Function at 0x1400638a2
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x308
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x44], 0
mov ecx, 0x21
mov dl, 1
call fcn.140062ffb
mov rsi, rdx
add rdi, rbx
lea rdx, [rsp + 0x108]
mov qword [rdx], rbx
mov qword [rdx + 8], rdi
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rdi, [rsp + 0x78]
mov rcx, rdi
call fcn.140062cbe
mov r8, qword [rdi + 8]
mov qword [rsp + 0x68], r8
cmp qword [rdi], 0
je 0x140063919
mov rcx, qword [0x14009e2b0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x44]
xor ebx, ebx
xor edx, edx
mov r8, rsi
call sub.rstrtmgr.dll_RmStartSession
test eax, eax
jne 0x140063b4f
mov ecx, dword [rsp + 0x44]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
lea r8, [rsp + 0x68]
mov edx, 1
xor r9d, r9d
call sub.rstrtmgr.dll_RmRegisterResources
test eax, eax
jne 0x140063b46
lea rdx, [rsp + 0x48]
mov dword [rdx], ebx
lea r8, [rsp + 0x4c]
mov dword [r8], ebx
lea r15, [rsp + 0x74]
mov dword [r15], ebx
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x20], r15
xor r9d, r9d
call sub.rstrtmgr.dll_RmGetList
cmp eax, 0xea
jne 0x140063b46
mov r14d, dword [rsp + 0x48]
mov dword [rsp + 0x4c], r14d
lea rcx, [rsp + 0x108]
mov r8d, 0x200
xor edx, edx
call fcn.140071950
lea rcx, [rsp + 0x78]
mov r8d, 0x90
xor edx, edx
call fcn.140071950
test r14, r14
je 0x140063a37
imul rbx, r14, 0x29c
mov al, byte [0x14009e330]
xor ecx, ecx
mov rdx, rbx
call fcn.14005ea40
test rax, rax
je 0x140063b74
mov rdi, rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
cmp r14d, 2
jb 0x140063a58
lea r12, [r14 - 1]
mov rbx, rdi
mov rcx, rbx
add rbx, 0x29c
mov r8d, 0x29c
xor edx, edx
call fcn.140071950
dec r12
jne 0x140063a10
lea r12, [r14 - 1]
test r14d, r14d
jne 0x140063a5e
jmp 0x140063aaa
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 4
mov qword [rsp + 0x60], 0
mov edi, 4
xor r12d, r12d
jmp 0x140063aaa
xor r12d, r12d
mov rbx, rdi
mov qword [rbx], 0
mov dword [rbx + 8], 0
lea rcx, [rbx + 0xc]
lea rdx, [rsp + 0x108]
mov r8d, 0x200
call fcn.1400712b0
add rbx, 0x20c
lea rdx, [rsp + 0x78]
mov r8d, 0x90
mov rcx, rbx
call fcn.1400712b0
inc r12
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x4c]
mov r9, rdi
call sub.rstrtmgr.dll_RmGetList
xor ebx, ebx
test eax, eax
jne 0x140063b2f
cmp dword [rsp + 0x48], 0
je 0x140063b2f
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcessId]
test r12, r12
je 0x140063b15
imul rcx, r12, 0x29c
xor edx, edx
mov r8d, 1
xor r9d, r9d
cmp dword [rdi + rdx], eax
movzx r9d, r9b
cmove r9d, r8d
add rdx, 0x29c
cmp rcx, rdx
jne 0x140063af8
test r9b, 1
jne 0x140063b2d
mov ecx, dword [rsp + 0x44]
mov edx, 1
xor r8d, r8d
call sub.rstrtmgr.dll_RmShutdown
test eax, eax
sete bl
jmp 0x140063b2f
xor ebx, ebx
test r14, r14
je 0x140063b46
mov rcx, qword [0x14009e2b0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [rsp + 0x44]
call sub.rstrtmgr.dll_RmEndSession
mov rcx, qword [0x14009e2b0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
add rsp, 0x308
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 4
mov rdx, rbx
call fcn.140072100
int3