Function at 0x1800157d0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2670]
mov eax, 0x2770
call fcn.180038620
sub rsp, rax
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x27b0], rbx
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp + 0x2660], rax
mov qword [rbp - 0x38], r8
mov r13, rdx
xor r12d, r12d
mov qword [rdx], r12
call fcn.180015570
mov dword [rbp - 0x40], eax
cmp eax, 0xffffffff
je 0x180016144
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
lea rcx, str.Psapi.dll
call fcn.1800429ec
mov r15, rax
movabs rsi, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [r12 - 1]
mov r14, qword [rsp + 0x78]
cmp rax, r14
ja 0x1800158b4
lea rdi, [rsp + 0x60]
cmp r14, 8
cmovae rdi, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.Psapi.dll
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r12w
jmp 0x1800159ad
cmp r15, rsi
ja 0x180016176
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x1800158ce
mov rbx, rsi
jmp 0x1800158ef
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x1800158e4
mov rbx, rsi
jmp 0x1800158ef
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x180015901
mov rdx, r8
jmp 0x18001590a
cmp rdx, 0x1000
jb 0x180015931
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.18003764c
test rax, rax
je 0x18001617c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180015946
test rdx, rdx
je 0x180015943
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
jmp 0x180015946
mov rdi, r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.Psapi.dll
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x1800159a8
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800159a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016182
call fcn.180037644
mov qword [rsp + 0x60], rdi
call fcn.18001b4e0
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.18001b580
mov r12, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180015a04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800159ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016188
call fcn.180037644
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
lea rcx, str.Advapi32.dll
call fcn.1800429ec
mov r15, rax
mov r14, qword [rbp - 0x68]
cmp rax, r14
ja 0x180015a7b
lea rdi, [rbp - 0x80]
cmp r14, 8
cmovae rdi, qword [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.Advapi32.dll
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x180015b84
cmp r15, rsi
ja 0x18001618e
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x180015a95
mov rbx, rsi
jmp 0x180015ab6
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180015aab
mov rbx, rsi
jmp 0x180015ab6
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180015ad9
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180015ae9
cmp rdx, 0x1000
jb 0x180015b10
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x180016194
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180015b20
test rdx, rdx
je 0x180015b20
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.Advapi32.dll
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x180015b80
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015b7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001619a
call fcn.180037644
mov qword [rbp - 0x80], rdi
call fcn.18001b4e0
mov rcx, rax
lea rdx, [rbp - 0x80]
call fcn.18001b580
mov r15, rax
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x180015bd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015bd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800161a0
call fcn.180037644
xor edi, edi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
lea rcx, str.Wtsapi32.dll
call fcn.1800429ec
mov rbx, rax
mov r14, qword [rbp - 0x48]
cmp rax, r14
ja 0x180015c4b
lea rdi, [rbp - 0x60]
cmp r14, 8
cmovae rdi, qword [rbp - 0x60]
mov qword [rbp - 0x50], rax
add rbx, rbx
mov r8, rbx
lea rdx, str.Wtsapi32.dll
mov rcx, rdi
call fcn.180039150
xor esi, esi
mov word [rbx + rdi], si
jmp 0x180015d4c
cmp rbx, rsi
ja 0x1800161a6
mov rcx, rbx
or rcx, 7
cmp rcx, rsi
ja 0x180015c7f
mov rdx, r14
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp r14, rax
ja 0x180015c7f
lea rax, [r14 + rdx]
mov rsi, rcx
cmp rcx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180015ca2
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180015cb2
cmp rdx, 0x1000
jb 0x180015cd9
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x1800161ac
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180015ce9
test rdx, rdx
je 0x180015ce9
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rsi
add rbx, rbx
mov r8, rbx
lea rdx, str.Wtsapi32.dll
mov rcx, rdi
call fcn.180039150
xor esi, esi
mov word [rdi + rbx], si
cmp r14, 8
jb 0x180015d48
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015d43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800161b2
call fcn.180037644
mov qword [rbp - 0x60], rdi
call fcn.18001b4e0
mov rcx, rax
lea rdx, [rbp - 0x60]
call fcn.18001b580
mov rbx, rax
mov qword [rbp - 0x20], rax
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x180015da4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015d9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016170
call fcn.180037644
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], si
test r12, r12
je 0x180016144
test r15, r15
je 0x180016144
test rbx, rbx
je 0x180016144
lea rdx, str.EnumProcesses
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.GetModuleFileNameExA
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rsp + 0x58], rax
lea rdx, str.GetProcessImageFileNameA
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rdx, str.OpenProcessToken
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rbp - 0x30], rax
lea rdx, str.GetTokenInformation
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x28], rax
test rbx, rbx
je 0x180016144
test rsi, rsi
jne 0x180015e54
test rdi, rdi
je 0x180016144
test r14, r14
je 0x180016144
test rax, rax
je 0x180016144
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x10]
call fcn.1800395e0
xor r14d, r14d
mov dword [rbp - 4], r14d
lea r8, [rbp - 4]
mov edx, 0x2000
lea rcx, [rbp + 0x10]
call rbx
test eax, eax
je 0x180016144
mov r15d, dword [rbp - 4]
shr r15d, 2
mov eax, 0x800
cmp r15d, eax
cmovae r15d, eax
mov dword [rbp - 8], r14d
mov dword [rbp + 4], r14d
mov r12d, r14d
test r15d, r15d
je 0x18001613a
lea r14, [rbp + 0x10]
xor edx, edx
mov r8d, 0x209
lea rcx, [rbp + 0x2450]
call fcn.1800395e0
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2340]
call fcn.1800395e0
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2230]
call fcn.1800395e0
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2010]
call fcn.1800395e0
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2120]
call fcn.1800395e0
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x180015f59
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001610f
test rdi, rdi
je 0x180015f74
mov r8d, 0x208
lea rdx, [rbp + 0x2450]
mov rcx, rbx
call rdi
test eax, eax
jne 0x180015f99
test rsi, rsi
je 0x1800160ec
mov r9d, 0x208
lea r8, [rbp + 0x2450]
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
je 0x1800160ec
mov qword [rsp + 0x40], 0x104
lea rax, [rbp + 0x2120]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rbp + 0x2010]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x2230]
mov r8d, 0x104
lea rdx, [rbp + 0x2340]
lea rcx, [rbp + 0x2450]
call fcn.18004685c
lea rdx, [rbp + 0x2010]
lea rcx, str.explorer
call fcn.1800464c8
test eax, eax
jne 0x1800160ec
lea rdx, [rbp + 0x2120]
lea rcx, str..exe
call fcn.1800464c8
test eax, eax
jne 0x1800160ec
mov r8, r13
mov edx, 0x2000e
mov rcx, rbx
call qword [rbp - 0x30]
test eax, eax
je 0x1800160ec
mov rcx, qword [r13]
test rcx, rcx
je 0x180016101
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 8]
lea edx, [r9 + 8]
call qword [rbp - 0x28]
test eax, eax
je 0x1800160ec
mov eax, dword [rbp - 0x40]
cmp dword [rbp - 8], eax
je 0x180016128
lea rdx, str.WTSQuerySessionInformationW
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.WTSFreeMemory
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x1800160e2
test rax, rax
je 0x1800160e2
xor eax, eax
mov qword [rbp - 0x10], rax
mov dword [rbp], eax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 8
mov edx, dword [rbp - 8]
xor ecx, ecx
call rsi
test eax, eax
je 0x1800160e2
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1800160e2
cmp dword [rbp], 4
jne 0x1800160e0
cmp dword [rcx], 0
je 0x180016120
call rdi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rcx, qword [r13]
test rcx, rcx
je 0x180016101
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [r13], rax
test rbx, rbx
je 0x18001610f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12d
add r14, 4
cmp r12d, r15d
jae 0x18001613a
jmp 0x180015ec1
call rdi
xor eax, eax
mov qword [rbp - 0x10], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
mov eax, dword [rbp - 8]
mov dword [rcx], eax
cmp qword [r13], 0
setne al
jmp 0x180016146
xor al, al
mov rcx, qword [rbp + 0x2660]
xor rcx, rsp
call fcn.180037620
mov rbx, qword [rsp + 0x27b0]
add rsp, 0x2770
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3