Function at 0x1402114e5
Capabilities:
Create restart manager session
Encode data using xor
Enumerate processes that use resource

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x748
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov rdx, qword [rdx + 8]
mov r8, qword [rsi + 0x10]
lea rbx, [rsp + 0x4a8]
mov rcx, rbx
call fcn.140047c30
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
lea r15, [rsp + 0x200]
mov rcx, r15
call fcn.140047c30
lea r12, [rsp + 0xa0]
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1401f7d3a
cmp qword [r12], 0
je 0x14021160b
mov dword [rsp + 0x44], 0
lea rax, [0x14048d18c]
mov qword [rsp + 0x200], rax
mov rcx, qword [rsp + 0x200]
movabs rax, 0xdc477c03c72f4f38
mov qword [rsp + 0x200], rax
mov rdx, qword [rsp + 0x200]
call fcn.14000caaa
xorps xmm0, xmm0
movaps xmmword [rsp + 0x200], xmm0
movaps xmmword [rsp + 0x210], xmm0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x140498f00]
mov r8, qword [rcx + rdx + 8]
xor r8, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0x208], r8
add rcx, 8
cmp rcx, 0x18
jb 0x1402115b1
mov ecx, 0x96bec389
xor ecx, dword [rax + 0x20]
mov dword [rsp + 0x220], ecx
mov al, byte [rax + 0x24]
xor al, 0x2e
mov byte [rsp + 0x224], al
mov dl, byte [rsp + 0x200]
movzx r15d, dl
test r15b, r15b
mov qword [rsp + 0x88], rdi
js 0x14021161c
mov r13d, 1
jmp 0x1402116ae
mov byte [rbp + 8], 1
mov qword [rbp], 0
jmp 0x140211f8c
mov eax, r15d
and eax, 0x1f
movzx r8d, byte [rsp + 0x201]
and r8d, 0x3f
cmp r15b, 0xdf
jbe 0x140211682
movzx ecx, byte [rsp + 0x202]
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
cmp dl, 0xf0
jb 0x140211693
movzx r15d, byte [rsp + 0x203]
and eax, 7
shl eax, 0x12
shl ecx, 6
and r15d, 0x3f
or r15d, ecx
or r15d, eax
mov r13d, 4
cmp r15d, 0x110000
jne 0x1402116a1
mov r15d, 2
jmp 0x14021185b
shl eax, 6
or eax, r8d
mov r13d, 2
mov r15d, eax
jmp 0x1402116ae
shl eax, 0xc
or ecx, eax
mov r13d, 3
mov r15d, ecx
cmp r15d, 0xffff
ja 0x140211a30
mov rdi, rbp
xor ebx, ebx
lea rbp, [rsp + 0x225]
lea rax, [rsp + r13]
add rax, 0x200
mov rdx, rbp
sub rdx, rax
add rdx, 3
shr rdx, 2
cmp rdx, 4
mov ecx, 3
cmovae rcx, rdx
inc rcx
call fcn.14021d234
mov word [rdx], r15w
lea r15, [rsp + 0x4a8]
mov qword [r15], rax
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], 1
mov r12d, 1
test bx, bx
jne 0x1402117ad
cmp r13, 0x25
je 0x140211823
mov r8b, byte [rsp + r13 + 0x200]
movzx ebx, r8b
test bl, bl
js 0x140211731
inc r13
jmp 0x1402117ad
mov eax, ebx
and eax, 0x1f
movzx r9d, byte [rsp + r13 + 0x201]
and r9d, 0x3f
cmp bl, 0xdf
jbe 0x14021178c
movzx ecx, byte [rsp + r13 + 0x202]
shl r9d, 6
and ecx, 0x3f
or ecx, r9d
cmp r8b, 0xf0
jb 0x14021179a
movzx ebx, byte [rsp + r13 + 0x203]
and eax, 7
shl eax, 0x12
shl ecx, 6
and ebx, 0x3f
or ebx, ecx
or ebx, eax
cmp ebx, 0x110000
je 0x140211823
add r13, 4
jmp 0x1402117a5
add r13, 2
shl eax, 6
or eax, r9d
mov ebx, eax
jmp 0x1402117ad
add r13, 3
shl eax, 0xc
or ecx, eax
mov ebx, ecx
cmp ebx, 0xffff
ja 0x140211802
xor r14d, r14d
cmp r12, qword [rsp + 0x4a8]
je 0x1402117d2
mov word [rdx + r12*2], bx
inc r12
mov qword [rsp + 0x4b8], r12
mov ebx, r14d
jmp 0x140211709
lea rax, [rsp + r13]
add rax, 0x200
mov r8, rbp
sub r8, rax
add r8, 3
shr r8, 2
inc r8
mov rcx, r15
mov rdx, r12
call fcn.1403999b8
mov rdx, qword [rsp + 0x4b0]
jmp 0x1402117ba
lea eax, [rbx + 0xff0000]
shr eax, 0xa
or eax, 0xd800
and ebx, 0x3ff
or ebx, 0xdc00
mov r14d, ebx
mov ebx, eax
jmp 0x1402117b0
mov r15, qword [rsp + 0x4b0]
cmp qword [rsp + 0x4a8], 0
je 0x140211848
mov rcx, qword [0x1404fd180]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, rdi
mov rdi, qword [rsp + 0x88]
lea rbx, [rsp + 0x4a8]
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8, r15
call qword [sym.imp.rstrtmgr.dll_RmStartSession]
test eax, eax
je 0x140211895
call sub.kernel32.dll_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.1401b10ae
mov qword [rbp], rax
lea rax, fcn.1401b10eb
mov qword [rbp + 8], rax
jmp 0x140211f7f
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
xor eax, eax
mov qword [rsp + 0x4a8], rax
mov qword [rsp + 0x4b0], 1
mov qword [rsp + 0x4b8], rax
movabs r9, 0x2000000000
lea r8, [rsp + 0x200]
mov qword [r8 + 0x30], r9
mov byte [r8 + 0x38], 3
mov qword [r8 + 0x10], rax
mov qword [r8 + 0x20], rax
mov qword [r8], rbx
lea rax, fcn.140071130
mov qword [r8 + 8], rax
call fcn.14022cfb0
test al, al
jne 0x140212023
mov rax, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x4b8]
add rcx, rax
lea rdx, [rsp + 0x200]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rcx, [rsp + 0x130]
call fcn.14021d7ee
cmp qword [rsp + 0x4a8], 0
je 0x140211957
mov r8, qword [rsp + 0x4b0]
mov rcx, qword [0x1404fd180]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [rsp + 0x44]
mov rax, qword [rsp + 0x138]
lea r15, [rsp + 0x200]
mov qword [r15], rax
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 0
mov edx, 1
mov r8, r15
xor r9d, r9d
call qword [sym.imp.rstrtmgr.dll_RmRegisterResources]
test eax, eax
je 0x1402119c3
call sub.kernel32.dll_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.1401b10ae
mov qword [rbp], rax
lea rax, fcn.1401b10eb
mov qword [rbp + 8], rax
mov ebx, 1
jmp 0x140211f58
lea rdx, [rsp + 0x48]
mov dword [rdx], r14d
lea r8, [rsp + 0x4c]
mov dword [r8], r14d
lea rbx, [rsp + 0x14c]
mov dword [rbx], r14d
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
call qword [sym.imp.rstrtmgr.dll_RmGetList]
test eax, eax
je 0x140211a5b
cmp eax, 0xea
jne 0x140211eaf
mov eax, dword [rsp + 0x48]
test rax, rax
mov qword [rsp + 0x68], rax
je 0x140211a64
imul r14, rax, 0x29c
mov edx, 4
mov rcx, r14
call fcn.140020b50
test rax, rax
je 0x140212051
mov ecx, dword [rsp + 0x48]
jmp 0x140211a6b
mov rdi, rbp
lea eax, [r15 + 0xff0000]
shr eax, 0xa
or eax, 0xd800
and r15d, 0x3ff
or r15d, 0xdc00
mov ebx, r15d
mov r15d, eax
jmp 0x1402116b3
mov byte [rbp + 8], 0
jmp 0x140211f48
xor ecx, ecx
mov eax, 4
lea r8, [rsp + 0x4c]
mov dword [r8], ecx
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov r9, rax
call qword [sym.imp.rstrtmgr.dll_RmGetList]
test eax, eax
je 0x140211ad8
call sub.kernel32.dll_GetLastError
shl rax, 0x20
lea rcx, [rax + 2]
call fcn.1401b10ae
mov qword [rbp], rax
lea rax, fcn.1401b10eb
mov qword [rbp + 8], rax
cmp dword [rsp + 0x68], 0
je 0x140211f50
mov rcx, qword [0x1404fd180]
xor edx, edx
mov r8, qword [rsp + 0x60]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140211f50
mov qword [rsp + 0x70], rbp
mov eax, dword [rsp + 0x4c]
test rax, rax
je 0x140211e8f
imul rcx, rax, 0x29c
mov r14, qword [rsp + 0x60]
add rcx, r14
mov qword [rsp + 0x110], rcx
lea rbp, [rsp + 0x150]
mov r8d, 0x29c
lea rbx, [rsp + 0x4a8]
mov rcx, rbx
mov qword [rsp + 0x128], r14
mov rdx, r14
call fcn.14038a820
mov r8d, 0x29c
mov rcx, r15
mov rdx, rbx
call fcn.14038a820
lea rax, [0x140495c53]
mov qword [rsp + 0x150], rax
mov rcx, qword [rsp + 0x150]
movabs rax, 0x2194e5f903348ac7
mov qword [rsp + 0x150], rax
mov rdx, qword [rsp + 0x150]
call fcn.14000bd1e
mov rcx, qword [rax]
movabs rdx, 0xf92d4798bd79f573
xor rcx, rdx
mov qword [rsp + 0x50], rcx
mov ecx, dword [rax + 8]
mov edx, 0x6a138197
xor ecx, edx
mov dword [rsp + 0x58], ecx
mov al, byte [rax + 0xc]
xor al, 0x67
mov byte [rsp + 0x5c], al
lea r14, [rsp + 0x50]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], 0xd
lea rax, [rsp + 0x90]
mov qword [rsp + 0xd0], rax
lea rax, [0x140071250]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], r15
lea rax, [0x140053d00]
mov qword [rsp + 0xe8], rax
lea rax, [0x140498f28]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 3
mov qword [rsp + 0x150], 0
lea r12, [rsp + 0xd0]
mov qword [rsp + 0x170], r12
mov r13d, 2
mov qword [rsp + 0x178], r13
lea rcx, [rsp + 0xb0]
mov rdx, rbp
call fcn.1400476f0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rax
mov r14, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
lea rax, str.usernamepassword
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xd0]
movabs rax, 0x5208091f7d801ab2
mov qword [rsp + 0xd0], rax
mov rdx, qword [rsp + 0xd0]
call fcn.14000d3bc
mov ecx, dword [rax]
movzx edx, byte [rax + 6]
movzx eax, word [rax + 4]
xor eax, 0x2e43
xor dl, 0xb1
movzx edx, dl
mov byte [rsp + 0x56], dl
shl rdx, 0x30
shl rax, 0x20
or rax, rdx
xor ecx, 0x7e0bc9bd
mov dword [rsp + 0x50], ecx
shr rax, 0x20
mov word [rsp + 0x54], ax
mov r8d, 7
mov rcx, rbp
lea rdx, [rsp + 0x50]
call fcn.140248e00
mov dword [rsp + 0x1f8], 0x8000000
lea rax, [0x140498f58]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0x78], r14
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], rbx
xor ebx, ebx
mov rdx, qword [rsp + rbx + 0xb0]
mov r8, qword [rsp + rbx + 0xb8]
mov rcx, rbp
call fcn.140248ee0
add rbx, 0x10
cmp rbx, 0x20
jne 0x140211d1a
lea rcx, [rsp + 0xd0]
mov rdx, rbp
xor r8d, r8d
mov r9b, 1
call fcn.140238950
mov r12, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xe0]
cmp rax, 2
je 0x140211fd3
mov r13, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x118], rcx
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x120], rcx
test rax, rax
je 0x140211db7
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, r12
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x140211df8
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x90], 1
lea rcx, [rsp + 0x98]
call fcn.1401b10eb
jmp 0x140211e18
mov dword [rsp + 0xd0], 0
mov rcx, r12
lea rdx, [rsp + 0xd0]
call qword [sym.imp.kernel32.dll_GetExitCodeProcess]
test eax, eax
je 0x140211dc9
mov rcx, r12
mov r12, qword [sym.imp.kernel32.dll_CloseHandle]
call r12
mov rcx, r13
call r12
test r14, r14
je 0x140211e3b
mov rcx, qword [rsp + 0x118]
call r12
test rbx, rbx
mov r14, qword [rsp + 0x128]
je 0x140211e53
mov rcx, qword [rsp + 0x120]
call r12
add r14, 0x29c
mov rcx, rbp
call fcn.14020d568
cmp qword [rsp + 0x80], 0
je 0x140211e81
mov rcx, qword [0x1404fd180]
xor edx, edx
mov r8, qword [rsp + 0x78]
call qword [sym.imp.kernel32.dll_HeapFree]
cmp r14, qword [rsp + 0x110]
jne 0x140211b09
cmp dword [rsp + 0x68], 0
mov rbp, qword [rsp + 0x70]
je 0x140211eaf
mov rcx, qword [0x1404fd180]
xor edx, edx
mov r8, qword [rsp + 0x60]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea r14, [rsp + 0x4a8]
mov rcx, r14
call fcn.140047c30
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
lea r15, [rsp + 0x200]
mov rcx, r15
call fcn.140047c30
lea r12, [rsp + 0x150]
mov rcx, r12
mov rdx, r14
mov r8, r15
call fcn.1401f7d3a
cmp qword [r12], 0
je 0x140211f44
lea rcx, [rsp + 0x158]
call fcn.1401b10eb
cmp qword [rsp + 0x130], 0
je 0x140211f2b
mov r8, qword [rsp + 0x138]
mov rcx, qword [0x1404fd180]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov byte [rbp + 8], 0
mov qword [rbp], 0
cmp qword [rsp + 0xa0], 0
jne 0x140211f7f
jmp 0x140211f8c
mov byte [rbp + 8], 1
mov qword [rbp], 0
mov rbx, qword [rsp + 0xa0]
cmp qword [rsp + 0x130], 0
je 0x140211f7a
mov r8, qword [rsp + 0x138]
mov rcx, qword [0x1404fd180]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
test rbx, rbx
je 0x140211f8c
lea rcx, [rsp + 0xa8]
call fcn.1401b10eb
cmp qword [rdi], 0
je 0x140211fa5
mov r8, qword [rdi + 8]
mov rcx, qword [0x1404fd180]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsi], 0
je 0x140211fbe
mov r8, qword [rsi + 8]
mov rcx, qword [0x1404fd180]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x748
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call fcn.1401b10ae
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
lea rax, fcn.1401b10eb
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x150]
call fcn.14020d568
cmp qword [rsp + 0x80], 0
je 0x140211ab4
mov rcx, qword [0x1404fd180]
xor edx, edx
mov r8, qword [rsp + 0x78]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140211ab4
lea rax, [0x1404ca0f0]
mov qword [rsp + 0x20], rax
lea rcx, str.a_Display_implementation_returned_an_error_unexpectedly_rustc_88fb1b922b047981fc0cfc62aa1418b4361ae72elibrary_alloc_src_string.rs
lea r9, [0x140497fb8]
lea r8, [rsp + 0x150]
mov edx, 0x37
call fcn.14038ebe0
ud2
mov edx, 4
mov rcx, r14
call fcn.14038e430
ud2