x70], 0
jne 0x1400027b1
lea r8, [r14 + rbx*4]
mov r9, qword [rbp - 0x38]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140001e50
test rax, rax
je 0x1400027b1
mov rax, rdi
mov ecx, dword [rdi + 8]
test cl, 1
je 0x140002761
lea rax, [rcx + r13]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
je 0x14000278e
nop dword [rax]
movzx eax, byte [rcx + 2]
inc rax
and rax, 0xfffffffffffffffe
lea rcx, [rcx + 4]
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r13
test byte [rcx], 0x20
jne 0x140002770
mov edx, dword [rax]
mov qword [rsp + 0x70], rdx
mov ebx, dword [rbp + 0x5f0]
mov rax, qword [rbp + 0x608]
mov rcx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
jmp 0x140002847
mov ebx, dword [rbp + 0x5f0]
test ebx, ebx
jne 0x140002831
lea rcx, [rsi + rsi*2]
lea r8, [r14 + rcx*4]
mov r9, qword [rbp - 0x20]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140001e50
mov qword [rbp - 0x28], rax
test rax, rax
je 0x140002831
mov rdx, rdi
mov ecx, dword [rdi + 8]
test cl, 1
je 0x1400027f0
lea rdx, [rcx + r13]
and rdx, 0xfffffffffffffffc
mov ecx, dword [rdx + 8]
add rcx, r13
test byte [rcx], 0x20
je 0x14000281e
nop dword [rax + rax]
movzx edx, byte [rcx + 2]
inc rdx
and rdx, 0xfffffffffffffffe
lea rcx, [rcx + 4]
lea rdx, [rcx + rdx*2]
mov ecx, dword [rdx + 8]
add rcx, r13
test byte [rcx], 0x20
jne 0x140002800
mov ebx, dword [rdx]
mov dword [rbp + 0x5f0], ebx
mov eax, dword [rdx + 4]
sub eax, ebx
mov dword [rbp + 0x600], eax
mov r8, qword [rsp + 0x68]
mov rax, qword [rbp + 0x608]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
cmp qword [rsp + 0x78], 0
je 0x140002867
test r8, r8
je 0x140002867
test rax, rax
je 0x140002867
test rcx, rcx
je 0x140002867
test rdx, rdx
je 0x140002867
test ebx, ebx
jne 0x14000288a
inc esi
add rdi, 0xc
cmp esi, r15d
jb 0x140002526
mov rbx, qword [rbp + 0x600]
mov qword [rbp - 0x50], rbx
mov r14, qword [rbp - 0x28]
jmp 0x140003105
mov r14, qword [rbp + 0x600]
mov qword [rbp - 0x50], r14
mov r14, qword [rbp - 0x28]
jmp 0x140003105
mov r14, qword [rbp + 0x600]
mov qword [rbp - 0x50], rax
jmp 0x14000310c
mov r14d, dword [rsi + 0x34]
mov qword [rbp - 0x50], r14
mov eax, dword [rdi]
test eax, eax
je 0x1400028e8
nop dword [rax]
mov ecx, eax
add rcx, 2
add rcx, r13
lea rdx, [0x140005b5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400029e8
add rdi, 4
mov eax, dword [rdi]
test eax, eax
jne 0x1400028c0
xor ecx, ecx
lea rax, [rcx + r14]
mov qword [rbp - 0x40], rax
test rbx, rbx
je 0x140002942
mov edi, dword [rbx]
add rdi, r13
mov eax, dword [rdi]
test eax, eax
je 0x140002938
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
add rcx, 2
add rcx, r13
lea rdx, str.VerifyVersionInfoW
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400029fd
add rdi, 4
mov eax, dword [rdi]
test eax, eax
jne 0x140002910
xor ecx, ecx
lea rax, [r14 + rcx]
mov qword [rbp - 0x60], rax
mov edx, 1
mov r8d, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Zydis.dll_ZydisDecoderInit]
lea rax, [0x140005b7c]
mov qword [rbp - 0x10], rax
xor r9d, r9d
mov qword [rsp + 0x40], r9
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov r15d, r9d
mov qword [rbp - 0x80], r9
mov qword [rbp + 0x10], r9
xor eax, eax
mov byte [rbp + 0x18], al
mov r11, qword [rbp - 0x68]
mov edx, dword [r11 + 0xc]
add rdx, r13
mov qword [rbp - 0x70], rdx
mov qword [rsp + 0x30], rdx
mov r12d, dword [r11 + 0x10]
mov qword [rbp - 0x58], r12
mov rsi, qword [rbp]
cmp r12, 5
jb 0x1400030c4
mov rax, qword [rbp + 0x600]
mov qword [rbp - 0x28], rax
mov r14, qword [rbp + 8]
nop dword [rax]
cmp dword [rdx], 0x8b55ff8b
jne 0x1400030a2
cmp byte [rdx + 4], 0xec
jne 0x1400030a2
cmp r14, r15
je 0x140002a10
mov qword [r14], rdx
add r14, 8
mov qword [rbp + 8], r14
jmp 0x140002a38
mov ecx, dword [r15 + 0x10]
mov eax, dword [r15]
sub rcx, rax
sub rcx, r13
add rcx, rdi
jmp 0x1400028ea
mov ecx, dword [rbx + 0x10]
mov eax, dword [rbx]
sub rcx, rax
sub rcx, r13
add rcx, rdi
jmp 0x14000293a
lea r8, [rsp + 0x30]
mov rdx, r14
lea rcx, [rbp]
call fcn.140003d30
mov r15, qword [rbp + 0x10]
mov qword [rbp - 0x80], r15
mov r14, qword [rbp + 8]
mov rsi, qword [rbp]
xor r9d, r9d
mov r11, qword [rbp - 0x68]
mov rcx, r14
sub rcx, rsi
sar rcx, 3
cmp rcx, 2
jl 0x140002a70
mov r8, qword [r14 - 8]
dec rcx
nop
lea rax, [rcx - 1]
sar rax, 1
mov rdx, qword [rsi + rax*8]
cmp rdx, r8
jbe 0x140002a6c
mov qword [rsi + rcx*8], rdx
mov rcx, rax
test rax, rax
jg 0x140002a50
mov qword [rsi + rcx*8], r8
cmp rsi, r14
je 0x140003017
nop dword [rax]
mov r12, qword [rsi]
mov rax, r14
sub rax, rsi
and rax, 0xfffffffffffffff8
cmp rax, 0x10
jl 0x140002b30
lea r8, [r14 - 8]
mov r10, qword [r8]
mov qword [r8], r12
sub r8, rsi
sar r8, 3
mov rdx, r9
mov rcx, r9
lea r9, [r8 - 1]
sar r9, 1
test r9, r9
jle 0x140002ae7
nop word [rax + rax]
add rcx, rcx
mov rax, qword [rsi + rcx*8 + 0x10]
cmp qword [rsi + rcx*8 + 8], rax
sbb rax, rax
add rax, 2
add rcx, rax
mov rax, qword [rsi + rcx*8]
mov qword [rsi + rdx*8], rax
mov rdx, rcx
cmp rcx, r9
jl 0x140002ac0
cmp rdx, r9
jne 0x140002aff
test r8b, 1
jne 0x140002aff
mov rax, qword [rsi + r8*8 - 8]
mov qword [rsi + rdx*8], rax
lea rdx, [r8 - 1]
test rdx, rdx
jle 0x140002b2c
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdx - 1]
sar rax, 1
mov rcx, qword [rsi + rax*8]
cmp rcx, r10
jbe 0x140002b2c
mov qword [rsi + rdx*8], rcx
mov rdx, rax
test rax, rax
jg 0x140002b10
mov qword [rsi + rdx*8], r10
sub r14, 8
mov qword [rbp + 8], r14
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140002b5d
cmp r12, qword [rax + 8]
jb 0x140002b5d
cmp r12, qword [rax + 0x10]
jb 0x140002e01
mov rcx, qword [rax]
mov rax, rcx
test rcx, rcx
jne 0x140002b42
mov rdi, r12
mov r15d, dword [r11 + 0x10]
sub r15, r12
add r15, r13
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x350]
mov r8, r15
mov rdx, r12
lea rcx, [rsp + 0x50]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140002e01
movzx ecx, byte [rbp + 0x358]
add rdi, rcx
sub r15, rcx
mov r11d, dword [rbp + 0xa0]
mov r10, qword [rbp + 0x60]
mov r9d, dword [rbp + 0x50]
mov ebx, dword [rbp + 0x354]
cmp cl, 5
jne 0x140002bd1
cmp ebx, 0x29c
jne 0x140002bd1
cmp r9d, 4
jne 0x140002dc6
mov rax, r10
jmp 0x140002c1e
cmp ebx, 0x1b7
jne 0x140002cb4
cmp r11d, 4
jne 0x140002dc6
cmp r9d, 1
jne 0x140002bf7
cmp cl, 5
je 0x140002c17
jmp 0x140002dc6
cmp r9d, 2
jne 0x140002dc6
cmp cl, 7
jb 0x140002dc6
lea eax, [r10 - 0x29]
cmp eax, 1
ja 0x140002dc6
mov rax, qword [rbp + 0xb0]
sub rax, qword [rbp - 0x50]
cmp qword [rsp + 0x78], 0
jne 0x140002c34
cmp rax, qword [rbp - 0x18]
je 0x140002e16
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
cmp qword [rsp + 0x68], 0
jne 0x140002c61
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
cmp rax, r8
je 0x140002e2a
cmp qword [rbp + 0x608], 0
jne 0x140002c75
cmp rax, qword [rbp - 0x30]
je 0x140002e46
cmp qword [rsp + 0x60], 0
jne 0x140002c87
cmp rax, qword [rbp - 0x48]
je 0x140002e60
cmp qword [rsp + 0x70], 0
jne 0x140002c99
cmp rax, qword [rbp - 0x38]
je 0x140002e74
mov qword [rbp - 0x78], r8
cmp dword [rbp + 0x5f0], 0
jne 0x140002cb4
mov qword [rbp - 0x78], r8
cmp rax, qword [rbp - 0x20]
je 0x140002e88
lea eax, [rbx - 0x131]
cmp eax, 0x15
ja 0x140002db6
cmp byte [rbp + 0x368], 2
jb 0x140002db6
cmp r9d, 4
jne 0x140002db6
cmp byte [rbp + 0x59], 1
jne 0x140002db6
cmp r11d, 1
jne 0x140002db6
cmp dword [rbp + 0xa8], 0xc4
jne 0x140002db6
lea rdx, [r10 + rdi]
mov qword [rsp + 0x30], rdx
cmp rdx, r12
jb 0x140002d15
cmp rdx, rdi
jbe 0x140002db6
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140002d3b
nop
cmp rdx, qword [rax + 8]
jb 0x140002d3b
cmp rdx, qword [rax + 0x10]
jb 0x140002db6
mov rcx, qword [rax]
mov rax, rcx
test rcx, rcx
jne 0x140002d20
cmp r14, qword [rbp - 0x80]
je 0x140002d4e
mov qword [r14], rdx
add r14, 8
mov qword [rbp + 8], r14
jmp 0x140002d6f
lea r8, [rsp + 0x30]
mov rdx, r14
lea rcx, [rbp]
call fcn.140003d30
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x80], rax
mov r14, qword [rbp + 8]
mov rsi, qword [rbp]
mov rdx, r14
sub rdx, rsi
sar rdx, 3
cmp rdx, 2
jl 0x140002db0
mov r8, qword [r14 - 8]
dec rdx
nop word [rax + rax]
lea rax, [rdx - 1]
sar rax, 1
mov rcx, qword [rsi + rax*8]
cmp rcx, r8
jbe 0x140002dac
mov qword [rsi + rdx*8], rcx
mov rdx, rax
test rax, rax
jg 0x140002d90
mov qword [rsi + rdx*8], r8
mov ebx, dword [rbp + 0x354]
cmp ebx, 0x2b6
je 0x140002df1
cmp ebx, 0x139
je 0x140002df1
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x350]
mov r8, r15
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140002b93
jmp 0x140002e01
mov r8, rdi
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.140001cd0
cmp rsi, r14
je 0x14000300f
xor r9d, r9d
mov r11, qword [rbp - 0x68]
jmp 0x140002a80
mov rax, qword [rbp - 0x70]
sub rax, r13
mov qword [rsp + 0x78], rax
mov ebx, dword [rbp + 0x5f0]
jmp 0x140002ea2
mov rax, qword [rbp - 0x70]
sub rax, r13
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
mov ebx, dword [rbp + 0x5f0]
jmp 0x140002e9e
mov r15, qword [rbp - 0x70]
sub r15, r13
mov qword [rbp + 0x608], r15
mov qword [rbp - 0x78], r8
mov ebx, dword [rbp + 0x5f0]
jmp 0x140002ea9
mov rax, qword [rbp - 0x70]
sub rax, r13
mov qword [rsp + 0x60], rax
mov ebx, dword [rbp + 0x5f0]
jmp 0x140002e9e
mov rax, qword [rbp - 0x70]
sub rax, r13
mov qword [rsp + 0x70], rax
mov ebx, dword [rbp + 0x5f0]
jmp 0x140002e9e
mov rax, rdi
sub rax, r13
mov qword [rbp - 0x28], rax
mov ebx, dword [rbp - 0x70]
sub ebx, r13d
mov dword [rbp + 0x5f0], ebx
mov qword [rbp - 0x78], r8
mov r15, qword [rbp + 0x608]
cmp qword [rsp + 0x40], 0
jne 0x140002ec1
mov r8, rdi
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.140001cd0
cmp rsi, r14
je 0x140002f96
xor r13d, r13d
nop dword [rax]
mov rax, r14
sub rax, rsi
and rax, 0xfffffffffffffff8
cmp rax, 0x10
jl 0x140002f80
lea r8, [r14 - 8]
mov r10, qword [r8]
mov rax, qword [rsi]
mov qword [r8], rax
sub r8, rsi
sar r8, 3
mov rdx, r13
mov rcx, r13
lea r9, [r8 - 1]
sar r9, 1
test r9, r9
jle 0x140002f37
nop word [rax + rax]
add rcx, rcx
mov rax, qword [rsi + rcx*8 + 0x10]
cmp qword [rsi + rcx*8 + 8], rax
sbb rax, rax
add rax, 2
add rcx, rax
mov rax, qword [rsi + rcx*8]
mov qword [rsi + rdx*8], rax
mov rdx, rcx
cmp rcx, r9
jl 0x140002f10
cmp rdx, r9
jne 0x140002f4f
test r8b, 1
jne 0x140002f4f
mov rax, qword [rsi + r8*8 - 8]
mov qword [rsi + rdx*8], rax
lea rdx, [r8 - 1]
test rdx, rdx
jle 0x140002f7c
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdx - 1]
sar rax, 1
mov rcx, qword [rsi + rax*8]
cmp rcx, r10
jbe 0x140002f7c
mov qword [rsi + rdx*8], rcx
mov rdx, rax
test rax, rax
jg 0x140002f60
mov qword [rsi + rdx*8], r10
sub r14, 8
cmp r14, rsi
jne 0x140002ed0
mov qword [rbp + 8], r14
mov r13, qword [rsp + 0x38]
cmp qword [rsp + 0x78], 0
je 0x14000300f
cmp qword [rsp + 0x68], 0
je 0x14000300f
test r15, r15
mov r15, qword [rbp - 0x80]
je 0x140003013
cmp qword [rsp + 0x60], 0
je 0x140003013
cmp qword [rsp + 0x70], 0
je 0x140003013
test ebx, ebx
je 0x140003013
mov r14, qword [rbp - 0x28]
test rsi, rsi
je 0x1400030d9
sub r15, rsi
sar r15, 3
lea rdx, [r15*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400030d0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r15, qword [rbp - 0x80]
mov r12, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x70]
mov rdi, rdx
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14000308b
cmp rdx, qword [rax + 8]
jb 0x140003047
mov rcx, qword [rax + 0x10]
cmp rdx, rcx
jb 0x140003044
mov rcx, qword [rax]
mov rax, rcx
test rcx, rcx
jne 0x140003028
jmp 0x140003047
mov rdi, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.140003f20
mov rcx, rbx
test rbx, rbx
jne 0x140003060
mov rdx, qword [rbp - 0x70]
xor r9d, r9d
sub rdx, rdi
add r12, rdx
mov rdx, rdi
mov r11, qword [rbp - 0x68]
jmp 0x1400030a8
xor r9d, r9d
mov qword [rsp + 0x40], r9
sub rdx, rdi
add r12, rdx
mov rdx, rdi
mov r11, qword [rbp - 0x68]
jmp 0x1400030a8
inc rdx
dec r12
mov qword [rbp - 0x58], r12
mov qword [rsp + 0x30], rdx
mov qword [rbp - 0x70], rdx
cmp r12, 5
jae 0x1400029c0
jmp 0x140002fc3
mov r14, qword [rbp + 0x600]
jmp 0x140002fc7
mov rcx, rsi
call fcn.140003f20
nop
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0
test rcx, rcx
je 0x140003105
nop dword [rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.140003f20
mov rcx, rbx
test rbx, rbx
jne 0x1400030f0
mov r12d, dword [rbp + 0x5f0]
mov edx, 1
lea r8d, [rdx + 0xf]
mov rbx, qword [rbp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x140003131
mov eax, 0xfffffffc
jmp 0x14000210a
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x14000314d
lea eax, [rbx - 5]
jmp 0x14000210a
movzx eax, word [rax + 0x34]
movzx r9d, word [rbx + 0x36]
movzx r8d, word [rbx + 0x30]
movzx edx, word [rbx + 0x32]
mov dword [rsp + 0x20], eax
lea rcx, str.__hu._hu._hu._hu__n
call fcn.140001010
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400031db
mov rax, qword [rbp + 0x608]
mov rdi, qword [rbp - 0x60]
test rax, rax
je 0x1400031a8
mov qword [rsp + 0x20], rdi
mov r9, rcx
mov r8, r13
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001770
test eax, eax
jne 0x1400031db
mov rcx, qword [rbp - 0x40]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x1400031db
mov qword [rsp + 0x20], rdi
mov r9, rcx
mov r8, r13
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001770
test eax, eax
jne 0x1400031db
lea rcx, str.ERROR:_SingleUserPatch_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400031f7
mov r8, r13
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400013c0
jmp 0x140003204
lea rcx, str.ERROR:_CDefPolicy_Query_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov eax, dword [rbx + 0x30]
cmp eax, 0x60001
jbe 0x140003c5b
test r12d, r12d
jne 0x14000322b
lea rcx, str.ERROR:_CSLQuery_Initialize_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
jmp 0x14000210a
add r12, r13
mov r13d, dword [rbp + 0x600]
cmp eax, 0x60002
jne 0x140003305
mov rdi, qword [rsp + 0x38]
lea rbx, [r14 + rdi]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x350]
mov r8d, r13d
mov rdx, rbx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x1400032d0
nop
movzx eax, byte [rbp + 0x358]
add rbx, rax
sub r13, rax
cmp dword [rbp + 0x354], 0x47
jne 0x1400032ab
cmp dword [rbp + 0x50], 4
jne 0x1400032ab
cmp byte [rbp + 0x59], 1
jne 0x1400032ab
cmp dword [rbp + 0xa0], 1
jne 0x1400032ab
mov eax, dword [rbp + 0xa8]
add eax, 0xffffff3c
cmp eax, 1
jbe 0x1400032e4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x350]
mov r8, r13
mov rdx, rbx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140003270
lea rcx, str.ERROR:_SLGetWindowsInformationDWORDWrapper_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
jmp 0x14000210a
mov r8, qword [rbp + 0x60]
sub r8, rdi
add r8, rbx
mov rdx, qword [rbp - 0x10]
lea rcx, str.SLPolicyInternal._1_s1_nSLPolicyOffset._1_s_2_zX_nSLPolicyFunc._1_sNew_Win8SL_n
call fcn.140001ad0
xor eax, eax
jmp 0x14000210a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000333c
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x140003333
mov r9, rax
mov r14, qword [rsp + 0x38]
mov r8, r14
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140001070
jmp 0x14000334e
lea rcx, str.ERROR:_IsLicenseTypeLocalOnly_not_found
jmp 0x140003343
lea rcx, str.ERROR:_GetInstanceOfTSLicense_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov r14, qword [rsp + 0x38]
mov r8d, dword [rbp + 0x5f0]
mov rdx, qword [rbp - 0x10]
lea rcx, str.SLInitHook._1_s1_nSLInitOffset._1_s_2_lX_nSLInitFunc._1_sNew_CSLQuery_Initialize_n
call fcn.140001ad0
movzx eax, word [rbx + 0x34]
movzx r9d, word [rbx + 0x36]
movzx r8d, word [rbx + 0x30]
movzx edx, word [rbx + 0x32]
mov dword [rsp + 0x20], eax
lea rcx, str._n__hu._hu._hu._hu_SLInit__n
call fcn.140001010
mov rdx, qword [rsp + 0x48]
mov edi, dword [rdx + 0xc]
add rdi, r14
xor ebx, ebx
mov esi, dword [rdx + 0x10]
test rsi, rsi
je 0x1400033cc
nop dword [rax]
lea rcx, [rbx + rdi]
mov r8d, 0x7e
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowMultipleSessions
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003511
add rbx, 4
cmp rbx, rsi
jb 0x1400033a0
mov rdx, qword [rsp + 0x48]
mov edi, dword [rdx + 0xc]
add rdi, r14
xor ebx, ebx
mov esi, dword [rdx + 0x10]
mov r8, 0xffffffffffffffff
mov r15, r8
test rsi, rsi
je 0x140003419
lea rcx, [rbx + rdi]
mov r8d, 0x78
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowAppServerMode
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000352d
add rbx, 4
cmp rbx, rsi
jb 0x1400033e6
mov rdx, qword [rsp + 0x48]
mov r8, 0xffffffffffffffff
mov edi, dword [rdx + 0xc]
add rdi, r14
xor ebx, ebx
mov esi, dword [rdx + 0x10]
mov r14, r8
test rsi, rsi
je 0x140003463
nop dword [rax]
lea rcx, [rbx + rdi]
mov r8d, 0x6e
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowMultimon
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000354b
add rbx, 4
cmp rbx, rsi
jb 0x140003430
mov rdx, qword [rsp + 0x48]
mov r8, 0xffffffffffffffff
mov edi, dword [rdx + 0xc]
add rdi, qword [rsp + 0x38]
xor ebx, ebx
mov eax, dword [rdx + 0x10]
mov rsi, r8
test rax, rax
je 0x1400034b6
nop dword [rax + rax]
lea rcx, [rbx + rdi]
mov r8d, 0x72
lea rdx, str.TerminalServices_RemoteConnectionManager_MaxUserSessions
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003565
add rbx, 4
mov rdx, qword [rsp + 0x48]
mov eax, dword [rdx + 0x10]
cmp rbx, rax
jb 0x140003480
mov r8, 0xffffffffffffffff
mov eax, dword [rdx + 0xc]
add rax, qword [rsp + 0x38]
mov qword [rbp + 0x600], rax
xor ebx, ebx
mov ecx, dword [rdx + 0x10]
mov rdi, r8
test rcx, rcx
je 0x140003596
lea rcx, [rbx + rax]
mov r8d, 0xb4
lea rdx, str.TerminalServices_RemoteConnectionManager_ce0ad219_4670_4988_98fb_89b14c2f072b_MaxSessions
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003586
add rbx, 4
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + 0x10]
cmp rbx, rax
mov rax, qword [rbp + 0x600]
jb 0x1400034d6
jmp 0x140003596
mov rdx, qword [rsp + 0x48]
mov r15d, dword [rdx + 0xc]
add r15, rbx
mov edi, dword [rdx + 0xc]
add rdi, r14
xor ebx, ebx
mov esi, dword [rdx + 0x10]
jmp 0x1400033e6
mov rax, qword [rsp + 0x48]
mov r14d, dword [rax + 0xc]
add r14, rbx
mov edi, dword [rax + 0xc]
add rdi, qword [rsp + 0x38]
xor ebx, ebx
mov esi, dword [rax + 0x10]
jmp 0x140003430
mov rax, qword [rsp + 0x48]
mov esi, dword [rax + 0xc]
add rsi, rbx
mov edi, dword [rax + 0xc]
add rdi, qword [rsp + 0x38]
xor ebx, ebx
jmp 0x140003480
mov rcx, qword [rsp + 0x48]
mov edi, dword [rcx + 0xc]
add rdi, rbx
mov eax, dword [rcx + 0xc]
add rax, qword [rsp + 0x38]
mov qword [rbp + 0x600], rax
xor ebx, ebx
jmp 0x1400034d6
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax + 0xc]
add r8, rbx
mov qword [rbp - 8], r8
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x600], rax
mov qword [rbp + 0x608], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x78], rax
lea rbx, [rbp - 0x18]
lea rax, [rbp + 0x30]
lea r9, [rbp + 0x350]
mov rdx, r12
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
cmp dword [rsp + 0x54], 1
jne 0x140003775
mov r8, r13
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140003b2c
nop word [rax + rax]
movzx r11d, byte [rbp + 0x358]
add r12, r11
sub r13, r11
mov rax, qword [rbp + 0xb0]
mov r9d, dword [rbp + 0xa0]
mov rcx, qword [rbp + 0x60]
mov r8d, dword [rbp + 0x50]
movzx r10d, byte [rbp + 0x79]
mov edx, dword [rbp + 0x354]
cmp qword [rbx], 0
jne 0x14000367e
cmp edx, 0x1b7
jne 0x1400036b7
cmp r8d, 2
jne 0x1400036b7
cmp dword [rbp + 0x5c], 0xc9
jne 0x1400036b7
test ecx, ecx
jne 0x1400036b7
test r10b, r10b
je 0x1400036b7
cmp r9d, 1
jne 0x1400036a2
mov eax, dword [rbp + 0xa8]
cmp eax, 0x25
je 0x14000366e
add eax, 0xffffffd5
cmp eax, r9d
ja 0x14000369b
mov rax, qword [rbp + 0x70]
sub rax, qword [rbp - 0x50]
mov qword [rbx], rax
jmp 0x140003735
cmp edx, 0x1b7
jne 0x1400036b7
cmp r8d, 2
jne 0x1400036b7
cmp dword [rbp + 0x5c], 0xc9
jne 0x1400036b7
test ecx, ecx
jne 0x1400036b7
jmp 0x1400036a2
mov rax, qword [rbp + 0xb0]
test r10b, r10b
je 0x1400036b7
cmp r9d, 4
jne 0x1400036b7
cmp rax, 1
je 0x140003763
cmp r11b, 5
jne 0x140003735
cmp edx, 0x29c
jne 0x1400036cd
cmp r8d, 4
jne 0x140003735
jmp 0x1400036e4
cmp edx, 0x1b7
jne 0x140003735
cmp r8d, 1
jne 0x140003735
cmp r9d, 4
jne 0x140003735
mov rcx, rax
sub rcx, qword [rbp - 0x50]
cmp rcx, qword [rbp - 0x20]
jne 0x1400036f7
lea rbx, [rbp + 0x600]
jmp 0x140003735
cmp rcx, r15
jne 0x140003705
lea rbx, [rbp + 0x608]
jmp 0x140003735
cmp rcx, r14
jne 0x140003710
lea rbx, [rbp - 0x40]
jmp 0x140003735
cmp rcx, rsi
jne 0x14000371b
lea rbx, [rbp - 0x48]
jmp 0x140003735
cmp rcx, rdi
jne 0x140003726
lea rbx, [rbp - 0x60]
jmp 0x140003735
lea rax, [rbp - 0x68]
cmp rcx, qword [rbp - 8]
cmovne rax, rbx
mov rbx, rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x350]
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x50]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140003600
jmp 0x140003afe
mov rax, qword [rbp + 0x70]
sub rax, qword [rbp - 0x50]
mov qword [rsp + 0x78], rax
jmp 0x140003afe
cmp r13, 0x100
jbe 0x140003925
mov r8, r13
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140003b2c
movzx eax, byte [rbp + 0x358]
add r12, rax
sub r13, rax
mov ecx, dword [rbp + 0xa0]
movzx r11d, byte [rbp + 0x79]
mov eax, dword [rbp + 0x354]
cmp qword [rbx], 0
jne 0x140003808
cmp eax, 0x1b7
jne 0x140003808
cmp dword [rbp + 0x50], 2
jne 0x1400038e1
cmp dword [rbp + 0x60], 0xc5
jne 0x1400038e1
test r11b, r11b
je 0x1400038e1
cmp ecx, 1
jne 0x1400038cd
cmp dword [rbp + 0xa8], 0x25
jne 0x1400038cd
mov rax, qword [rbp + 0x70]
sub rax, qword [rsp + 0x38]
add rax, r12
mov qword [rbx], rax
jmp 0x1400038e1
mov rdx, r15
mov r8, r14
mov r9, rsi
mov r10, rdi
cmp eax, 0x18e
jne 0x1400038b7
cmp ecx, 2
jne 0x1400038e1
cmp dword [rbp + 0xb0], 0xc5
jne 0x1400038e1
cmp byte [rbp + 0xc9], 0
je 0x1400038e1
cmp dword [rbp + 0x50], 1
jne 0x1400038e1
cmp dword [rbp + 0x58], 0x36
jne 0x1400038e1
mov rcx, qword [rbp + 0xc0]
sub rcx, qword [rsp + 0x38]
add rcx, r12
cmp rcx, qword [rbp - 0x20]
jne 0x140003877
lea rbx, [rbp + 0x600]
jmp 0x1400038e1
cmp rcx, rdx
jne 0x140003885
lea rbx, [rbp + 0x608]
jmp 0x1400038e1
cmp rcx, r8
jne 0x140003890
lea rbx, [rbp - 0x40]
jmp 0x1400038e1
cmp rcx, r9
jne 0x14000389b
lea rbx, [rbp - 0x48]
jmp 0x1400038e1
cmp rcx, r10
jne 0x1400038a6
lea rbx, [rbp - 0x60]
jmp 0x1400038e1
lea rax, [rbp - 0x68]
cmp rcx, qword [rbp - 8]
cmovne rax, rbx
mov rbx, rax
jmp 0x1400038e1
cmp eax, 0x1b7
jne 0x1400038e1
cmp dword [rbp + 0x50], 2
jne 0x1400038e1
cmp dword [rbp + 0x60], 0xc5
jne 0x1400038e1
test r11b, r11b
je 0x1400038e1
cmp ecx, 4
jne 0x1400038e1
cmp qword [rbp + 0xb0], 1
je 0x14000390f
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x350]
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x50]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140003793
jmp 0x140003afe
mov rax, qword [rbp + 0x70]
sub rax, qword [rsp + 0x38]
add rax, r12
mov qword [rsp + 0x78], rax
jmp 0x140003afe
mov r8d, 0x11000
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140003b2c
nop dword [rax]
movzx eax, byte [rbp + 0x358]
add r12, rax
sub qword [rbp + 0x20], rax
mov r11d, dword [rbp + 0xa0]
mov ecx, dword [rbp + 0x50]
mov eax, dword [rbp + 0x354]
cmp eax, 0x139
jne 0x14000398b
cmp ecx, 4
jne 0x14000398b
cmp byte [rbp + 0x59], 1
jne 0x14000398b
cmp r11d, 1
jne 0x14000398b
cmp dword [rbp + 0xa8], 0xc5
jne 0x14000398b
add r12, qword [rbp + 0x60]
jmp 0x140003ad4
movzx r13d, byte [rbp + 0x79]
cmp qword [rbx], 0
jne 0x1400039da
cmp eax, 0x1b7
jne 0x1400039da
cmp ecx, 2
jne 0x140003ad4
cmp dword [rbp + 0x60], 0xc5
jne 0x140003ad4
test r13b, r13b
je 0x140003ad4
cmp r11d, 1
jne 0x140003aa1
mov rax, qword [rbp + 0x70]
sub rax, qword [rsp + 0x38]
add rax, r12
mov qword [rbx], rax
jmp 0x140003ad4
mov rdx, r15
mov r8, r14
mov r9, rsi
mov r10, rdi
cmp eax, 0x18e
jne 0x140003a8c
cmp r11d, 2
jne 0x140003ad4
cmp dword [rbp + 0xb0], 0xc5
jne 0x140003ad4
cmp byte [rbp + 0xc9], 0
je 0x140003ad4
cmp ecx, 1
jne 0x140003ad4
cmp dword [rbp + 0x58], 0x37
jne 0x140003ad4
mov rcx, qword [rbp + 0xc0]
sub rcx, qword [rsp + 0x38]
add rcx, r12
cmp rcx, qword [rbp - 0x20]
jne 0x140003a4c
lea rbx, [rbp + 0x600]
jmp 0x140003ad4
cmp rcx, rdx
jne 0x140003a5a
lea rbx, [rbp + 0x608]
jmp 0x140003ad4
cmp rcx, r8
jne 0x140003a65
lea rbx, [rbp - 0x40]
jmp 0x140003ad4
cmp rcx, r9
jne 0x140003a70
lea rbx, [rbp - 0x48]
jmp 0x140003ad4
cmp rcx, r10
jne 0x140003a7b
lea rbx, [rbp - 0x60]
jmp 0x140003ad4
lea rax, [rbp - 0x68]
cmp rcx, qword [rbp - 8]
cmovne rax, rbx
mov rbx, rax
jmp 0x140003ad4
cmp eax, 0x1b7
jne 0x140003acd
cmp ecx, 2
jne 0x140003ad4
cmp dword [rbp + 0x60], 0xc5
jne 0x140003ad4
test r13b, r13b
je 0x140003ad4
cmp r11d, 1
jne 0x140003ad4
mov eax, dword [rbp + 0xa8]
add eax, 0xffffffdb
cmp eax, r11d
ja 0x140003ad4
mov rax, qword [rbp + 0x70]
sub rax, qword [rsp + 0x38]
add rax, r12
mov qword [rsp + 0x78], rax
jmp 0x140003ad4
cmp eax, 0x2b6
je 0x140003afe
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x350]
mov r8, qword [rbp + 0x20]
mov rdx, r12
lea rcx, [rsp + 0x50]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140003940
mov r8, qword [rbp - 0x18]
test r8, r8
je 0x140003b23
mov rdi, qword [rbp - 0x10]
mov rdx, rdi
lea rcx, str.bServerSku._s_zX_n
call fcn.140001010
mov rbx, qword [rbp + 0x600]
jmp 0x140003b3f
mov rbx, qword [rbp + 0x600]
jmp 0x140003b2e
xor ebx, ebx
lea rcx, str.ERROR:_bServerSku_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdi, qword [rbp - 0x10]
test rbx, rbx
je 0x140003b58
mov r8, rbx
mov rdx, rdi
lea rcx, str.bRemoteConnAllowed._s_zX_n
call fcn.140001010
jmp 0x140003b65
lea rcx, str.ERROR:_bRemoteConnAllowed_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov r8, qword [rbp + 0x608]
test r8, r8
je 0x140003b82
mov rdx, rdi
lea rcx, str.bFUSEnabled._s_zX_n
call fcn.140001010
jmp 0x140003b8f
lea rcx, str.ERROR:_bFUSEnabled_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov r8, qword [rbp - 0x40]
test r8, r8
je 0x140003ba9
mov rdx, rdi
lea rcx, str.bAppServerAllowed._s_zX_n
call fcn.140001010
jmp 0x140003bb6
lea rcx, str.ERROR:_bAppServerAllowed_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov r8, qword [rbp - 0x48]
test r8, r8
je 0x140003bd0
mov rdx, rdi
lea rcx, str.bMultimonAllowed._s_zX_n
call fcn.140001010
jmp 0x140003bdd
lea rcx, str.ERROR:_bMultimonAllowed_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov r8, qword [rbp - 0x60]
test r8, r8
je 0x140003bf7
mov rdx, rdi
lea rcx, str.lMaxUserSessions._s_zX_n
call fcn.140001010
jmp 0x140003c04
lea rcx, str.ERROR:_lMaxUserSessions_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov r8, qword [rbp - 0x68]
test r8, r8
je 0x140003c1e
mov rdx, rdi
lea rcx, str.ulMaxDebugSessions._s_zX_n
call fcn.140001010
jmp 0x140003c2b
lea rcx, str.ERROR:_ulMaxDebugSessions_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x140003c4e
mov r8, rax
mov rdx, rdi
lea rcx, str.bInitialized._s_zX_n
call fcn.140001010
xor eax, eax
jmp 0x14000210a
lea rcx, str.ERROR:_bInitialized_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
jmp 0x14000210a