Function at 0x7ffe04621040
Capabilities:
Allocate thread local storage
Get thread local storage value
Query or enumerate registry value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xa30
mov rax, qword [0x7ffe0466e080]
xor rax, rsp
mov qword [rsp + 0xa20], rax
xor r12d, r12d
mov dword [rsp + 0x30], r12d
cmp qword [0x7ffe0466e840], r12
jne 0x7ffe04623afc
lea rax, [0x7ffe0466e7f0]
mov qword [0x7ffe0466e7f8], rax
mov qword [0x7ffe0466e7f0], rax
lea rax, [0x7ffe0466e798]
mov qword [0x7ffe0466e7a0], rax
mov qword [0x7ffe0466e798], rax
lea rax, [0x7ffe0466e7b0]
mov qword [0x7ffe0466e7b8], rax
mov qword [0x7ffe0466e7b0], rax
lea rax, [0x7ffe0466e828]
mov qword [0x7ffe0466e830], rax
mov qword [0x7ffe0466e828], rax
mov edi, 0x208
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x1f0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ebx, r12d
mov r8d, 0x104
lea rdx, [rsp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x7ffe04623b59
cmp eax, 0x104
je 0x7ffe04623b59
lea edx, [r12 + 0x5c]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
mov r10, rax
test rax, rax
je 0x7ffe04623b08
add r10, 2
mov rdx, rdi
lea r11, str.SYSTEMCurrentControlSetServicesldapTracinglsass.exe
mov rax, r11
lea r8, str.SYSTEMCurrentControlSetServicesldapTracing
sub r8, r11
nop word [rax + rax]
lea rcx, [rdx + 0x7ffffdf6]
test rcx, rcx
je 0x7ffe04621193
movzx ecx, word [r8 + rax]
test cx, cx
je 0x7ffe04621193
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x7ffe04621170
test rdx, rdx
je 0x7ffe04623b15
mov word [rax], r12w
test ebx, ebx
js 0x7ffe04623b65
mov rcx, rdi
mov rax, r11
mov ebx, r12d
cmp word [rax], bx
je 0x7ffe046211c0
add rax, 2
sub rcx, 1
jne 0x7ffe046211b1
test rcx, rcx
je 0x7ffe04623b23
mov rdx, rdi
sub rdx, rcx
mov qword [rsp + 0xa8], rdx
lea r13, [0x7ffe0465c990]
test ebx, ebx
js 0x7ffe04623b71
mov rax, rdi
sub rax, rdx
lea rcx, [r11 + rdx*2]
mov ebx, r12d
je 0x7ffe04621219
lea r8, [rdx + 0x7ffffdf6]
add r8, rax
mov rdx, r13
sub rdx, rcx
test r8, r8
je 0x7ffe04621219
movzx r9d, word [rcx + rdx]
test r9w, r9w
jne 0x7ffe04621e16
test rax, rax
je 0x7ffe04623b30
mov word [rcx], r12w
test ebx, ebx
js 0x7ffe04623b71
mov rcx, rdi
mov rax, r11
mov ebx, r12d
cmp word [rax], bx
je 0x7ffe04621246
add rax, 2
sub rcx, 1
jne 0x7ffe04621237
test rcx, rcx
je 0x7ffe04623b3e
mov rdx, rdi
sub rdx, rcx
mov qword [rsp + 0xb0], rdx
test ebx, ebx
js 0x7ffe04623b71
mov rcx, rdi
sub rcx, rdx
lea rax, [r11 + rdx*2]
mov ebx, r12d
je 0x7ffe046212a2
add rdx, 0x7ffffdf6
add rdx, rcx
sub r10, rax
test rdx, rdx
je 0x7ffe046212a2
movzx r8d, word [rax + r10]
test r8w, r8w
je 0x7ffe046212a2
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x7ffe04621281
test rcx, rcx
je 0x7ffe04623b4b
mov word [rax], r12w
test ebx, ebx
js 0x7ffe04623b71
lea r9, [0x7ffe0466e8a8]
xor r8d, r8d
lea rdx, [0x7ffe04636b70]
lea rcx, [0x7ffe0465ca40]
call qword [sym.imp.ntdll.dll_EtwEventRegister]
nop dword [rax + rax]
test eax, eax
jne 0x7ffe04623b71
lea rcx, [0x7ffe0466ee70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 1
lea rcx, [0x7ffe0466eda8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 2
lea rcx, [0x7ffe0466ee48]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 3
lea rcx, [0x7ffe0466edf8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 4
lea rcx, [0x7ffe0466edd0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 5
lea rcx, [0x7ffe0466ed08]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 6
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 7
lea rcx, [0x7ffe0466ed30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 8
lea rcx, [0x7ffe0466ee20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 9
lea rcx, [0x7ffe0466ed58]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x30], 0xa
jmp 0x7ffe04621545
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
nop dword [rax + rax]
mov dword [0x7ffe0466e0ac], eax
mov ebx, 0xffffffff
cmp eax, ebx
je 0x7ffe04623b99
mov dword [rsp + 0xd0], 0x11c
lea rcx, [rsp + 0xd0]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x7ffe04623cd0
cmp byte [rsp + 0x1ea], 1
jne 0x7ffe04623d52
cmp dword [0x7ffe0466eeac], 0
jne 0x7ffe04623d1d
mov rax, r12
mov qword [0x7ffe0466e840], rax
test rax, rax
jne 0x7ffe046215d1
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov qword [0x7ffe0466e840], rax
test rax, rax
je 0x7ffe04623d9e
cmp dword [0x7ffe0466eeac], 0
jne 0x7ffe04623eae
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov r15d, eax
mov dword [rsp + 0x34], eax
mov ecx, dword [0x7ffe0466e0ac]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x7ffe04621683
lea edx, [rax + 8]
lea r8d, [rax + 0x18]
mov rcx, qword [0x7ffe0466e840]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r14, rax
mov ecx, dword [0x7ffe0466eeac]
test ecx, ecx
jne 0x7ffe04623ee3
mov eax, dword [0x7ffe0466e8b8]
test r14, r14
je 0x7ffe0462165d
mov dword [r14], 0x6c546864
mov dword [r14 + 4], 0x10
add r14, 8
add eax, 0x10
mov dword [0x7ffe0466e8b8], eax
test ecx, ecx
jne 0x7ffe04623f29
test r14, r14
je 0x7ffe046242fa
mov rdx, r14
mov ecx, dword [0x7ffe0466e0ac]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
test r14, r14
je 0x7ffe046242fa
mov edx, 8
lea r8d, [rdx + 0x30]
mov rcx, qword [0x7ffe0466e840]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
mov ecx, dword [0x7ffe0466eeac]
test ecx, ecx
jne 0x7ffe04623f6e
mov eax, dword [0x7ffe0466e8b8]
test rsi, rsi
je 0x7ffe046216de
mov dword [rsi], 0x6c546864
mov dword [rsi + 4], 0x30
add rsi, 8
add eax, 0x30
mov dword [0x7ffe0466e8b8], eax
test ecx, ecx
jne 0x7ffe04623fb4
test rsi, rsi
je 0x7ffe046242cc
mov dword [rsi + 0x10], r15d
mov qword [rsi + 0x18], r12
mov qword [rsi + 0x20], r12
mov byte [rsi + 0x28], 0
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rbx, qword [0x7ffe0466e8a0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x74]
shl rcx, 0x20
mov eax, dword [rsp + 0x70]
or rcx, rax
movabs r12, 0x346dc5d63886594b
mov rax, r12
mul rcx
shr rdx, 0xb
test rbx, rbx
jne 0x7ffe04623ffe
cmp dword [0x7ffe0466eeac], 0
jne 0x7ffe04624037
mov r15, qword [0x7ffe0466e828]
lea rax, [0x7ffe0466e828]
cmp r15, rax
jne 0x7ffe0462406c
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov edx, dword [rsp + 0x7c]
shl rdx, 0x20
mov ecx, dword [rsp + 0x78]
or rdx, rcx
mov rax, r12
mul rdx
shr rdx, 0xb
mov qword [0x7ffe0466e8a0], rdx
mov r15d, dword [rsp + 0x34]
mov rax, qword [0x7ffe0466e828]
mov qword [rsi], rax
lea rcx, [0x7ffe0466e828]
mov qword [rsi + 8], rcx
mov qword [rax + 8], rsi
mov qword [0x7ffe0466e828], rsi
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov qword [r14 + 8], rsi
cmp dword [0x7ffe0466eeac], 0
jne 0x7ffe04624104
mov byte [0x7ffe0466e884], 1
xor r14d, r14d
mov dword [0x7ffe0466e814], r14d
mov dword [0x7ffe0466e864], r14d
mov dword [0x7ffe0466e808], r14d
mov qword [0x7ffe0466e848], r14
mov qword [0x7ffe0466e850], r14
mov qword [0x7ffe0466e800], r14
mov qword [0x7ffe0466e858], r14
mov qword [0x7ffe0466e7e8], r14
mov qword [0x7ffe0466e7d8], r14
mov qword [0x7ffe0466e7c0], r14
mov qword [0x7ffe0466e7e0], r14
mov qword [0x7ffe0466e7d0], r14
mov qword [0x7ffe0466e7c8], r14
mov dword [0x7ffe0466e7a8], r14d
mov dword [0x7ffe0466e838], r14d
mov dword [0x7ffe0466e810], r14d
mov dword [0x7ffe0466e80c], r14d
mov byte [0x7ffe0466e818], r14b
mov qword [0x7ffe0466e888], r14
mov qword [0x7ffe0466e820], r14
mov byte [0x7ffe0466e8c0], r14b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventA]
nop dword [rax + rax]
mov qword [0x7ffe0466e8c8], rax
mov dword [0x7ffe0466e81c], r14d
mov dword [0x7ffe0466e860], r14d
lea rcx, [0x7ffe0466edf8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
xorps xmm0, xmm0
movdqu xmmword [0x7ffe0466e770], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x7ffe0466e780], xmm1
mov qword [0x7ffe0466e790], r14
lea rcx, [0x7ffe0466edf8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rbx, str.SystemCurrentControlSetServicesLDAP
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x7ffe0462198d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.LdapClientIntegrity
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test esi, esi
jne 0x7ffe0462413c
cmp dword [rsp + 0x44], 4
jne 0x7ffe0462413c
mov eax, dword [rsp + 0x48]
mov dword [0x7ffe0466e0a4], eax
test esi, esi
jne 0x7ffe0462413c
mov dword [rsp + 0x4c], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x7ffe04621a37
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UseOldHostResolutionOrder
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test esi, esi
je 0x7ffe0462414b
mov byte [0x7ffe0466e86c], r14b
mov dword [rsp + 0x54], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x7ffe04621acb
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UseHostnameAsAlias
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test esi, esi
je 0x7ffe04624164
mov byte [0x7ffe0466e86d], r14b
mov dword [rsp + 0x5c], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x7ffe04621b61
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.RecvBufferSize
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test esi, esi
je 0x7ffe0462417d
mov ecx, dword [0x7ffe0466e0a8]
test esi, esi
je 0x7ffe04624197
mov dword [0x7ffe0466e0a8], 0x1000
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x610]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x68], 4
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x400]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, r14d
mov r8d, 0x104
lea rdx, [rsp + 0x400]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x7ffe0462420a
cmp eax, 0x104
je 0x7ffe0462420a
mov edx, 0x5c
lea rcx, [rsp + 0x400]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
mov r8, rax
test rax, rax
je 0x7ffe046241b9
add r8, 2
mov rdx, rdi
lea rcx, [rsp + 0x610]
lea rax, [rsp + 0x610]
sub rbx, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x7ffe04621c52
movzx eax, word [rcx + rbx]
test ax, ax
je 0x7ffe04621c52
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x7ffe04621c30
test rdx, rdx
je 0x7ffe046241c6
mov word [rcx], r14w
test esi, esi
js 0x7ffe04621d7e
mov rcx, rdi
lea rax, [rsp + 0x610]
mov esi, r14d
cmp word [rax], si
je 0x7ffe04621c84
add rax, 2
sub rcx, 1
jne 0x7ffe04621c75
test rcx, rcx
je 0x7ffe046241d4
mov rdx, rdi
sub rdx, rcx
mov qword [rsp + 0xb8], rdx
test esi, esi
js 0x7ffe04621d7e
mov rax, rdi
sub rax, rdx
lea rcx, [rsp + 0x610]
lea rcx, [rcx + rdx*2]
mov esi, r14d
je 0x7ffe04621cda
lea r9, [rdx + 0x7ffffdf6]
add r9, rax
sub r13, rcx
test r9, r9
je 0x7ffe04621cda
movzx edx, word [rcx + r13]
test dx, dx
jne 0x7ffe04621e30
test rax, rax
je 0x7ffe046241e1
mov word [rcx], r14w
test esi, esi
js 0x7ffe04621d7e
mov rcx, rdi
lea rax, [rsp + 0x610]
mov esi, r14d
nop dword [rax]
cmp word [rax], si
je 0x7ffe04621d0f
add rax, 2
sub rcx, 1
jne 0x7ffe04621d00
test rcx, rcx
je 0x7ffe046241ef
mov rdx, rdi
sub rdx, rcx
mov qword [rsp + 0xc0], rdx
test esi, esi
js 0x7ffe04621d7e
sub rdi, rdx
lea rax, [rsp + 0x610]
lea rax, [rax + rdx*2]
mov esi, r14d
je 0x7ffe04621d6f
lea rcx, [rdx + 0x7ffffdf6]
add rcx, rdi
sub r8, rax
nop dword [rax + rax]
test rcx, rcx
je 0x7ffe04621d6f
movzx edx, word [rax + r8]
test dx, dx
je 0x7ffe04621d6f
mov word [rax], dx
add rax, 2
dec rcx
sub rdi, 1
jne 0x7ffe04621d50
test rdi, rdi
je 0x7ffe046241fc
mov word [rax], r14w
test esi, esi
jne 0x7ffe04621dbb
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x610]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x7ffe0462421c
test esi, esi
je 0x7ffe0462426f
mov dword [0x7ffe0466e868], r14d
lock inc dword [0x7ffe0466e8e0]
cmp dword [0x7ffe0466eeac], r14d
jne 0x7ffe04624297
mov eax, 1
mov rcx, qword [rsp + 0xa20]
xor rcx, rsp
call fcn.7ffe04622890
lea r11, [rsp + 0xa30]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov word [rcx], r9w
add rcx, 2
dec r8
sub rax, 1
jne 0x7ffe04621205
jmp 0x7ffe04621219
mov word [rcx], dx
add rcx, 2
dec r9
sub rax, 1
jne 0x7ffe04621cc7
jmp 0x7ffe04621cda
lock inc dword [0x7ffe0466e8e0]
jmp 0x7ffe04621dde
lea r10, [rsp + 0x1f0]
jmp 0x7ffe0462114e
sub rax, 2
mov ebx, 0x8007007a
jmp 0x7ffe0462119c
mov ebx, 0x80070057
mov rdx, r12
jmp 0x7ffe046211cf
sub rcx, 2
mov ebx, 0x8007007a
jmp 0x7ffe04621222
mov ebx, 0x80070057
mov rdx, r12
jmp 0x7ffe04621255
sub rax, 2
mov ebx, 0x8007007a
jmp 0x7ffe046212ab
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r13, [0x7ffe0465c990]
jmp 0x7ffe046212af
mov rcx, qword [0x7ffe0466e8a8]
test rcx, rcx
je 0x7ffe046212e3
call qword [sym.imp.ntdll.dll_EtwEventUnregister]
nop dword [rax + rax]
mov qword [0x7ffe0466e8a8], r12
jmp 0x7ffe046212e3
cmp dword [0x7ffe0466eeac], 0
je 0x7ffe04623bd8
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04623bd8
test qword [0x7ffe0466eea0], 0x10000000
je 0x7ffe04623bd8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r8d, eax
lea rdx, str.LDAP_client_failed_to_allocate_thread_local_storage__error__0x_x._n
mov ecx, 0x10000000
call fcn.7ffe04636b9c
lea rcx, [0x7ffe0466ee70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466eda8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ee48]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466edf8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466edd0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed08]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ee20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed58]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
jmp 0x7ffe04623caa
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop dword [rax + rax]
mov dword [0x7ffe0466e0ac], ebx
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x7ffe0466e8a8]
test rcx, rcx
jne 0x7ffe04624495
jmp 0x7ffe046244a8
cmp dword [0x7ffe0466eeac], 0
je 0x7ffe04623d82
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04623d82
test qword [0x7ffe0466eea0], 0x4000000
je 0x7ffe04623d82
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r8d, eax
lea rdx, str.Could_not_get_any_version_information_from_GetVersionEx_0x_x_n
mov ecx, 0x4000000
call fcn.7ffe04636b9c
jmp 0x7ffe04623d82
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe046215a6
test qword [0x7ffe0466eea0], 0x4000000
je 0x7ffe046215a6
lea rdx, str.Platform_is_not_a_Windows_Server_n
mov ecx, 0x4000000
call fcn.7ffe04636c10
nop
jmp 0x7ffe046215a6
cmp dword [0x7ffe0466eeac], 0
je 0x7ffe04623d82
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04623d82
test qword [0x7ffe0466eea0], 0x4000000
je 0x7ffe04623d82
lea rdx, str.Platform_is_Windows_Server_n
mov ecx, 0x4000000
call fcn.7ffe04636c10
xor r8d, r8d
mov edx, 0x4000
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapCreate]
nop dword [rax + rax]
nop
jmp 0x7ffe046215a9
cmp dword [0x7ffe0466eeac], 0
je 0x7ffe04623ddd
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04623ddd
test qword [0x7ffe0466eea0], 0x10000000
je 0x7ffe04623ddd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r8d, eax
lea rdx, str.LDAP_client_failed_to_create_heap__error__0x_x._n
mov ecx, 0x10000000
call fcn.7ffe04636b9c
lea rcx, [0x7ffe0466ee70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466eda8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ee48]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466edf8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466edd0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed08]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ee20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed58]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
mov ecx, dword [0x7ffe0466e0ac]
cmp ecx, ebx
je 0x7ffe04623caa
jmp 0x7ffe04623c98
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe046215de
test qword [0x7ffe0466eea0], 0x4000000
je 0x7ffe046215de
lea rdx, str.LDAP_Client_API_32_initializing._n
mov ecx, 0x4000000
call fcn.7ffe04636c10
nop
jmp 0x7ffe046215de
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04621636
test byte [0x7ffe0466eea0], 8
je 0x7ffe04621636
mov dword [rsp + 0x20], 0x6c546864
mov r9, r14
mov r8d, 0x18
lea rdx, str.ldapMalloc_allocated_0x_x_bytes_at_address_0x_x_of_tag_0x_x._n
lea ecx, [r8 - 0x10]
call fcn.7ffe04636b9c
mov ecx, dword [0x7ffe0466eeac]
jmp 0x7ffe04621636
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04621665
test byte [0x7ffe0466eea0], 8
je 0x7ffe04621665
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x6c546864
mov r9, r14
mov r8d, 0x10
lea rdx, str.ldapMalloc_0x_08x_bytes_at_address_0x_x_of_tag__x__tot_d._n
lea ecx, [r8 - 8]
call fcn.7ffe04636b9c
nop
jmp 0x7ffe04621665
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe046216b9
test byte [0x7ffe0466eea0], 8
je 0x7ffe046216b9
mov dword [rsp + 0x20], 0x6c546864
mov r9, rsi
mov r8d, 0x38
lea rdx, str.ldapMalloc_allocated_0x_x_bytes_at_address_0x_x_of_tag_0x_x._n
lea ecx, [r8 - 0x30]
call fcn.7ffe04636b9c
mov ecx, dword [0x7ffe0466eeac]
jmp 0x7ffe046216b9
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe046216e6
test byte [0x7ffe0466eea0], 8
je 0x7ffe046216e6
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x6c546864
mov r9, rsi
mov r8d, 0x30
lea rdx, str.ldapMalloc_0x_08x_bytes_at_address_0x_x_of_tag__x__tot_d._n
lea ecx, [r8 - 0x28]
call fcn.7ffe04636b9c
mov ecx, dword [0x7ffe0466eeac]
jmp 0x7ffe046216e6
mov rax, rdx
sub rax, rbx
cmp rbx, rdx
ja 0x7ffe0462401e
cmp rax, 0x493e0
ja 0x7ffe04621756
cmp rbx, rdx
jbe 0x7ffe046217b0
mov ecx, 0xffffffff
add rax, rcx
cmp rax, 0x493e0
jbe 0x7ffe046217b0
jmp 0x7ffe04621756
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe04621763
test qword [0x7ffe0466eea0], 0x200000
je 0x7ffe04621763
lea rdx, str.Removing_all_per_thread_data_entries_that_are_marked_as_deleted_n
mov ecx, 0x200000
call fcn.7ffe04636c10
nop
jmp 0x7ffe04621763
mov r13, r15
mov r15, qword [r15]
cmp byte [r13 + 0x28], 1
jne 0x7ffe046240ef
mov rax, qword [r13 + 8]
mov qword [rax], r15
mov qword [r15 + 8], rax
mov rbx, qword [r13 + 0x18]
test rbx, rbx
je 0x7ffe046240bd
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x7ffe046240a3
call sym.WLDAP32.dll_ldap_memfreeA
mov edx, 0x7272454c
mov rcx, rbx
call fcn.7ffe04621ee0
mov rax, qword [rsp + 0x38]
mov rbx, rax
test rax, rax
jne 0x7ffe0462408d
mov rcx, qword [r13 + 0x20]
test rcx, rcx
je 0x7ffe046240db
mov rbx, qword [rcx]
mov edx, 0x7274414c
call fcn.7ffe04621ee0
mov rcx, rbx
test rbx, rbx
jne 0x7ffe046240c6
mov edx, 0x6c546864
mov rcx, r13
call fcn.7ffe04621ee0
lea rax, [0x7ffe0466e828]
cmp r15, rax
jne 0x7ffe0462406c
lea r13, [0x7ffe0465c990]
jmp 0x7ffe0462177a
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe046217f4
test qword [0x7ffe0466eea0], 0x200000
je 0x7ffe046217f4
mov r8d, r15d
lea rdx, str.Added_thread_data_entry_for_thread_0x_0lx_n
mov ecx, 0x200000
call fcn.7ffe04636b9c
nop
jmp 0x7ffe046217f4
mov dword [0x7ffe0466e0a4], 1
jmp 0x7ffe046219b2
cmp dword [rsp + 0x50], r14d
setne byte [0x7ffe0466e86c]
test esi, esi
je 0x7ffe04621a46
jmp 0x7ffe04621a3f
cmp dword [rsp + 0x58], r14d
setne byte [0x7ffe0466e86d]
test esi, esi
je 0x7ffe04621ada
jmp 0x7ffe04621ad3
cmp dword [rsp + 0x60], 4
jne 0x7ffe04621b77
mov ecx, dword [rsp + 0x64]
mov dword [0x7ffe0466e0a8], ecx
jmp 0x7ffe04621b6f
lea eax, [rcx - 0x1000]
cmp eax, 0xfff000
ja 0x7ffe04621b77
test ecx, 0xfff
je 0x7ffe04621b81
jmp 0x7ffe04621b77
lea r8, [rsp + 0x400]
jmp 0x7ffe04621c10
sub rcx, 2
mov esi, 0x8007007a
jmp 0x7ffe04621c5b
mov esi, 0x80070057
mov rdx, r14
jmp 0x7ffe04621c93
sub rcx, 2
mov esi, 0x8007007a
jmp 0x7ffe04621ce3
mov esi, 0x80070057
mov rdx, r14
jmp 0x7ffe04621d1e
sub rax, 2
mov esi, 0x8007007a
jmp 0x7ffe04621d78
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
nop
jmp 0x7ffe04621d7c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea rdx, str.ParallelRecvMode
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x7ffe04621dbb
cmp dword [rsp + 0x6c], 4
jne 0x7ffe04621dc3
mov eax, r14d
cmp dword [rsp + 0x34], eax
setne al
mov dword [0x7ffe0466e868], eax
test esi, esi
je 0x7ffe04621dca
jmp 0x7ffe04621dc3
cmp dword [0x7ffe0466eea8], r14d
je 0x7ffe04621dde
test qword [0x7ffe0466eea0], 0x4000000
je 0x7ffe04621dde
lea rdx, str.LDAP_Client_API_32_initialization_complete._n
mov ecx, 0x4000000
call fcn.7ffe04636c10
nop
jmp 0x7ffe04621dde
test ecx, ecx
je 0x7ffe046242fa
cmp dword [0x7ffe0466eea8], 0
je 0x7ffe046242fa
test qword [0x7ffe0466eea0], 0x4000
je 0x7ffe046242fa
mov r8d, r15d
lea rdx, str.Failed_to_allocate_thread_data_entry_for_thread_0x_0lx_n
mov ecx, 0x4000
call fcn.7ffe04636b9c
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
call fcn.7ffe04633864
test eax, eax
je 0x7ffe04624356
call fcn.7ffe04634408
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x3c]
shl rcx, 0x20
mov eax, dword [rsp + 0x38]
or rcx, rax
movabs rax, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
mov qword [0x7ffe0466e8a0], rdx
xor r12d, r12d
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp qword [0x7ffe0466e840], 0
je 0x7ffe0462439e
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, qword [0x7ffe0466e840]
cmp rcx, rax
je 0x7ffe0462439e
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapDestroy]
nop dword [rax + rax]
mov qword [0x7ffe0466e840], r12
lea rcx, [0x7ffe0466ee70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466eda8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ee48]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466edf8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466edd0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed08]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ee20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
lea rcx, [0x7ffe0466ed58]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
nop dword [rax + rax]
mov ecx, dword [0x7ffe0466e0ac]
cmp ecx, ebx
je 0x7ffe04624478
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop dword [rax + rax]
mov dword [0x7ffe0466e0ac], ebx
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x7ffe0466e8a8]
test rcx, rcx
je 0x7ffe046244a8
call qword [sym.imp.ntdll.dll_EtwEventUnregister]
nop dword [rax + rax]
mov qword [0x7ffe0466e8a8], r12
xor eax, eax
jmp 0x7ffe04621de3