Function at 0x140019140
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x14009f100]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, r8
mov rdi, rdx
mov r15, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 7
jbe 0x14001917b
mov rcx, qword [rdx]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001939c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x1400191cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x14001932c
mov rax, rdi
cmp qword [rdi + 0x18], 7
jbe 0x1400191d8
mov rax, qword [rdi]
mov dword [rsp + 0x6c], 0xffffffff
mov qword [rsp + 0x78], rax
mov r14d, r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x74], r12d
mov rsi, r12
lea r8, [rsp + 0x80]
xor edx, edx
lea rcx, [rsp + 0x6c]
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x1400192e1
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x78]
mov edx, 1
mov ecx, dword [rsp + 0x6c]
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x1400192e1
mov r13, 0xffffffffffffffff
nop dword [rax]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
mov ecx, dword [rsp + 0x6c]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
je 0x1400192bb
cmp eax, 0xea
jne 0x1400192d4
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x68], eax
test rsi, rsi
je 0x140019295
mov rcx, rsi
call fcn.140036bb4
mov eax, dword [rsp + 0x68]
mov ecx, eax
mov eax, 0x29c
mul rcx
cmovb rax, r13
mov rcx, rax
call fcn.140036e88
mov rsi, rax
mov eax, r14d
inc r14d
cmp eax, 3
jb 0x140019250
jmp 0x1400192d4
cmp dword [rsp + 0x74], r12d
jne 0x1400192d4
xor r8d, r8d
mov edx, 1
mov ecx, dword [rsp + 0x6c]
call qword [sym.imp.RstrtMgr.DLL_RmShutdown]
test rsi, rsi
je 0x1400192e1
mov rcx, rsi
call fcn.140036bb4
mov ecx, dword [rsp + 0x6c]
cmp ecx, 0xffffffff
je 0x1400192f0
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x1400192fd
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001939c
lea rcx, [rsp + 0x48]
call fcn.140024930
cmp qword [rax + 0x18], 7
jbe 0x140019340
mov rax, qword [rax]
cmp qword [rdi + 0x18], 7
jbe 0x14001934a
mov rdi, qword [rdi]
mov r8, rax
mov rdx, rdi
lea rcx, str.____Cant_open_file:__ls._Error:__ls_n
call fcn.140001430
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1400193bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019395
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400193de
call fcn.140036bb4
jmp 0x1400193bb
mov r9, rbx
mov r8, rdi
mov rdx, r15
mov rcx, rsi
call fcn.1400189b0
test al, al
jne 0x1400193bb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140036840
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140046420
nop
int3