Function at 0x180015830
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2670]
mov eax, 0x2770
call fcn.180038bd0
sub rsp, rax
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x27b0], rbx
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp + 0x2660], rax
mov qword [rbp - 0x38], r8
mov r13, rdx
xor r12d, r12d
mov qword [rdx], r12
call fcn.1800155d0
mov dword [rbp - 0x40], eax
cmp eax, 0xffffffff
je 0x1800161a4
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
lea rcx, str.Psapi.dll
call fcn.180042f9c
mov r15, rax
movabs rsi, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [r12 - 1]
mov r14, qword [rsp + 0x78]
cmp rax, r14
ja 0x180015914
lea rdi, [rsp + 0x60]
cmp r14, 8
cmovae rdi, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.Psapi.dll
mov rcx, rdi
call fcn.180039700
mov word [rbx + rdi], r12w
jmp 0x180015a0d
cmp r15, rsi
ja 0x1800161d6
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x18001592e
mov rbx, rsi
jmp 0x18001594f
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180015944
mov rbx, rsi
jmp 0x18001594f
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x180015961
mov rdx, r8
jmp 0x18001596a
cmp rdx, 0x1000
jb 0x180015991
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.180037bfc
test rax, rax
je 0x1800161dc
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800159a6
test rdx, rdx
je 0x1800159a3
mov rcx, rdx
call fcn.180037bfc
mov rdi, rax
jmp 0x1800159a6
mov rdi, r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.Psapi.dll
mov rcx, rdi
call fcn.180039700
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x180015a08
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015a03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800161e2
call fcn.180037bf4
mov qword [rsp + 0x60], rdi
call fcn.180018aa0
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.180018b40
mov r12, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180015a64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015a5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800161e8
call fcn.180037bf4
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
lea rcx, str.Advapi32.dll
call fcn.180042f9c
mov r15, rax
mov r14, qword [rbp - 0x68]
cmp rax, r14
ja 0x180015adb
lea rdi, [rbp - 0x80]
cmp r14, 8
cmovae rdi, qword [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.Advapi32.dll
mov rcx, rdi
call fcn.180039700
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x180015be4
cmp r15, rsi
ja 0x1800161ee
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x180015af5
mov rbx, rsi
jmp 0x180015b16
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180015b0b
mov rbx, rsi
jmp 0x180015b16
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180015b39
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180015b49
cmp rdx, 0x1000
jb 0x180015b70
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.180037bfc
test rax, rax
je 0x1800161f4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180015b80
test rdx, rdx
je 0x180015b80
mov rcx, rdx
call fcn.180037bfc
mov rdi, rax
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.Advapi32.dll
mov rcx, rdi
call fcn.180039700
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x180015be0
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015bdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800161fa
call fcn.180037bf4
mov qword [rbp - 0x80], rdi
call fcn.180018aa0
mov rcx, rax
lea rdx, [rbp - 0x80]
call fcn.180018b40
mov r15, rax
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x180015c38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015c33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016200
call fcn.180037bf4
xor edi, edi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
lea rcx, str.Wtsapi32.dll
call fcn.180042f9c
mov rbx, rax
mov r14, qword [rbp - 0x48]
cmp rax, r14
ja 0x180015cab
lea rdi, [rbp - 0x60]
cmp r14, 8
cmovae rdi, qword [rbp - 0x60]
mov qword [rbp - 0x50], rax
add rbx, rbx
mov r8, rbx
lea rdx, str.Wtsapi32.dll
mov rcx, rdi
call fcn.180039700
xor esi, esi
mov word [rbx + rdi], si
jmp 0x180015dac
cmp rbx, rsi
ja 0x180016206
mov rcx, rbx
or rcx, 7
cmp rcx, rsi
ja 0x180015cdf
mov rdx, r14
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp r14, rax
ja 0x180015cdf
lea rax, [r14 + rdx]
mov rsi, rcx
cmp rcx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180015d02
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180015d12
cmp rdx, 0x1000
jb 0x180015d39
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.180037bfc
test rax, rax
je 0x18001620c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180015d49
test rdx, rdx
je 0x180015d49
mov rcx, rdx
call fcn.180037bfc
mov rdi, rax
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rsi
add rbx, rbx
mov r8, rbx
lea rdx, str.Wtsapi32.dll
mov rcx, rdi
call fcn.180039700
xor esi, esi
mov word [rdi + rbx], si
cmp r14, 8
jb 0x180015da8
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015da3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016212
call fcn.180037bf4
mov qword [rbp - 0x60], rdi
call fcn.180018aa0
mov rcx, rax
lea rdx, [rbp - 0x60]
call fcn.180018b40
mov rbx, rax
mov qword [rbp - 0x20], rax
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x180015e04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015dff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800161d0
call fcn.180037bf4
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], si
test r12, r12
je 0x1800161a4
test r15, r15
je 0x1800161a4
test rbx, rbx
je 0x1800161a4
lea rdx, str.EnumProcesses
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.GetModuleFileNameExA
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rsp + 0x58], rax
lea rdx, str.GetProcessImageFileNameA
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rdx, str.OpenProcessToken
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rbp - 0x30], rax
lea rdx, str.GetTokenInformation
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x28], rax
test rbx, rbx
je 0x1800161a4
test rsi, rsi
jne 0x180015eb4
test rdi, rdi
je 0x1800161a4
test r14, r14
je 0x1800161a4
test rax, rax
je 0x1800161a4
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x10]
call fcn.180039b90
xor r14d, r14d
mov dword [rbp - 4], r14d
lea r8, [rbp - 4]
mov edx, 0x2000
lea rcx, [rbp + 0x10]
call rbx
test eax, eax
je 0x1800161a4
mov r15d, dword [rbp - 4]
shr r15d, 2
mov eax, 0x800
cmp r15d, eax
cmovae r15d, eax
mov dword [rbp - 8], r14d
mov dword [rbp + 4], r14d
mov r12d, r14d
test r15d, r15d
je 0x18001619a
lea r14, [rbp + 0x10]
xor edx, edx
mov r8d, 0x209
lea rcx, [rbp + 0x2450]
call fcn.180039b90
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2340]
call fcn.180039b90
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2230]
call fcn.180039b90
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2010]
call fcn.180039b90
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2120]
call fcn.180039b90
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x180015fb9
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001616f
test rdi, rdi
je 0x180015fd4
mov r8d, 0x208
lea rdx, [rbp + 0x2450]
mov rcx, rbx
call rdi
test eax, eax
jne 0x180015ff9
test rsi, rsi
je 0x18001614c
mov r9d, 0x208
lea r8, [rbp + 0x2450]
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
je 0x18001614c
mov qword [rsp + 0x40], 0x104
lea rax, [rbp + 0x2120]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rbp + 0x2010]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x2230]
mov r8d, 0x104
lea rdx, [rbp + 0x2340]
lea rcx, [rbp + 0x2450]
call fcn.180046dc4
lea rdx, [rbp + 0x2010]
lea rcx, str.explorer
call fcn.180046a30
test eax, eax
jne 0x18001614c
lea rdx, [rbp + 0x2120]
lea rcx, str..exe
call fcn.180046a30
test eax, eax
jne 0x18001614c
mov r8, r13
mov edx, 0x2000e
mov rcx, rbx
call qword [rbp - 0x30]
test eax, eax
je 0x18001614c
mov rcx, qword [r13]
test rcx, rcx
je 0x180016161
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 8]
lea edx, [r9 + 8]
call qword [rbp - 0x28]
test eax, eax
je 0x18001614c
mov eax, dword [rbp - 0x40]
cmp dword [rbp - 8], eax
je 0x180016188
lea rdx, str.WTSQuerySessionInformationW
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.WTSFreeMemory
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x180016142
test rax, rax
je 0x180016142
xor eax, eax
mov qword [rbp - 0x10], rax
mov dword [rbp], eax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 8
mov edx, dword [rbp - 8]
xor ecx, ecx
call rsi
test eax, eax
je 0x180016142
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x180016142
cmp dword [rbp], 4
jne 0x180016140
cmp dword [rcx], 0
je 0x180016180
call rdi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rcx, qword [r13]
test rcx, rcx
je 0x180016161
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [r13], rax
test rbx, rbx
je 0x18001616f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12d
add r14, 4
cmp r12d, r15d
jae 0x18001619a
jmp 0x180015f21
call rdi
xor eax, eax
mov qword [rbp - 0x10], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
mov eax, dword [rbp - 8]
mov dword [rcx], eax
cmp qword [r13], 0
setne al
jmp 0x1800161a6
xor al, al
mov rcx, qword [rbp + 0x2660]
xor rcx, rsp
call fcn.180037bd0
mov rbx, qword [rsp + 0x27b0]
add rsp, 0x2770
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180042f24
int3
call fcn.180001ee0
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180001ee0
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180042f24
int3
call fcn.180001ee0
int3
call fcn.180042f24
int3
call fcn.180042f24
int3