Function at 0x140192960
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
push r12
push r13
sub rsp, 0x78
mov r13, r8
mov r9d, edx
mov r12, rcx
test r8, r8
jne 0x140192988
mov eax, 0xc0000001
add rsp, 0x78
pop r13
pop r12
ret
mov eax, r9d
mov qword [rsp + 0x50], r15
and al, 0x13
neg al
mov eax, 0x10c0000
sbb ecx, ecx
and ecx, 0x80000
mov r8d, ecx
bts r8d, 0x12
test r9d, 0xa0000024
cmove r8d, ecx
lea rcx, [rsp + 0x40]
mov edx, r8d
bts edx, 0x18
test r9d, 0x50000048
cmove edx, r8d
mov r8, qword [r13 + 0x78]
bt r9d, 0x10
cmovb edx, eax
mov rax, qword [r13 + 0x58]
call qword [case.0x14013d84a.0]
mov r15d, eax
lfence
test eax, eax
js 0x140192ce8
mov qword ss:[rsp + 0x90], rbx
mov qword ss:[rsp + 0x70], rbp
mov qword [rsp + 0x68], rsi
mov rsi, qword [r13 + 0x50]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r14
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x140192ada
mov rsi, qword ds:[rsi + 8]
lea r14, str.Service
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192a76
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192acb
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x140192a50
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192b86
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x140192ab7
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192ada
add rsi, 2
sub rdi, 1
jne 0x140192a90
jmp 0x140192b86
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192a7f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x140192c05
mov rsi, qword ds:[rsi + 8]
lea r14, str.SCManager
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192b3a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192bb2
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x140192b10
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140192b86
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x140192b7b
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192c05
add rsi, 2
sub rdi, 1
jne 0x140192b50
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
test eax, eax
je 0x140192bc5
mov rcx, qword [rsp + 0x40]
xor r15d, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140192cc9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192b43
cmp dword [0x1402bff40], 0xffffffff
jae 0x140192bdc
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140192be6
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov rcx, qword [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x140192cc9
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 8
jne 0x140192d08
mov rsi, qword [rsi + 8]
lea rbp, [0x14026d620]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192c5a
nop dword [rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192cf6
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192c30
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140192ca6
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192c98
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192d08
add rsi, 2
sub rdi, 1
jne 0x140192c70
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov r15d, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
mov r14, qword [rsp + 0x58]
mov eax, r15d
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
add rsp, 0x78
pop r13
pop r12
ret
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192c63
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140192dba
mov rsi, qword [rsi + 8]
lea rbp, str.FileObject
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192d56
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192dab
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192d30
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192ca6
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192d98
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192dba
add rsi, 2
sub rdi, 1
jne 0x140192d70
jmp 0x140192ca6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192d5f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140192e7a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaAccount
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192e16
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192e6b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192df0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x1401930a6
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192e58
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192e7a
add rsi, 2
sub rdi, 1
jne 0x140192e30
jmp 0x1401930a6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192e1f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x140192f3a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaPolicy
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192ed6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192f2b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192eb0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x1401930a6
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192f18
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192f3a
add rsi, 2
sub rdi, 1
jne 0x140192ef0
jmp 0x1401930a6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192edf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x140192ffa
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaSecret
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140192f96
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140192feb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140192f70
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x1401930a6
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140192fd8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192ffa
add rsi, 2
sub rdi, 1
jne 0x140192fb0
jmp 0x1401930a6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140192f9f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x1401930dd
mov rsi, qword ds:[rsi + 8]
lea rbp, str.LsaTrusted
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14019305a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401930ce
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193030
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x1401930a6
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193098
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401930dd
add rsi, 2
sub rdi, 1
jne 0x140193070
mov edx, dword [rsp + 0x98]
mov r8, r12
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_LsaSetSecurityObject]
mov rcx, qword [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x140192cc9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193063
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14019319a
mov rsi, qword [rsi + 8]
lea rbp, str.SamAlias
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193136
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019318b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193110
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192cc9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193178
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019319a
add rsi, 2
sub rdi, 1
jne 0x140193150
jmp 0x140192cc9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019313f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x14019325a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamDomain
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401931f6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019324b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x1401931d0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192cc9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193238
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019325a
add rsi, 2
sub rdi, 1
jne 0x140193210
jmp 0x140192cc9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401931ff
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x10
jne 0x14019331a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamGroup
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401932b6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019330b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193290
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192cc9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x1401932f8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019331a
add rsi, 2
sub rdi, 1
jne 0x1401932d0
jmp 0x140192cc9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x1401932bf
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x12
jne 0x1401933da
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamServer
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193376
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401933cb
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193350
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192cc9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x1401933b8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401933da
add rsi, 2
sub rdi, 1
jne 0x140193390
jmp 0x140192cc9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019337f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14019349a
mov rsi, qword ds:[rsi + 8]
lea rbp, str.SamUser
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x140193436
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019348b
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193410
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x140192cc9
sub rbp, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x140193478
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14019349a
add rsi, 2
sub rdi, 1
jne 0x140193450
jmp 0x140192cc9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14019343f
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x1401935da
mov rsi, qword ds:[rsi + 8]
lea rbp, str.TokenDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x1401934fa
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1401935bd
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x1401934d0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140193546
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14019353c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401935da
add rsi, 2
sub rdi, 1
jne 0x140193510
xor r15d, r15d
mov byte [rsp + 0xa8], 0
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x48]
mov byte [rsp + 0xa0], 0
lea rdx, [rsp + 0xa8]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
nop dword [rax]
test eax, eax
js 0x140192cbb
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1401935cf
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0xa0]
mov r9d, 8
mov qword [rsp + 0xa0], rax
mov edx, 6
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
jmp 0x140192cbb
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193503
mov r15d, 0xc0000079
jmp 0x140192cbe
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x140193725
mov rsi, qword ds:[rsi + 8]
lea rbp, str.PowerDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14019363a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbp]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193713
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193610
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140193686
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x14019367c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140193725
add rsi, 2
sub rdi, 1
jne 0x140193650
call fcn.140189960
mov rdx, rax
mov r8b, 1
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
lea rdx, [0x140245150]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov edx, 0x1100
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetControlSecurityDescriptor]
mov rdx, r12
mov ecx, 0xf
call fcn.14013baa0
mov rbx, rax
test rax, rax
je 0x140192cc9
mov rcx, rax
call fcn.140181860
mov r15d, eax
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140192cc9
call fcn.140141ea0
jmp 0x140192cc9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193643
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x1401938b9
mov rsi, qword [rsi + 8]
lea rbp, str.RdpDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14019377a
nop dword [rax]
movdqu xmm1, xmmword [rbp]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140193847
add rsi, 0x10
add rbp, 0x10
sub rdi, 1
jne 0x140193750
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x1401937c6
sub rbp, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r14d, word [rsi + rbp]
cmp cx, r14w
je 0x1401937bc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1401938b9
add rsi, 2
sub rdi, 1
jne 0x140193790
mov rax, qword [0x1402cabf8]
xor r15d, r15d
test rax, rax
jne 0x140193885
call fcn.1401815c0
nop
test rax, rax
je 0x140193875
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140193859
mov edx, dword ds:[rax + 0x3c]
lea ecx, [rdx - 1]
cmp ecx, 0x7ffffffd
ja 0x140193859
cmp dword [rdx + rax], 0x4550
jne 0x140193859
add rdx, 0x88
add rdx, rax
mov ecx, dword [rdx]
test ecx, ecx
je 0x140193859
cmp dword [rdx + 4], r15d
je 0x140193859
lea r8, ds:[rax + rcx]
mov word [rsp + 0x20], r15w
mov rcx, rax
lea r9, str.WTSSetListenerSecurityW
call fcn.14017e4c0
jmp 0x14019385c
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193783
mov rax, r15
mov qword [0x1402cabf8], rax
test rax, rax
jne 0x140193885
mov ecx, 0xc000007a
mov r15d, ecx
jmp 0x140192cc9
mov ecx, 0xc0000135
mov r15d, ecx
jmp 0x140192cc9
mov qword [rsp + 0x28], r12
lea r9, str.RDP_Tcp
xor r8d, r8d
mov dword [rsp + 0x20], 0xc
xor edx, edx
xor ecx, ecx
call qword [case.0x14013d84a.0]
test eax, eax
mov ecx, 0xc0000079
cmovne ecx, r15d
mov r15d, ecx
jmp 0x140192cc9
mov rsi, qword [r13 + 0x50]
mov rcx, qword [rsi]
cmp rcx, 0x14
jne 0x140192ca6
mov rsi, qword ds:[rsi + 8]
lea r14, str.WmiDefault
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14019391a
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rsi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14019399c
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x1401938f0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x140193966
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx ebp, word [r14 + rsi]
cmp cx, bp
je 0x14019395b
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140192ca6
add rsi, 2
sub rdi, 1
jne 0x140193930
call fcn.140189960
mov r8b, 1
mov rdx, rax
mov rcx, r12
mov rbx, rax
call qword [sym.imp.ntdll.dll_RtlSetOwnerSecurityDescriptor]
mov r8b, 1
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlSetGroupSecurityDescriptor]
mov rcx, r12
call fcn.140181de0
mov r15d, eax
jmp 0x140192cc9
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140193923