Function at 0x140001a20
Capabilities:
Enumerate pe sections
Extract resource via kernel32 functions

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x448]
sub rsp, 0x548
mov rax, rdx
xor edx, edx
cmp ecx, 2
jl 0x140001a4d
mov rcx, qword [rax + 8]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x140001a60
mov r8d, 0x801
lea rcx, str.termsrv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
test rax, rax
jne 0x140001a78
lea eax, [r12 - 1]
add rsp, 0x548
pop r12
pop rbp
ret
mov qword [rsp + 0x568], rbx
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x540], rsi
mov qword [rsp + 0x538], rdi
mov qword [rsp + 0x530], r13
movsxd r13, dword [r12 + 0x3c]
add r13, r12
mov qword [rsp + 0x528], r14
xor r14d, r14d
mov qword [rsp + 0x520], r15
mov ebx, r14d
mov qword [rbp - 0x68], rcx
movzx eax, word [r13 + 0x14]
lea rdi, [r13 + 0x18]
add rdi, rax
mov qword [rbp + 0x478], rdi
cmp r14w, word [r13 + 6]
jae 0x140001b2b
lea rsi, str..rdata
mov dword [rsp + 0x28], ecx
xor edx, edx
mov r9d, ecx
mov qword [rsp + 0x20], rsi
mov r8, rdi
lea ecx, [rdx + 0x7f]
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x140001b22
movzx eax, word [r13 + 6]
add rdi, 0x28
inc rbx
mov qword [rbp + 0x478], rdi
mov rcx, 0xffffffffffffffff
cmp rbx, rax
jb 0x140001ae2
jmp 0x140001b2b
test rdi, rdi
jne 0x140001b98
lea rcx, [rdi - 1]
movzx edi, word [r13 + 0x14]
mov rbx, r14
add rdi, 0x18
add rdi, r13
mov qword [rbp + 0x478], rdi
cmp r14w, word [r13 + 6]
jae 0x140001b8e
lea rsi, str..text
nop
mov dword [rsp + 0x28], ecx
xor edx, edx
mov r9d, ecx
mov qword [rsp + 0x20], rsi
mov r8, rdi
lea ecx, [rdx + 0x7f]
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x140001b98
movzx eax, word [r13 + 6]
add rdi, 0x28
inc rbx
mov qword [rbp + 0x478], rdi
mov rcx, 0xffffffffffffffff
cmp rbx, rax
jb 0x140001b50
mov rdi, r14
mov qword [rbp + 0x478], r14
mov r9d, dword [rdi + 0xc]
mov rax, r14
mov edi, dword [rdi + 0x10]
mov qword [rbp + 0x470], r9
lea rsi, [r9 + r12]
test rdi, rdi
je 0x140001be7
movzx ecx, byte [0x1400049f0]
mov rdx, qword [0x1400049e8]
mov r8, qword [str.CDefPolicy::Query]
cmp qword [rax + rsi], r8
jne 0x140001bde
cmp qword [rax + rsi + 8], rdx
jne 0x140001bde
cmp byte [rax + rsi + 0x10], cl
je 0x140001dc5
add rax, 4
cmp rax, rdi
jb 0x140001bc7
mov rax, 0xffffffffffffffff
mov rbx, r14
mov qword [rbp - 0x60], rax
mov r15, rsi
mov r14, rdi
test rdi, rdi
je 0x140001c2e
lea rcx, [rbx + r15]
mov r8d, 0x29
lea rdx, str.CEnforcementCore::GetInstanceOfTSLicense
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001ddb
add rbx, 4
cmp rbx, r14
jb 0x140001c00
mov rax, 0xffffffffffffffff
xor ebx, ebx
mov qword [rbp - 0x58], rax
mov r15, rsi
mov r14, rdi
test rdi, rdi
je 0x140001c6e
nop
lea rcx, [rbx + r15]
mov r8d, 0x38
lea rdx, str.CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001df6
add rbx, 4
cmp rbx, r14
jb 0x140001c40
mov rax, 0xffffffffffffffff
xor ebx, ebx
mov qword [rsp + 0x48], rax
mov r15, rsi
mov r14, rdi
test rdi, rdi
je 0x140001cae
lea rcx, [rbx + r15]
mov r8d, 0x17
lea rdx, str.IsSingleSessionPerUser
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001e12
add rbx, 4
cmp rbx, r14
jb 0x140001c80
mov rax, 0xffffffffffffffff
mov r14, qword [rbp + 0x470]
movabs rcx, 0x3a3a736c69745543
mov qword [rsp + 0x60], rax
cmp qword [rax + r12 - 8], rcx
jne 0x140001cd4
sub rax, 8
mov qword [rsp + 0x60], rax
xor r15d, r15d
mov ebx, r15d
test rdi, rdi
je 0x140001d07
nop
lea rcx, [rbx + rsi]
mov r8d, 0x21
lea rdx, str.CSLQuery::IsTerminalTypeLocalOnly
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001e22
add rbx, 4
cmp rbx, rdi
jb 0x140001ce0
mov rbx, r15
mov r15, 0xffffffffffffffff
mov qword [rsp + 0x58], r15
test rdi, rdi
je 0x140001d47
nop dword [rax + rax]
lea rcx, [rbx + rsi]
mov r8d, 0x80
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowRemoteConnections
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001e3a
add rbx, 4
cmp rbx, rdi
jb 0x140001d20
mov qword [rbp - 0x70], r15
mov esi, dword [r13 + 0x90]
add rsi, r12
mov rbx, rsi
cmp dword [rsi + 0xc], 0
je 0x140001d85
nop
mov ecx, dword [rbx + 0xc]
lea rdx, str.msvcrt.dll
add rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001e47
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140001d60
mov eax, 0xfffffffe
mov r14, qword [rsp + 0x528]
mov r13, qword [rsp + 0x530]
mov rdi, qword [rsp + 0x538]
mov rsi, qword [rsp + 0x540]
mov rbx, qword [rsp + 0x568]
mov r15, qword [rsp + 0x520]
add rsp, 0x548
pop r12
pop rbp
ret
lea rcx, [rax + r9]
mov rbx, r14
mov qword [rbp - 0x60], rcx
mov r15, rsi
mov r14, rdi
jmp 0x140001c00
mov rcx, qword [rbp + 0x470]
mov r15, rsi
add rcx, rbx
mov r14, rdi
mov qword [rbp - 0x58], rcx
xor ebx, ebx
jmp 0x140001c40
mov rcx, qword [rbp + 0x470]
mov r15, rsi
add rcx, rbx
mov r14, rdi
mov qword [rsp + 0x48], rcx
xor ebx, ebx
jmp 0x140001c80
mov r14, qword [rbp + 0x470]
lea rax, [rbx + r14]
jmp 0x140001cb5
lea rax, [rbx + r14]
mov rbx, r15
mov qword [rsp + 0x58], rax
mov r15, 0xffffffffffffffff
jmp 0x140001d20
lea rax, [rbx + r14]
mov qword [rbp - 0x70], rax
jmp 0x140001d4b
mov edi, dword [rbx]
add rdi, r12
mov rax, qword [rdi]
test rax, rax
je 0x140001e85
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rax + 2]
add rcx, r12
lea rdx, [0x1400044ac]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001ef3
mov rax, qword [rdi + 8]
add rdi, 8
test rax, rax
jne 0x140001e60
mov qword [rsp + 0x68], r15
cmp dword [rsi + 0xc], 0
mov rbx, rsi
mov qword [rsp + 0x50], r15
je 0x140001ec1
nop dword [rax + rax]
mov ecx, dword [rbx + 0xc]
lea rdx, str.api_ms_win_core_kernel32_legacy_l1_1_1.dll
add rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001f08
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140001ea0
cmp dword [rsi + 0xc], 0
mov rbx, rsi
je 0x140001f4a
nop
mov ecx, dword [rbx + 0xc]
lea rdx, [0x1400044e8]
add rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001f08
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140001ed0
jmp 0x140001f4a
mov ecx, dword [rbx + 0x10]
mov eax, dword [rbx]
sub rcx, rax
sub rcx, r12
add rcx, rdi
mov qword [rsp + 0x68], rcx
jmp 0x140001e8a
mov edi, dword [rbx]
add rdi, r12
mov rax, qword [rdi]
test rax, rax
je 0x140001f45
nop word [rax + rax]
lea rcx, [rax + 2]
add rcx, r12
lea rdx, str.VerifyVersionInfoW
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001f7c
mov rax, qword [rdi + 8]
add rdi, 8
test rax, rax
jne 0x140001f20
mov qword [rsp + 0x50], r15
mov eax, dword [r13 + 0xa0]
add rax, r12
mov qword [rsp + 0x40], rax
mov eax, 0xaaaaaaab
mul dword [r13 + 0xa4]
mov edi, edx
shr edi, 3
mov dword [rbp + 0x470], edi
test edi, edi
jne 0x140001f92
lea eax, [rdi - 3]
jmp 0x140001d8a
mov r14d, dword [rbx + 0x10]
mov eax, dword [rbx]
sub r14, rax
sub r14, r12
add r14, rdi
mov qword [rsp + 0x50], r14
jmp 0x140001f4a
xor ebx, ebx
lea rcx, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov r14d, ebx
mov qword [rsp + 0x38], rbx
mov r15d, ebx
mov r13d, ebx
lea r8d, [rbx + 2]
mov esi, ebx
call qword [sym.imp.Zydis.dll_ZydisDecoderInit]
mov dword [rbp + 0x460], ebx
mov eax, ebx
test edi, edi
je 0x1400022eb
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rbp + 0x470]
mov rdi, rcx
mov qword [rsp + 0x70], rdx
nop
mov ebx, eax
test r14, r14
jne 0x14000205b
mov r9, qword [rbp - 0x60]
lea rax, [rbx + rbx*2]
lea r8, [rcx + rax*4]
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140001070
test rax, rax
je 0x140002056
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x140002018
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x14000204e
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x140002030
mov r14d, dword [rax]
jmp 0x14000229e
mov rcx, qword [rsp + 0x40]
lea rbx, [rbx + rbx*2]
shl rbx, 2
cmp qword [rsp + 0x30], 0
jne 0x1400020da
mov r9, qword [rbp - 0x58]
lea r8, [rbx + rcx]
lea rcx, [rsp + 0x78]
mov rdx, r12
call fcn.140001070
test rax, rax
je 0x1400020da
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x140002098
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x1400020ce
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x1400020b0
mov eax, dword [rax]
mov qword [rsp + 0x30], rax
jmp 0x1400022a3
test r15, r15
jne 0x140002146
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x78]
mov r9, qword [rsp + 0x48]
add r8, rbx
mov rdx, r12
call fcn.140001070
test rax, rax
je 0x140002146
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x140002111
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x14000213e
nop dword [rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x140002120
mov r15d, dword [rax]
jmp 0x14000229e
test r13, r13
jne 0x1400021b6
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x78]
mov r9, qword [rsp + 0x60]
add r8, rbx
mov rdx, r12
call fcn.140001070
test rax, rax
je 0x1400021b6
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x14000217d
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x1400021ae
nop dword [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x140002190
mov r13d, dword [rax]
jmp 0x14000229e
cmp qword [rsp + 0x38], 0
jne 0x14000222c
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x78]
mov r9, qword [rsp + 0x58]
add r8, rbx
mov rdx, r12
call fcn.140001070
test rax, rax
je 0x14000222c
mov ecx, dword [rdi + 8]
mov rax, rdi
test cl, 1
je 0x1400021f0
lea rax, [r12 + rcx]
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x14000221e
nop dword [rax + rax]
movzx eax, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rax
and rax, 0xfffffffffffffffe
lea rax, [rcx + rax*2]
mov ecx, dword [rax + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x140002200
mov ebx, dword [rax]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rbx
jmp 0x1400022a8
test rsi, rsi
jne 0x14000229e
mov eax, dword [rbp + 0x460]
mov rdx, r12
mov r9, qword [rbp - 0x70]
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x40]
lea r8, [rax + rcx*4]
lea rcx, [rsp + 0x78]
call fcn.140001070
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000229e
mov ecx, dword [rdi + 8]
mov rsi, rdi
test cl, 1
je 0x140002272
lea rsi, [r12 + rcx]
and rsi, 0xfffffffffffffffc
mov ecx, dword [rsi + 8]
add rcx, r12
test byte [rcx], 0x20
je 0x14000229e
nop dword [rax]
movzx esi, byte [rcx + 2]
lea rcx, [rcx + 4]
inc rsi
and rsi, 0xfffffffffffffffe
lea rsi, [rcx + rsi*2]
mov ecx, dword [rsi + 8]
add rcx, r12
test byte [rcx], 0x20
jne 0x140002280
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
test r14, r14
je 0x1400022c6
test rax, rax
je 0x1400022c6
test r15, r15
je 0x1400022c6
test r13, r13
je 0x1400022c6
test rbx, rbx
je 0x1400022c6
test rsi, rsi
jne 0x1400022f7
mov eax, dword [rbp + 0x460]
add rdi, 0xc
mov rcx, qword [rsp + 0x40]
inc eax
mov dword [rbp + 0x460], eax
cmp eax, dword [rbp + 0x470]
jb 0x140001fe0
jmp 0x1400022f7
mov rax, qword [rbp + 0x470]
mov qword [rsp + 0x70], rax
mov edx, 1
mov rcx, r12
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x140002318
mov eax, 0xfffffffc
jmp 0x140001d8a
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x140002334
lea eax, [rbx - 5]
jmp 0x140001d8a
movzx eax, word [rax + 0x34]
lea rcx, str.__hu._hu._hu._hu__n
movzx r9d, word [rbx + 0x36]
movzx r8d, word [rbx + 0x30]
movzx edx, word [rbx + 0x32]
mov dword [rsp + 0x20], eax
call fcn.140001010
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400023b9
mov rdi, qword [rsp + 0x50]
test r15, r15
je 0x14000238b
mov r9, rax
mov qword [rsp + 0x20], rdi
mov r8, r12
lea rcx, [rsp + 0x78]
mov rdx, r15
call fcn.140001780
test eax, eax
jne 0x1400023b9
mov rax, qword [rsp + 0x68]
test r13, r13
je 0x1400023b9
mov r9, rax
mov qword [rsp + 0x20], rdi
mov r8, r12
lea rcx, [rsp + 0x78]
mov rdx, r13
call fcn.140001780
test eax, eax
jne 0x1400023b9
lea rcx, str.ERROR:_SingleUserPatch_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
test r14, r14
je 0x1400023d0
mov r8, r12
lea rcx, [rsp + 0x78]
mov rdx, r14
call fcn.140001440
jmp 0x1400023dd
lea rcx, str.ERROR:_CDefPolicy_Query_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov ecx, dword [rbx + 0x30]
cmp ecx, 0x60001
jbe 0x140002c70
test rsi, rsi
jne 0x140002405
lea rcx, str.ERROR:_CSLQuery_Initialize_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
jmp 0x140001d8a
mov eax, dword [rsi]
mov edi, dword [rsi + 4]
sub rdi, rax
mov qword [rsp + 0x68], rdi
lea r13, [rax + r12]
cmp ecx, 0x60002
jne 0x1400024d7
mov rbx, qword [rsp + 0x70]
lea rax, [rbp - 0x50]
add rbx, r12
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea r9, [rbp + 0x2d0]
mov r8, rdi
lea rcx, [rsp + 0x78]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x1400024a6
nop
movzx eax, byte [rbp + 0x2d8]
add rbx, rax
sub rdi, rax
cmp dword [rbp + 0x2d4], 0x47
jne 0x140002481
cmp dword [rbp - 0x30], 4
jne 0x140002481
cmp byte [rbp - 0x27], 1
jne 0x140002481
cmp dword [rbp + 0x20], 1
jne 0x140002481
cmp dword [rbp + 0x28], 0xc5
je 0x1400024ba
lea rax, [rbp - 0x50]
mov r8, rdi
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x78]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140002450
lea rcx, str.ERROR:_SLGetWindowsInformationDWORDWrapper_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
jmp 0x140001d8a
mov rdx, qword [rbp - 0x20]
lea rcx, str.SLPolicyInternal.x641_nSLPolicyOffset.x64_llX_nSLPolicyFunc.x64New_Win8SL_n
sub rdx, r12
add rdx, rbx
call fcn.140001010
xor eax, eax
jmp 0x140001d8a
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140002506
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400024fd
mov r9, rax
lea rcx, [rsp + 0x78]
mov r8, r12
call fcn.140001170
jmp 0x140002513
lea rcx, str.ERROR:_IsLicenseTypeLocalOnly_not_found
jmp 0x14000250d
lea rcx, str.ERROR:_GetInstanceOfTSLicense_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov edx, dword [rsi]
lea rcx, str.SLInitHook.x641_nSLInitOffset.x64_lX_nSLInitFunc.x64New_CSLQuery_Initialize_n
call fcn.140001010
movzx eax, word [rbx + 0x34]
lea rcx, str._n__hu._hu._hu._hu_SLInit__n
movzx r9d, word [rbx + 0x36]
movzx r8d, word [rbx + 0x30]
movzx edx, word [rbx + 0x32]
mov dword [rsp + 0x20], eax
call fcn.140001010
mov rdx, qword [rbp + 0x478]
xor r15d, r15d
mov ebx, r15d
mov esi, dword [rdx + 0xc]
mov edi, dword [rdx + 0x10]
add rsi, r12
test rdi, rdi
je 0x14000258e
nop
lea rcx, [rbx + rsi]
mov r8d, 0x7e
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowMultipleSessions
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400026ed
add rbx, 4
cmp rbx, rdi
jb 0x140002560
mov rdx, qword [rbp + 0x478]
mov edi, dword [rdx + 0xc]
mov r9, 0xffffffffffffffff
mov esi, dword [rdx + 0x10]
add rdi, r12
mov rbx, r15
mov r14, r9
test rsi, rsi
je 0x1400025e5
nop dword [rax]
lea rcx, [rbx + rdi]
mov r8d, 0x78
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowAppServerMode
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000270c
add rbx, 4
cmp rbx, rsi
jb 0x1400025b0
mov rdx, qword [rbp + 0x478]
mov r9, 0xffffffffffffffff
mov edi, dword [rdx + 0xc]
mov rbx, r15
mov r15d, dword [rdx + 0x10]
add rdi, r12
mov rsi, r9
test r15, r15
je 0x140002635
nop word [rax + rax]
lea rcx, [rbx + rdi]
mov r8d, 0x6e
lea rdx, str.TerminalServices_RemoteConnectionManager_AllowMultimon
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000272b
add rbx, 4
cmp rbx, r15
jb 0x140002600
mov rdx, qword [rbp + 0x478]
mov r9, 0xffffffffffffffff
mov ebx, dword [rdx + 0xc]
xor r15d, r15d
mov eax, dword [rdx + 0x10]
add rbx, r12
mov rdi, r9
test rax, rax
je 0x140002688
nop dword [rax]
lea rcx, [r15 + rbx]
mov r8d, 0x72
lea rdx, str.TerminalServices_RemoteConnectionManager_MaxUserSessions
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140002746
mov rdx, qword [rbp + 0x478]
add r15, 4
mov eax, dword [rdx + 0x10]
cmp r15, rax
jb 0x140002650
mov r9, 0xffffffffffffffff
mov eax, dword [rdx + 0xc]
xor r15d, r15d
mov ecx, dword [rdx + 0x10]
add rax, r12
mov qword [rbp + 0x470], rax
mov rbx, r9
test rcx, rcx
je 0x14000277a
nop word [rax + rax]
lea rcx, [r15 + rax]
mov r8d, 0xb4
lea rdx, str.TerminalServices_RemoteConnectionManager_ce0ad219_4670_4988_98fb_89b14c2f072b_MaxSessions
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140002768
mov rcx, qword [rbp + 0x478]
add r15, 4
mov eax, dword [rcx + 0x10]
cmp r15, rax
mov rax, qword [rbp + 0x470]
jb 0x1400026b0
jmp 0x14000277a
mov rdx, qword [rbp + 0x478]
mov r14d, dword [rdx + 0xc]
mov edi, dword [rdx + 0xc]
add r14, rbx
mov esi, dword [rdx + 0x10]
add rdi, r12
mov rbx, r15
jmp 0x1400025b0
mov rax, qword [rbp + 0x478]
mov esi, dword [rax + 0xc]
mov edi, dword [rax + 0xc]
add rsi, rbx
mov rbx, r15
add rdi, r12
mov r15d, dword [rax + 0x10]
jmp 0x140002600
mov rax, qword [rbp + 0x478]
mov edi, dword [rax + 0xc]
add rdi, rbx
mov ebx, dword [rax + 0xc]
add rbx, r12
xor r15d, r15d
jmp 0x140002650
mov rcx, qword [rbp + 0x478]
mov ebx, dword [rcx + 0xc]
mov eax, dword [rcx + 0xc]
add rbx, r15
add rax, r12
mov qword [rbp + 0x470], rax
xor r15d, r15d
jmp 0x1400026b0
mov rax, qword [rbp + 0x478]
mov r9d, dword [rax + 0xc]
add r9, r15
mov qword [rbp - 0x68], r9
mov r8, qword [rsp + 0x68]
lea r15, [rsp + 0x58]
xor eax, eax
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x58], rax
mov rdx, r13
mov qword [rbp + 0x470], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
cmp r8, 0x64
jbe 0x140002967
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140002b58
movzx eax, byte [rbp + 0x2d8]
mov r11, qword [rsp + 0x68]
add r13, rax
mov r10d, dword [rbp + 0x20]
sub r11, rax
cmp qword [r15], 0
mov eax, dword [rbp + 0x2d4]
mov qword [rsp + 0x68], r11
jne 0x140002855
cmp eax, 0x1b4
jne 0x140002855
cmp dword [rbp - 0x30], 2
jne 0x140002925
cmp dword [rbp - 0x20], 0xc5
jne 0x140002925
cmp byte [rbp - 0x10], 1
jne 0x140002925
cmp r10d, 1
jne 0x140002918
cmp dword [rbp + 0x28], 0x25
jne 0x140002925
mov rax, qword [rbp - 8]
sub rax, r12
add rax, r13
mov qword [r15], rax
jmp 0x140002925
mov rcx, r14
mov rdx, rsi
mov r8, rdi
mov r9, rbx
cmp eax, 0x18c
jne 0x1400028fc
cmp r10d, 2
jne 0x140002925
cmp dword [rbp + 0x30], 0xc5
jne 0x140002925
cmp byte [rbp + 0x40], 1
jne 0x140002925
cmp dword [rbp - 0x30], 1
jne 0x140002925
cmp dword [rbp - 0x28], 0x36
jne 0x140002925
mov r10, qword [rbp + 0x48]
sub r10, r12
add r10, r13
cmp r10, qword [rbp - 0x70]
jne 0x1400028ba
lea r15, [rbp + 0x470]
jmp 0x140002925
cmp r10, rcx
jne 0x1400028c6
lea r15, [rsp + 0x70]
jmp 0x140002925
cmp r10, rdx
jne 0x1400028d2
lea r15, [rsp + 0x60]
jmp 0x140002925
cmp r10, r8
jne 0x1400028de
lea r15, [rsp + 0x50]
jmp 0x140002925
cmp r10, r9
jne 0x1400028ea
lea r15, [rsp + 0x40]
jmp 0x140002925
cmp r10, qword [rbp - 0x68]
lea rax, [rsp + 0x38]
cmovne rax, r15
mov r15, rax
jmp 0x140002925
cmp eax, 0x1b4
jne 0x140002925
cmp dword [rbp - 0x30], 2
jne 0x140002925
cmp dword [rbp - 0x20], 0xc5
jne 0x140002925
cmp byte [rbp - 0x10], 1
jne 0x140002925
cmp r10d, 4
jne 0x140002925
cmp qword [rbp + 0x30], 1
je 0x140002953
lea rax, [rbp - 0x50]
mov r8, r11
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
mov rdx, r13
lea rcx, [rsp + 0x78]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x1400027e0
jmp 0x140002b30
mov rax, qword [rbp - 8]
sub rax, r12
add rax, r13
mov qword [rsp + 0x30], rax
jmp 0x140002b30
mov r8d, 0x11000
mov qword [rbp + 0x478], r8
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
js 0x140002b58
movzx eax, byte [rbp + 0x2d8]
sub qword [rbp + 0x478], rax
add r13, rax
mov eax, dword [rbp + 0x2d4]
mov r11d, dword [rbp + 0x20]
mov r10d, dword [rbp - 0x30]
cmp eax, 0x137
jne 0x1400029cc
cmp r10d, 4
jne 0x1400029cc
cmp byte [rbp - 0x27], 1
jne 0x1400029cc
cmp r11d, 1
jne 0x1400029cc
cmp dword [rbp + 0x28], 0xc5
jne 0x1400029cc
add r13, qword [rbp - 0x20]
jmp 0x140002b03
cmp qword [r15], 0
jne 0x140002a16
cmp eax, 0x1b4
jne 0x140002a16
cmp r10d, 2
jne 0x140002b03
cmp dword [rbp - 0x20], 0xc5
jne 0x140002b03
cmp byte [rbp - 0x10], 1
jne 0x140002b03
cmp r11d, 1
jne 0x140002b03
mov rax, qword [rbp - 8]
sub rax, r12
add rax, r13
mov qword [r15], rax
jmp 0x140002b03
mov rcx, r14
mov rdx, rsi
mov r8, rdi
mov r9, rbx
cmp eax, 0x18c
jne 0x140002ac3
cmp r11d, 2
jne 0x140002b03
cmp dword [rbp + 0x30], 0xc5
jne 0x140002b03
cmp byte [rbp + 0x40], 1
jne 0x140002b03
cmp r10d, 1
jne 0x140002b03
cmp dword [rbp - 0x28], 0x37
jne 0x140002b03
mov r10, qword [rbp + 0x48]
sub r10, r12
add r10, r13
cmp r10, qword [rbp - 0x70]
jne 0x140002a7e
lea r15, [rbp + 0x470]
jmp 0x140002b03
cmp r10, rcx
jne 0x140002a8d
lea r15, [rsp + 0x70]
jmp 0x140002b03
cmp r10, rdx
jne 0x140002a99
lea r15, [rsp + 0x60]
jmp 0x140002b03
cmp r10, r8
jne 0x140002aa5
lea r15, [rsp + 0x50]
jmp 0x140002b03
cmp r10, r9
jne 0x140002ab1
lea r15, [rsp + 0x40]
jmp 0x140002b03
cmp r10, qword [rbp - 0x68]
lea rax, [rsp + 0x38]
cmovne rax, r15
mov r15, rax
jmp 0x140002b03
cmp eax, 0x1b4
jne 0x140002afc
cmp r10d, 2
jne 0x140002b03
cmp dword [rbp - 0x20], 0xc5
jne 0x140002b03
cmp byte [rbp - 0x10], 1
jne 0x140002b03
cmp r11d, 1
jne 0x140002b03
cmp dword [rbp + 0x28], 0x25
jne 0x140002b03
mov rax, qword [rbp - 8]
sub rax, r12
add rax, r13
mov qword [rsp + 0x30], rax
jmp 0x140002b03
cmp eax, 0x2b2
je 0x140002b30
mov r8, qword [rbp + 0x478]
lea rax, [rbp - 0x50]
lea r9, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
mov rdx, r13
lea rcx, [rsp + 0x78]
call qword [sym.imp.Zydis.dll_ZydisDecoderDecodeFull]
test eax, eax
jns 0x140002982
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140002b4f
lea rcx, str.bServerSku.x64_llX_n
call fcn.140001010
mov rbx, qword [rbp + 0x470]
jmp 0x140002b67
mov rbx, qword [rbp + 0x470]
jmp 0x140002b5a
xor ebx, ebx
lea rcx, str.ERROR:_bServerSku_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
test rbx, rbx
je 0x140002b7d
mov rdx, rbx
lea rcx, str.bRemoteConnAllowed.x64_llX_n
call fcn.140001010
jmp 0x140002b8a
lea rcx, str.ERROR:_bRemoteConnAllowed_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140002ba2
lea rcx, str.bFUSEnabled.x64_llX_n
call fcn.140001010
jmp 0x140002baf
lea rcx, str.ERROR:_bFUSEnabled_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140002bc7
lea rcx, str.bAppServerAllowed.x64_llX_n
call fcn.140001010
jmp 0x140002bd4
lea rcx, str.ERROR:_bAppServerAllowed_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140002bec
lea rcx, str.bMultimonAllowed.x64_llX_n
call fcn.140001010
jmp 0x140002bf9
lea rcx, str.ERROR:_bMultimonAllowed_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140002c11
lea rcx, str.lMaxUserSessions.x64_llX_n
call fcn.140001010
jmp 0x140002c1e
lea rcx, str.ERROR:_lMaxUserSessions_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002c36
lea rcx, str.ulMaxDebugSessions.x64_llX_n
call fcn.140001010
jmp 0x140002c43
lea rcx, str.ERROR:_ulMaxDebugSessions_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140002c63
mov rdx, rax
lea rcx, str.bInitialized.x64_llX_n
call fcn.140001010
xor eax, eax
jmp 0x140001d8a
lea rcx, str.ERROR:_bInitialized_not_found
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
jmp 0x140001d8a