Function at 0x14018b660
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
push r12
push r13
sub rsp, 0x78
mov r13, r8
mov r9d, edx
mov r12, rcx
test r8, r8
jne 0x14018b688
mov eax, 0xc0000001
add rsp, 0x78
pop r13
pop r12
ret
mov eax, r9d
mov qword [rsp + 0x50], r15
and al, 0x13
neg al
mov eax, 0x10c0000
sbb ecx, ecx
and ecx, 0x80000
mov r8d, ecx
bts r8d, 0x12
test r9d, 0xa0000024
cmove r8d, ecx
lea rcx, [rsp + 0x40]
mov edx, r8d
bts edx, 0x18
test r9d, 0x50000048
cmove edx, r8d
mov r8, qword [r13 + 0x78]
bt r9d, 0x10
cmovb edx, eax
mov rax, qword [r13 + 0x58]
call qword [str.PB__]
mov r15d, eax
lfence
test eax, eax
js 0x14018b9c8
mov qword ss:[rsp + 0x90], rbx
mov qword ss:[rsp + 0x70], rbp
mov qword [rsp + 0x68], rsi
mov rsi, qword [r13 + 0x50]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r14
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14018b7da
mov rsi, qword ds:[rsi + 8]
lea r14, str.Service
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018b776
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018b7cb
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14018b750
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b886
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x14018b7b7
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018b7da
add rsi, 2
sub rdi, 1
jne 0x14018b790
jmp 0x14018b886
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018b77f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018b8eb
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SCManager
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018b83a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018b8b2
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018b810
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018b886
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018b878
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018b8eb
add rsi, 2
sub rdi, 1
jne 0x14018b850
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
test eax, eax
je 0x14018b8c5
mov rcx, qword [rsp + 0x40]
xor r15d, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14018b9a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018b843
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov rcx, qword ds:[rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14018b9a9
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 8
jne 0x14018b9e8
mov rsi, qword [rsi + 8]
lea rbp, [0x140266130]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018b93d
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018b9d6
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018b913
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018b986
sub rbp, rsi
nop
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018b978
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018b9e8
add rsi, 2
sub rdi, 1
jne 0x14018b950
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov r15d, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rsp + 0x58]
mov eax, r15d
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
add rsp, 0x78
pop r13
pop r12
ret
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018b946
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018ba9a
mov rsi, qword [rsi + 8]
lea rbp, str.FileObject
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018ba36
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018ba8b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018ba10
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b986
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018ba78
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018ba9a
add rsi, 2
sub rdi, 1
jne 0x14018ba50
jmp 0x14018b986
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018ba3f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018bb5a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaAccount
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018baf6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018bb4b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018bad0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018bd86
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018bb38
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018bb5a
add rsi, 2
sub rdi, 1
jne 0x14018bb10
jmp 0x14018bd86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018baff
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018bc1a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaPolicy
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018bbb6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018bc0b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018bb90
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018bd86
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018bbf8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018bc1a
add rsi, 2
sub rdi, 1
jne 0x14018bbd0
jmp 0x14018bd86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018bbbf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018bcda
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaSecret
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018bc76
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018bccb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018bc50
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018bd86
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018bcb8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018bcda
add rsi, 2
sub rdi, 1
jne 0x14018bc90
jmp 0x14018bd86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018bc7f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018bdbd
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaTrusted
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018bd3a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018bdae
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018bd10
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018bd86
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018bd78
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018bdbd
add rsi, 2
sub rdi, 1
jne 0x14018bd50
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_LsaSetSecurityObject]
mov rcx, qword [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x14018b9a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018bd43
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14018be7a
mov rsi, qword [rsi + 8]
lea rbp, str.SamAlias
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018be16
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018be6b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018bdf0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b9a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018be58
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018be7a
add rsi, 2
sub rdi, 1
jne 0x14018be30
jmp 0x14018b9a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018be1f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018bf3a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamDomain
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018bed6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018bf2b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018beb0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b9a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018bf18
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018bf3a
add rsi, 2
sub rdi, 1
jne 0x14018bef0
jmp 0x14018b9a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018bedf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14018bffa
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamGroup
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018bf96
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018bfeb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018bf70
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b9a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018bfd8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018bffa
add rsi, 2
sub rdi, 1
jne 0x14018bfb0
jmp 0x14018b9a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018bf9f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14018c0ba
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamServer
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018c056
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018c0ab
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018c030
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b9a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018c098
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018c0ba
add rsi, 2
sub rdi, 1
jne 0x14018c070
jmp 0x14018b9a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018c05f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14018c17a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamUser
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018c116
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018c16b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018c0f0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018b9a9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018c158
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018c17a
add rsi, 2
sub rdi, 1
jne 0x14018c130
jmp 0x14018b9a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018c11f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14018c2b7
mov rsi, qword ds:[rsi + 8]
lea rbp, str.TokenDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018c1da
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018c29a
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018c1b0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018c226
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018c21c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018c2b7
add rsi, 2
sub rdi, 1
jne 0x14018c1f0
xor r15d, r15d
mov byte [rsp + 0xa8], 0
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x48]
mov byte [rsp + 0xa0], 0
lea rdx, [rsp + 0xa8]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
nop dword [rax]
test eax, eax
js 0x14018b99b
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14018c2ac
mov rcx, qword [rsp + 0x40]
lea r9d, [r15 + 8]
lea r8, [rsp + 0xa0]
mov qword [rsp + 0xa0], rax
lea edx, [r15 + 6]
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
jmp 0x14018b99b
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018c1e3
mov r15d, 0xc0000079
jmp 0x14018b99e
mov rsi, qword ds:[r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14018c405
mov rsi, qword ds:[rsi + 8]
lea rbp, str.PowerDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018c31a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018c3f3
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018c2f0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14018c366
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018c35c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018c405
add rsi, 2
sub rdi, 1
jne 0x14018c330
call fcn.140182ac0
mov rdx, rax
mov r8b, 1
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
lea rdx, [0x14023dd20]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov edx, 0x1100
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetControlSecurityDescriptor]
mov rdx, r12
mov ecx, 0xf
call fcn.140137200
mov rbx, rax
test rax, rax
je 0x14018b9a9
mov rcx, rax
call fcn.14017a0a0
mov r15d, eax
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14018b9a9
call fcn.14013d2a0
jmp 0x14018b9a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018c323
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x14018c585
mov rsi, qword [rsi + 8]
lea rbp, str.RdpDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14018c456
nop dword [rax]
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018c4be
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x14018c430
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14018c4a6
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14018c49c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018c585
add rsi, 2
sub rdi, 1
jne 0x14018c470
call fcn.140179e20
mov rcx, rax
test rax, rax
jne 0x14018c4cd
mov r15d, 0xc0000135
jmp 0x14018b9a9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14018c45f
mov rax, qword [0x1402bff58]
xor r15d, r15d
test rax, rax
jne 0x14018c53a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14018c56e
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14018c56e
cmp dword ds:[rdx + rcx], 0x4550
jne 0x14018c56e
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14018c56e
cmp dword [rdx + 4], r15d
je 0x14018c56e
lea r8, [rcx + rax]
mov word [rsp + 0x20], r15w
lea r9, str.WTSSetListenerSecurityW
call fcn.140174840
mov qword [0x1402bff58], rax
test rax, rax
je 0x14018c575
mov qword [rsp + 0x28], r12
lea r9, str.RDP_Tcp
xor r8d, r8d
mov dword [rsp + 0x20], 0xc
xor edx, edx
xor ecx, ecx
call qword [str.PB__]
test eax, eax
mov ecx, 0xc0000079
cmovne ecx, r15d
mov r15d, ecx
jmp 0x14018b9a9
mov qword [0x1402bff58], r15
mov r15d, 0xc000007a
jmp 0x14018b9a9
mov rdi, qword [r13 + 0x50]
mov rsi, qword [rdi]
cmp rsi, 0x14
jne 0x14018b986
mov rdi, qword [rdi + 8]
lea r14, str.WmiDefault
mov rcx, rsi
shr rcx, 4
test rcx, rcx
je 0x14018c5da
nop dword [rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14018c65c
add rdi, 0x10
add r14, 0x10
sub rcx, 1
jne 0x14018c5b0
shr rsi, 1
and esi, 7
test rsi, rsi
je 0x14018c626
sub r14, rdi
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx ebp, word [r14 + rdi]
cmp cx, bp
je 0x14018c61b
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14018b986
add rdi, 2
sub rsi, 1
jne 0x14018c5f0
call fcn.140182ac0
mov r8b, 1
mov rdx, rax
mov rcx, r12
mov rbx, rax
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov rcx, r12
call fcn.14017a600
mov r15d, eax
jmp 0x14018b9a9
and esi, 0xf
shl rcx, 4
add rsi, rcx
shr rsi, 1
jmp 0x14018c5e0