Function at 0x18001f700
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2670]
mov eax, 0x2770
call fcn.1800bc710
sub rsp, rax
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x27b0], rbx
mov rax, qword [0x180122010]
xor rax, rsp
mov qword [rbp + 0x2660], rax
mov qword [rsp + 0x60], r8
mov r14, rdx
xor r13d, r13d
mov qword [rdx], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x1800e3630]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r13w
lea rdx, str.Kernel32.dll
lea rcx, [rsp + 0x68]
call fcn.1800034f0
nop
call fcn.180025220
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.180025300
mov rbx, rax
lea rcx, [rsp + 0x68]
call fcn.180003470
test rbx, rbx
je 0x18001fc47
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001fc47
call rax
mov dword [rsp + 0x58], eax
cmp eax, 0xffffffff
je 0x18001fc47
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x1800e3630]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r13w
lea rdx, str.Psapi.dll
lea rcx, [rsp + 0x68]
call fcn.1800034f0
nop
call fcn.180025220
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.180025300
mov rdi, rax
lea rcx, [rsp + 0x68]
call fcn.180003470
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x1800e3630]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r13w
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x58]
call fcn.1800034f0
nop
call fcn.180025220
mov rcx, rax
lea rdx, [rbp - 0x58]
call fcn.180025300
mov rbx, rax
lea rcx, [rbp - 0x58]
call fcn.180003470
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x1800e3630]
movdqu xmmword [rbp - 0x28], xmm1
mov word [rbp - 0x38], r13w
lea rdx, str.Wtsapi32.dll
lea rcx, [rbp - 0x38]
call fcn.1800034f0
nop
call fcn.180025220
mov rcx, rax
lea rdx, [rbp - 0x38]
call fcn.180025300
mov rsi, rax
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x38]
call fcn.180003470
test rdi, rdi
je 0x18001fc47
test rbx, rbx
je 0x18001fc47
test rsi, rsi
je 0x18001fc47
lea rdx, str.EnumProcesses
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.GetModuleFileNameExA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rbp - 0x78], rax
lea rdx, str.GetProcessImageFileNameA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rdx, str.OpenProcessToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rbp - 0x70], rax
lea rdx, str.GetTokenInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x68], rax
test rsi, rsi
je 0x18001fc47
test r15, r15
jne 0x18001f950
test rdi, rdi
je 0x18001fc47
test r12, r12
je 0x18001fc47
test rax, rax
je 0x18001fc47
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 4], r13d
lea r8, [rbp - 4]
mov edx, 0x2000
lea rcx, [rbp + 0x10]
call rsi
test eax, eax
je 0x18001fc47
mov r12d, dword [rbp - 4]
shr r12d, 2
mov eax, 0x800
cmp r12d, eax
cmovae r12d, eax
mov dword [rbp - 8], r13d
mov dword [rbp + 4], r13d
test r12d, r12d
je 0x18001fc3e
lea r15, [rbp + 0x10]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x209
lea rcx, [rbp + 0x2450]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2340]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2230]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2010]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2120]
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [r15]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x18001fa58
mov r8d, dword [r15]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001fc10
test rdi, rdi
je 0x18001fa73
mov r8d, 0x208
lea rdx, [rbp + 0x2450]
mov rcx, rbx
call rdi
test eax, eax
jne 0x18001fa9c
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x18001fbed
mov r9d, 0x208
lea r8, [rbp + 0x2450]
xor edx, edx
mov rcx, rbx
call rax
test eax, eax
je 0x18001fbed
mov qword [rsp + 0x40], 0x104
lea rax, [rbp + 0x2120]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rbp + 0x2010]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x2230]
mov r8d, 0x104
lea rdx, [rbp + 0x2340]
lea rcx, [rbp + 0x2450]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath_s]
lea rdx, [rbp + 0x2010]
lea rcx, str.explorer
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x18001fbed
lea rdx, [rbp + 0x2120]
lea rcx, [0x1800dd994]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x18001fbed
mov r8, r14
mov edx, 0x2000e
mov rcx, rbx
call qword [rbp - 0x70]
test eax, eax
je 0x18001fbed
mov rcx, qword [r14]
test rcx, rcx
je 0x18001fc02
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 8]
lea edx, [r9 + 8]
call qword [rbp - 0x68]
test eax, eax
je 0x18001fbed
mov eax, dword [rsp + 0x58]
cmp dword [rbp - 8], eax
je 0x18001fc2b
lea rdx, str.WTSQuerySessionInformationW
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.WTSFreeMemory
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x18001fbe8
test rax, rax
je 0x18001fbe8
xor eax, eax
mov qword [rbp - 0x10], rax
mov dword [rbp], eax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 8
mov edx, dword [rbp - 8]
xor ecx, ecx
call rsi
test eax, eax
je 0x18001fbe8
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x18001fbe8
cmp dword [rbp], 4
jne 0x18001fbe6
cmp dword [rcx], 0
je 0x18001fc21
call rdi
mov rdi, qword [rsp + 0x50]
mov rcx, qword [r14]
test rcx, rcx
je 0x18001fc02
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14], 0
test rbx, rbx
je 0x18001fc10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13d
add r15, 4
cmp r13d, r12d
jae 0x18001fc3e
jmp 0x18001f9c0
call rdi
mov qword [rbp - 0x10], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rbp - 8]
mov dword [rcx], eax
cmp qword [r14], 0
setne al
jmp 0x18001fc49
xor al, al
mov rcx, qword [rbp + 0x2660]
xor rcx, rsp
call fcn.1800ba9e0
mov rbx, qword [rsp + 0x27b0]
add rsp, 0x2770
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret