Function at 0x14002001c
Capabilities:
Create restart manager session
Encode data using xor
Enumerate processes that use resource

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x768
mov r12, r8
mov r14, rdx
mov r13, rcx
mov rdx, qword [rdx + 8]
mov r8, qword [r14 + 0x10]
lea r15, [rsp + 0x4c8]
mov rcx, r15
call fcn.140054330
mov rdx, qword [r12 + 8]
mov r8, qword [r12 + 0x10]
lea rbx, [rsp + 0x220]
mov rcx, rbx
call fcn.140054330
lea rbp, [rsp + 0xb8]
mov rcx, rbp
mov rdx, r15
mov r8, rbx
call fcn.140200955
cmp qword [rbp], 0
je 0x14002013f
mov dword [rsp + 0x40], 0
lea rax, [0x1403b3c98]
mov qword [rsp + 0x220], rax
mov rcx, qword [rsp + 0x220]
movabs rax, 0xdc477c03c72f4f38
mov qword [rsp + 0x220], rax
mov rdx, qword [rsp + 0x220]
call fcn.140201ef7
xorps xmm0, xmm0
movaps xmmword [rsp + 0x220], xmm0
movaps xmmword [rsp + 0x230], xmm0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x1403bef08]
mov rbp, qword [rcx + rdx + 8]
xor rbp, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0x228], rbp
add rcx, 8
cmp rcx, 0x18
jb 0x1400200ea
mov ecx, 0x96bec389
xor ecx, dword [rax + 0x20]
mov dword [rsp + 0x240], ecx
mov al, byte [rax + 0x24]
xor al, 0x2e
mov byte [rsp + 0x244], al
mov dl, byte [rsp + 0x220]
movzx esi, dl
test sil, sil
mov qword [rsp + 0x70], r13
js 0x140020151
mov edi, 1
jmp 0x1400201d1
mov byte [r13 + 8], 1
mov qword [r13], 0
jmp 0x140020af4
mov eax, esi
and eax, 0x1f
movzx ebp, byte [rsp + 0x221]
and ebp, 0x3f
cmp sil, 0xdf
jbe 0x1400201ab
movzx ecx, byte [rsp + 0x222]
shl ebp, 6
and ecx, 0x3f
or ecx, ebp
cmp dl, 0xf0
jb 0x1400201b9
movzx esi, byte [rsp + 0x223]
and eax, 7
shl eax, 0x12
shl ecx, 6
and esi, 0x3f
or esi, ecx
or esi, eax
mov edi, 4
cmp esi, 0x110000
jne 0x1400201c5
mov ebx, 2
jmp 0x1400203c5
shl eax, 6
or eax, ebp
mov edi, 2
mov esi, eax
jmp 0x1400201d1
shl eax, 0xc
or ecx, eax
mov edi, 3
mov esi, ecx
cmp esi, 0xffff
ja 0x140020592
mov r13, r12
xor r15d, r15d
lea rcx, [rsp + 0x245]
lea rax, [rsp + rdi]
add rax, 0x220
sub rcx, rax
add rcx, 3
shr rcx, 2
cmp rcx, 4
mov r12d, 3
cmovae r12, rcx
movabs rax, 0x3fffffffffffffff
xor ebx, ebx
cmp r12, rax
setne al
je 0x140020b9b
mov qword [rsp + 0x48], r14
mov bl, al
add rbx, rbx
lea rbp, [r12 + r12]
add rbp, 2
mov rcx, rbp
mov rdx, rbx
call fcn.14002c720
test rax, rax
je 0x140020ba2
inc r12
mov word [rax], si
lea r14, [rsp + 0x4c8]
mov qword [r14], r12
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 1
mov ebx, 1
mov r12, r13
mov r13, qword [rsp + 0x70]
test r15w, r15w
jne 0x140020311
cmp rdi, 0x25
je 0x140020393
mov dl, byte [rsp + rdi + 0x220]
movzx r15d, dl
test r15b, r15b
js 0x140020293
inc rdi
jmp 0x140020311
mov ecx, r15d
and ecx, 0x1f
movzx ebp, byte [rsp + rdi + 0x221]
and ebp, 0x3f
cmp r15b, 0xdf
jbe 0x1400202ee
movzx esi, byte [rsp + rdi + 0x222]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp dl, 0xf0
jb 0x1400202fc
movzx r15d, byte [rsp + rdi + 0x223]
and ecx, 7
shl ecx, 0x12
shl esi, 6
and r15d, 0x3f
or r15d, esi
or r15d, ecx
cmp r15d, 0x110000
je 0x140020393
add rdi, 4
jmp 0x140020308
add rdi, 2
shl ecx, 6
or ecx, ebp
mov r15d, ecx
jmp 0x140020311
add rdi, 3
shl ecx, 0xc
or esi, ecx
mov r15d, esi
cmp r15d, 0xffff
ja 0x14002036a
xor esi, esi
cmp rbx, qword [rsp + 0x4c8]
je 0x140020335
mov word [rax + rbx*2], r15w
inc rbx
mov qword [rsp + 0x4d8], rbx
mov r15d, esi
jmp 0x14002026a
lea rax, [rsp + rdi]
add rax, 0x220
lea r8, [rsp + 0x245]
sub r8, rax
add r8, 3
shr r8, 2
inc r8
mov rcx, r14
mov rdx, rbx
call fcn.1403b2b2d
mov rax, qword [rsp + 0x4d0]
jmp 0x14002031d
add r15d, 0xffff0000
mov ecx, r15d
shr ecx, 0xa
or ecx, 0xd800
and r15d, 0x3ff
or r15d, 0xdc00
mov esi, r15d
mov r15d, ecx
jmp 0x140020313
mov rbx, qword [rsp + 0x4d0]
cmp qword [rsp + 0x4c8], 0
je 0x1400203b8
mov rcx, qword [0x14051f200]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov r14, qword [rsp + 0x48]
lea r15, [rsp + 0x4c8]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8, rbx
call qword [sym.imp.rstrtmgr.dll_RmStartSession]
test eax, eax
je 0x1400203ff
call sub.KERNEL32.DLL_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.1401cfbf4
mov qword [r13], rax
lea rax, fcn.14007ddf7
mov qword [r13 + 8], rax
jmp 0x140020ae7
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x10]
xor eax, eax
mov qword [rsp + 0x4c8], rax
mov qword [rsp + 0x4d0], 1
mov qword [rsp + 0x4d8], rax
movabs rbp, 0x2000000000
lea r8, [rsp + 0x220]
mov qword [r8 + 0x30], rbp
mov byte [r8 + 0x38], 3
mov qword [r8 + 0x10], rax
mov qword [r8 + 0x20], rax
mov qword [r8], r15
lea rax, fcn.140030c20
mov qword [r8 + 8], rax
call fcn.1402401b0
test al, al
jne 0x140020baf
mov rax, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x4d8]
add rcx, rax
lea rdx, [rsp + 0x220]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rcx, [rsp + 0xd0]
call fcn.140231180
cmp qword [rsp + 0x4c8], 0
je 0x1400204c1
mov r8, qword [rsp + 0x4d0]
mov rcx, qword [0x14051f200]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0xd8]
lea rbx, [rsp + 0x220]
mov qword [rbx], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 0
mov edx, 1
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.rstrtmgr.dll_RmRegisterResources]
test eax, eax
je 0x14002052c
call sub.KERNEL32.DLL_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.1401cfbf4
mov qword [r13], rax
lea rax, fcn.14007ddf7
mov qword [r13 + 8], rax
mov esi, 1
jmp 0x140020ac0
lea rdx, [rsp + 0x44]
mov dword [rdx], edi
lea r8, [rsp + 0x54]
mov dword [r8], edi
lea rsi, [rsp + 0xec]
mov dword [rsi], edi
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
call qword [sym.imp.rstrtmgr.dll_RmGetList]
test eax, eax
je 0x1400205bb
cmp eax, 0xea
jne 0x140020a14
mov edi, dword [rsp + 0x44]
test rdi, rdi
je 0x1400205c5
imul rbp, rdi, 0x29c
mov edx, 4
mov rcx, rbp
call fcn.14002c720
test rax, rax
je 0x140020bdd
mov ecx, dword [rsp + 0x44]
jmp 0x1400205cc
mov r13, r12
add esi, 0xffff0000
mov eax, esi
shr eax, 0xa
or eax, 0xd800
and esi, 0x3ff
or esi, 0xdc00
mov r15d, esi
mov esi, eax
jmp 0x1400201d7
mov byte [r13 + 8], 0
jmp 0x140020ab0
xor ecx, ecx
mov eax, 4
lea r8, [rsp + 0x54]
mov dword [r8], ecx
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x58], rax
mov r9, rax
call qword [sym.imp.rstrtmgr.dll_RmGetList]
test eax, eax
je 0x140020636
call sub.KERNEL32.DLL_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.1401cfbf4
mov qword [r13], rax
lea rax, fcn.14007ddf7
mov qword [r13 + 8], rax
test edi, edi
je 0x140020ab8
mov rcx, qword [0x14051f200]
xor edx, edx
mov r8, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.DLL_HeapFree]
jmp 0x140020ab8
mov qword [rsp + 0xa8], rdi
mov eax, dword [rsp + 0x54]
test rax, rax
je 0x1400209fd
imul rax, rax, 0x29c
mov rbp, qword [rsp + 0x58]
add rax, rbp
mov qword [rsp + 0xc8], rax
lea r13, [rsp + 0x170]
lea r15, [rsp + 0x130]
mov r8d, 0x29c
lea rsi, [rsp + 0x4c8]
mov rcx, rsi
mov qword [rsp + 0x68], rbp
mov rdx, rbp
call fcn.1403abad0
mov r8d, 0x29c
mov rcx, rbx
mov rdx, rsi
call fcn.1403abad0
lea rax, [0x1403bc75f]
mov qword [rsp + 0x170], rax
mov rcx, qword [rsp + 0x170]
movabs rax, 0x2194e5f903348ac7
mov qword [rsp + 0x170], rax
mov rdx, qword [rsp + 0x170]
call fcn.140202c36
mov rcx, qword [rax]
movabs rdx, 0xf92d4798bd79f573
xor rcx, rdx
mov qword [rsp + 0x78], rcx
mov ecx, dword [rax + 8]
mov edx, 0x6a138197
xor ecx, edx
mov dword [rsp + 0x80], ecx
mov al, byte [rax + 0xc]
xor al, 0x67
mov byte [rsp + 0x84], al
lea rax, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 0xd
lea rdi, [rsp + 0x88]
mov qword [rsp + 0x130], rdi
lea rax, [0x140134850]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rbx
lea rax, [0x14005ef90]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x170], 0
lea rax, str.dest_is_out_of_bounds
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], 3
mov qword [rsp + 0x190], r15
mov eax, 2
mov qword [rsp + 0x198], rax
lea rcx, [rsp + 0xf0]
mov rdx, r13
call fcn.140053dd0
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x100]
lea rax, [0x1403b9bdc]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x88]
movabs rax, 0x5208091f7d801ab2
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
call fcn.140203ab9
mov ecx, dword [rax]
movzx edx, byte [rax + 6]
movzx eax, word [rax + 4]
xor eax, 0x2e43
xor dl, 0xb1
movzx edx, dl
mov byte [rsp + 0x66], dl
shl rdx, 0x30
shl rax, 0x20
or rax, rdx
xor rcx, 0x7e0bc9bd
mov dword [rsp + 0x60], ecx
shr rax, 0x20
mov word [rsp + 0x64], ax
mov r8d, 7
mov rcx, r13
lea rdx, [rsp + 0x60]
call fcn.14025fd40
mov dword [rsp + 0x218], 0x8000000
lea rax, [0x1403bef60]
mov qword [rsp + 0x88], rax
mov eax, 2
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rsi
xor esi, esi
mov rdx, qword [rsp + rsi + 0x88]
mov r8, qword [rsp + rsi + 0x90]
mov rcx, r13
call fcn.14025fe30
add rsi, 0x10
cmp rsi, 0x20
jne 0x140020883
mov rbp, r15
mov rcx, r15
mov rdx, r13
call fcn.14024e2d0
mov r15, qword [rsp + 0x130]
mov rax, qword [rsp + 0x140]
cmp rax, 2
je 0x140020b3d
mov rdi, rbx
mov rcx, qword [rsp + 0x138]
lea rsi, [rsp + 0x148]
mov rdx, qword [rsi + 0x20]
lea rbx, [rsp + 0x108]
mov qword [rbx + 0x20], rdx
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xf8], rcx
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x100], 0
test rax, rax
je 0x14002092d
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, r15
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x14002097b
call sub.KERNEL32.DLL_GetLastError
mov rbx, rdi
mov r15, rbp
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x48]
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x78], 1
lea rcx, [rsp + 0x80]
call fcn.14007ddf7
jmp 0x1400209a6
mov dword [rsp + 0x130], 0
mov rcx, r15
mov r15, rbp
mov rdx, rbp
call qword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
mov rbx, rdi
mov rsi, qword [rsp + 0x48]
je 0x1400209ee
mov rbp, qword [rsp + 0x68]
add rbp, 0x29c
lea rcx, [rsp + 0xf0]
call fcn.140006090
mov rcx, r13
call fcn.1400066cb
test rsi, rsi
je 0x1400209de
mov rcx, qword [0x14051f200]
xor edx, edx
mov r8, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_HeapFree]
cmp rbp, qword [rsp + 0xc8]
jne 0x140020672
jmp 0x1400209fd
call sub.KERNEL32.DLL_GetLastError
mov rbp, qword [rsp + 0x68]
jmp 0x140020954
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x58]
call fcn.140053680
mov r13, qword [rsp + 0x70]
mov rdx, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
lea r15, [rsp + 0x4c8]
mov rcx, r15
call fcn.140054330
mov rdx, qword [r12 + 8]
mov r8, qword [r12 + 0x10]
lea rbp, [rsp + 0x220]
mov rcx, rbp
call fcn.140054330
lea rbx, [rsp + 0x170]
mov rcx, rbx
mov rdx, r15
mov r8, rbp
call fcn.140200955
cmp qword [rbx], 0
je 0x140020aab
lea rcx, [rsp + 0x178]
call fcn.14007ddf7
cmp qword [rsp + 0xd0], 0
je 0x140020a91
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14051f200]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov byte [r13 + 8], 0
mov qword [r13], 0
cmp qword [rsp + 0xb8], 0
jne 0x140020ae7
jmp 0x140020af4
mov byte [r13 + 8], 1
mov qword [r13], 0
mov rsi, qword [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0
je 0x140020ae2
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14051f200]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
test rsi, rsi
je 0x140020af4
lea rcx, [rsp + 0xc0]
call fcn.14007ddf7
cmp qword [r12], 0
je 0x140020b0f
mov r8, qword [r12 + 8]
mov rcx, qword [0x14051f200]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
cmp qword [r14], 0
je 0x140020b28
mov r8, qword [r14 + 8]
mov rcx, qword [0x14051f200]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
nop
add rsp, 0x768
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.1401cfbf4
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
lea rax, fcn.14007ddf7
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x170]
call fcn.1400066cb
cmp qword [rsp + 0x48], 0
je 0x140020b84
mov rcx, qword [0x14051f200]
xor edx, edx
mov r8, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x58]
call fcn.140053680
jmp 0x140020ab8
call fcn.1400535c0
ud2
mov rcx, rbp
mov rdx, rbx
call fcn.1403af440
ud2
lea rax, [0x1404ec760]
mov qword [rsp + 0x20], rax
lea rcx, str.a_Display_implementation_returned_an_error_unexpectedly_rustc_d5a82bbd26e1ad8b7401f6a718a9c57c96905483library_alloc_src_string.rs
lea r9, [0x1403bd498]
lea r8, [rsp + 0x170]
mov edx, 0x37
call fcn.1403afcb0
ud2
mov edx, 4
mov rcx, rbp
jmp 0x140020ba8